{ "Event": { "published": true, "date": "2026-07-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-08", "timestamp": 1783555382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4ef8bb47-bf03-43bc-b463-d5c3dee2e1e8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea07f8cd-7adb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783522036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522036, "uuid": "0b2550f3-1de6-4424-9b7e-908d1db6cd99", "comment": "Malware payload (Mirai)", "value": "05fa132565aba47df3d8bd41e60c5f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522036, "uuid": "ae5d9074-bc09-4951-a69b-39cf85b801cf", "comment": "Malware payload (Mirai)", "value": "00423a283cfa8baed7018cc00e9c82785231dcdfb53d615104002714c36e1c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522036, "uuid": "505f1941-21ed-4897-91a0-fe81c5542ab8", "comment": "Malware payload (Mirai)", "value": "d449cf8ade5238894e28592c2505a50878a49ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522036, "uuid": "692719d3-4421-4eb9-be22-a57e157a8e42", "comment": "Malware payload (Mirai)", "value": "e8b45a180b66588499e74ce26300e2225bce1810f42f256f557dbbe716b5c0a4fe771d54e590705d203c215163e6f8b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522036, "uuid": "0f4dbbe2-6eea-434f-af84-cbb0034ad22e", "value": "T1B8456B57B6F364FEC053C430879BD6A2A935B42542322E7F61C4CA302FA7E641B1DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522036, "uuid": "beb8bfc0-81d6-4dae-90f9-3b1779378f95", "value": "24576:QndCzR4kDUY3mcL/qqjz3/Fq4jzrcegG7uPhV2Agv8DHS:QndYR4kDUumqdqirtgGaHgv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783522036, "uuid": "772d754e-11a3-43d4-b31b-c11ae847511c", "value": 1214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783522036, "uuid": "ca98bd80-8db2-4594-b6df-6313f7c2ba88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522036, "uuid": "8e6028ac-124e-4556-a3cd-f7cb9a11af89", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211725d6-7b10-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783544463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544463, "uuid": "2ae72d3f-00f6-4a9e-8d45-0b567e27b9fc", "comment": "Malware payload (Mirai)", "value": "82fe7a216f51b5c267843216ca787173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544463, "uuid": "b7dc860a-c6fc-4b2f-a8d1-e68cb114d0d7", "comment": "Malware payload (Mirai)", "value": "0160a27a27c97b62864fe40e7b0bf51e17fce63d980f69e415b48950a4b34af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544463, "uuid": "25a003d9-287e-412a-9c6e-a81bdc45caec", "comment": "Malware payload (Mirai)", "value": "7e2daadd7fe0aaf943e42d0e14b49e0095eecb54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544463, "uuid": "aa3454fa-d10a-4fda-9417-45974b9e5395", "comment": "Malware payload (Mirai)", "value": "7b8fd50ec6f7b460198021bb76056535ce84d5b5213d5536931cbaba693952358e33a78f8f347af686ef197fcedc19b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544463, "uuid": "c2f861df-96c8-4193-be4e-cd2beccb450e", "value": "T168636DC6AE43E0F5EC934675003BA7578F36E5365538DB46DBA52832AC13E009B1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544463, "uuid": "0adfd964-a5d4-49da-a779-baed14c06d72", "value": "1536:cCxHavLbmu2rMYZiRC+uPQTQLGJKrOJyvewq3FR81lkKn5v5N4GfeSgEt:fs3m5FkC+xVJJ341W0p2Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783544463, "uuid": "ba077fc0-7b8e-40df-8d8e-a9d7972e445a", "value": 72116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783544463, "uuid": "840d1d6c-dc7b-4f7c-8a16-a6ac870a983b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544463, "uuid": "160f3b50-acc7-4c41-98d1-38ef1ded3abd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e280f42-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517104, "uuid": "239d3dab-8428-481b-a3c7-a99bc43de35c", "comment": "Malware payload (ConnectWise)", "value": "3d4d54fb1aaa70005f040558b5d4cd0c", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517104, "uuid": "4476ca72-9099-4825-a5ec-b2e110ff4460", "comment": "Malware payload (ConnectWise)", "value": "01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517104, "uuid": "16a531d2-d6cc-4daf-9ffd-6d648d31b001", "comment": "Malware payload (ConnectWise)", "value": "5731b2f26146fe379f27bbfc5608f4e9ab11a9d3", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517104, "uuid": "3e23c5f4-2c70-46ca-b9bf-017730cd8415", "comment": "Malware payload (ConnectWise)", "value": "62efa9ec2754ac35dbe2908019ce5c9901b60197a9d701f9c0a39852b6135061880bca0467918a576f9d2589bd5cc530", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517104, "uuid": "5041bab1-78a2-400a-9ae8-4c8720e13dee", "value": "T14CD622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517104, "uuid": "25d22fde-e0f3-448b-974a-3a20a68279ef", "value": "196608:UHxcp9ym3nltDUJViHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3aHf:yGplptGpPGpjGpeGpOGpoGpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517104, "uuid": "74bd1ed6-0e2b-4cb8-bc59-dd7f026dc96b", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517104, "uuid": "6d09fd98-e741-4c5b-8c7f-9995bf8e8417", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517104, "uuid": "573f98d8-9519-4c68-84e7-e7dd0fac8688", "value": "DocumentReview.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c4aef4-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474090, "uuid": "9427ae7e-4453-4def-b023-4044b11c0356", "comment": "Malware payload (Mirai)", "value": "7f44c63eaaaa7454f1cd7824e4161791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474090, "uuid": "1d6188b7-d113-4f10-bc62-c0805628c513", "comment": "Malware payload (Mirai)", "value": "0203c5c6f6ecbcfa7eb83c7e9cd222635643a587637b9c538740ad687cc0d5cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474090, "uuid": "91c40b8c-85f2-404f-8357-2efd48d1453b", "comment": "Malware payload (Mirai)", "value": "d03d17a02335cb6817b6b4f335ac63675b24f2f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474090, "uuid": "e4a0f4af-5ccc-4e07-bb1d-1562dfdd6062", "comment": "Malware payload (Mirai)", "value": "8864256cc50b276f29fc31e918b3fda4e266010f01bda51511b32368f0c46422782fe6a72e884b01cbc3cd478232837c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474090, "uuid": "c0ec7427-e26a-4c54-9bd2-69663dd8ad2a", "value": "T1E0440856BE419F17C5D216F7FBAE4298371A7BA8C6EE3112D8146F90339B48F0E36241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474090, "uuid": "29f2a9a7-cd51-48df-9919-7e0ede1ddbb9", "value": "6144:oeDgeaqNQCLxQQmKwuoP724teXTAa9Ulsk8yB209X:oeOqNBLxpu24t8Lbk/209", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474090, "uuid": "8cc5ecaa-1c9c-4847-acf3-90bff6dce06f", "value": 274516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474090, "uuid": "732d8ccc-bcc2-43c6-82e9-0cabedabd4d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474090, "uuid": "c4a7271d-70e0-482f-adc0-58098f35575d", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f41f96-7af7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783533901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533901, "uuid": "16b8270a-209b-4233-9d4f-eb14f96be205", "comment": "Malware payload", "value": "bb7b666f0512e4f398dabf92eb9c6fa3", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533901, "uuid": "6e9d7f4c-d85b-4923-b514-a57bdd2fef50", "comment": "Malware payload", "value": "0255ae1616eec19d9b97440779b34a01602bb933699816121d705c069974c7db", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533901, "uuid": "88ee06c7-ec80-4087-a82d-ba870beb4648", "comment": "Malware payload", "value": "33d3f047cdebfae6384a2744a5796adf55c257e2", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533901, "uuid": "f6c3bde2-0f9f-4750-aea0-5c5c2f64941a", "comment": "Malware payload", "value": "6a4c4674f5483554c8758b9e9952e629e6835528e162c8436cede8fc4b950af43bc74587a2abe786795ca218cfbd557b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533901, "uuid": "30fc2255-e1d9-4005-858e-e6aed1a9409f", "value": "T164564943ECA555E9C0AEE230896B9253BB717C485F2123D32B90F3286F72BD46EB5750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533901, "uuid": "b45015c2-ceaa-4ee8-85c2-82a117a3a04f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533901, "uuid": "ce272dfe-14a4-4808-b165-f1f9c957a647", "value": "49152:NRUxOOa41HyZ1KMlnhsK49pRgyq2ss6LwBivwykTlz2NXVKRzc/XnTfKiK9Kvnpa:N6aJ+gns6cik34bb/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783533901, "uuid": "89c0c346-4346-4eeb-a3c8-38f9bd56194e", "value": 6366720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783533901, "uuid": "18a0b7d1-72c6-437d-ba86-284cdd6b0562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533901, "uuid": "b5d1d4ad-114a-41e1-a375-f94578c71804", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0254ec-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475570, "uuid": "986c1611-1dda-4323-b7f6-4b9fd308460e", "comment": "Malware payload (Mirai)", "value": "04f65af5fbec750c21d7d33c84a178b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475570, "uuid": "c2cfa846-9c67-4887-9eb7-de0af52fb952", "comment": "Malware payload (Mirai)", "value": "02666285148eae0968f8e25b6c6de6ebe8827b8b15e25ef617635ad3b4e24007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475570, "uuid": "2517d4f8-39e2-4848-9cb5-93865ed1bdef", "comment": "Malware payload (Mirai)", "value": "19090434303b65e68428e75bd0ea6f6483910cf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475570, "uuid": "1190d4d4-0502-4ac6-9af9-1848768b68b7", "comment": "Malware payload (Mirai)", "value": "337f8a3e906b997a92ea1088c58793bb4c74aeda1b5d87bc34a4c6573496007889c97b046dbbc6fa16a54cfa8d76b3aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475570, "uuid": "ce718cef-fa63-42cc-82d2-c44c87f3d8b5", "value": "T1613319DAF8019E7DF95BE27E44174908BA3173D112832B2B27BBFDA36C720595D12E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475570, "uuid": "bb575f57-d59c-4dbb-864a-0c9c60cac929", "value": "768:7Iyef6zs1j76X+7EQdkjSl88YbHriM/+oG8Y1lWuwSxGi:7xQj74c7dMSl880Hf/+oGP1Uxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475570, "uuid": "bf80f0cc-a744-4bf1-8b29-d4067163fdb9", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475570, "uuid": "386855e2-64df-45c1-a247-322d5a4a5c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475570, "uuid": "1f2a0bff-2f97-4480-b544-c88702438f19", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71498586-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474160, "uuid": "1658123b-2f57-4bee-aa6b-30b5fd323bea", "comment": "Malware payload (Mirai)", "value": "d230b6e5f564595a56afde31f8f57c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474160, "uuid": "55feb580-4c9a-4cb3-aa94-b6b1a1c1f7d2", "comment": "Malware payload (Mirai)", "value": "04091fb5f36bccd38e322b8201b8cb4dccb97934faad702686bce72a155a7be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474160, "uuid": "0677b147-d333-4164-9f55-353c0d9de2cf", "comment": "Malware payload (Mirai)", "value": "38168244f4fcf3388cd0e6593989648f38020ce3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474160, "uuid": "633a64a6-6212-4670-a12d-cdb8b84e6fc8", "comment": "Malware payload (Mirai)", "value": "bffa8a8c388112153038c53e4d3f6961d6692e2017f04d95c47e0e72f26d8de805bc9e60b19e720fe4e50053cb74d20c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474160, "uuid": "cc9bc218-44da-4d5a-9f1e-1d19d87ac282", "value": "T1D7F3F805BB610EF7E85FCC3706E9270128CDA51622B97B36B534D958F64B28B26E3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474160, "uuid": "c3f5b0b6-ec2f-4e58-ab97-1b862f69539c", "value": "3072:ldrx+vzsw8TONAdQLty5l6Gm7UxbiuyZ6RlPP4FQQm8DrfIHm:lJx+vzXUONAdQLtKlTm7UxbiuyZ6RlPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474160, "uuid": "081ca329-e03e-4170-b710-af04d3e4c82d", "value": 161084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474160, "uuid": "46692b7b-0a42-468f-9998-b6e0bfdfa739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474160, "uuid": "5cc43bd4-efe0-4d7e-9164-899f93e7ffcf", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64c37e2-7af2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783531882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531882, "uuid": "9ec74d35-e2b3-4ae2-bc48-82fbd163f138", "comment": "Malware payload (Prometei)", "value": "180972fa3ce05f33ba348caebf58270e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531882, "uuid": "88a9abbe-1342-4201-86a3-e98559291560", "comment": "Malware payload (Prometei)", "value": "04ae319b77841b85d9cfb11c56d99f5256a6431752d52206fae17aee46e40782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531882, "uuid": "deab4451-767a-4527-b80a-820fca41adfd", "comment": "Malware payload (Prometei)", "value": "c0b4f64f267c7ddd09cdbaaa4fb424b63fc2e961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531882, "uuid": "f1256b6f-c839-43e7-b9a3-c4271b552cc6", "comment": "Malware payload (Prometei)", "value": "e8ef6a053e7ce1180c0d5b67ffc61c5d01378aa8a1b3680f762892f2cbebd555eb1e23cabe14dcdcf073c2e5a8786a1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531882, "uuid": "1ea2e197-6fc4-4cd0-96c4-60cee6e19ebf", "value": "T17CA423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531882, "uuid": "b561e4f3-65fc-4679-aad3-4d1dda371025", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdR:Fs6pyCC/Ya2hpi6T6N4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783531882, "uuid": "30d2cfe0-21a0-477d-afc0-f58bb378528c", "value": 449076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783531882, "uuid": "5db9a923-a06b-4e01-b024-6434db4e9f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531882, "uuid": "f63feb30-e860-4082-a0f1-d64b440f9f5a", "value": "04ae319b77841b85d9cfb11c56d99f5256a6431752d52206fae17aee46e40782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51545fe3-7a84-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783484414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484414, "uuid": "14bc252d-a87d-4d30-b4dc-74f0353048a7", "comment": "Malware payload (Mirai)", "value": "0a4220ecddc850910d7bd47583f0c270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484414, "uuid": "dff9758f-e891-41ea-8e9a-64863b016433", "comment": "Malware payload (Mirai)", "value": "05107cd7d97c5735f95cf0460ce1da2db4631abbc167c0b21842949bdca6651c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484414, "uuid": "124516c0-8361-4ae3-8ec0-64921ae1c394", "comment": "Malware payload (Mirai)", "value": "73931d366de22b92c8b1e8eb2bd3cce8982a758c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484414, "uuid": "9cd130ec-b017-4d14-8076-9080211e2a76", "comment": "Malware payload (Mirai)", "value": "04ed9fd325136c45a56d39b14d505b80a9ddc9fa564ec413328e9ed574afd86b68c80f3341bcd76b94166ae033cde0a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484414, "uuid": "9538ac76-92e5-4af9-be62-a2bed420a5d4", "value": "T1BB665B73905614D8D1ADD974C5152213BEA8388B673873DBBBC076F11BBABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484414, "uuid": "bb3034a3-ae64-40f3-ae14-26fea7fec23b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQA:cqYUQuVDt0TZE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783484414, "uuid": "7c452a16-7b59-43ce-a9cd-05cff02fd28e", "value": 6750208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783484414, "uuid": "8949ef56-343d-48ca-a6f1-c70ec06c23c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484414, "uuid": "67bedac9-85a3-4c39-b9f3-5e74eb458b03", "value": "05107cd7d97c5735f95cf0460ce1da2db4631abbc167c0b21842949bdca6651c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf70b3a-7a9f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783496001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496001, "uuid": "de20cf0b-a82a-45ec-ad0c-37420bddc5d4", "comment": "Malware payload", "value": "ef0674760cc53fc1bee26a3ce66a428b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496001, "uuid": "b96cad88-7eac-4254-a4d0-82f2533458a3", "comment": "Malware payload", "value": "0563bc585570d57435df9d6b5090967fb3ec128e269a658402775acc00455af1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496001, "uuid": "cf273382-3d86-4288-bb2b-b0374742ecde", "comment": "Malware payload", "value": "c8df10ae2f30977b6fe5f1abd43afa83248b528c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496001, "uuid": "2180b80a-8e64-4051-b35c-e9335f212c37", "comment": "Malware payload", "value": "852a63ffab191a2e26e15b467164ed9c429a75cb00d2af984b7f65bd77975191b2d1e83a9b1276a6f91e246d421127a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496001, "uuid": "f3910388-c4ac-4d4c-8aec-f535c1a7eeac", "value": "T198335C6516817C24EA99C8361C7E2F0CB9AD43E6324452EE7FCB3CF28C4AA9DD11971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496001, "uuid": "16f340eb-3734-4f77-935f-da0455d371ba", "value": "768:7+lS9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:7+hcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783496001, "uuid": "0b01c4a6-296e-44c7-8d2d-098a5badc760", "value": 50386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783496001, "uuid": "af4b060b-43ac-46c9-b036-b426ad17a34f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496001, "uuid": "f4006fae-1b8a-4f7b-a394-2fc77e41fdd4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d24bd9-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783474088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474088, "uuid": "4906a568-9273-4d7d-b88d-48507b342d3e", "comment": "Malware payload (Gafgyt)", "value": "54f0648f2e7cee0cb382eec995843eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474088, "uuid": "440c8674-8364-469f-a753-73e94b9a72c9", "comment": "Malware payload (Gafgyt)", "value": "05686c56837324d1bbb9b98c331bd689af81de4a27c52a4d84ace7e25302e111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474088, "uuid": "1c58fc97-92e7-471a-9e1f-28dfd7bf7d7b", "comment": "Malware payload (Gafgyt)", "value": "d2f5dbec007fc5ab00891651aaf56e1feefd9b63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474088, "uuid": "1008a592-5159-4fd4-84e4-173e5aecc91c", "comment": "Malware payload (Gafgyt)", "value": "7882bb37db6b74eb5db808aefabc267b401350f3ef0dd31cae4bef0db320d52f2f5a81ab71692d6b021deef044a0fa2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474088, "uuid": "aea62a7f-9a75-44e5-a251-5d7c11b31b4f", "value": "T1AE445B036580D5BAC487D0B5CBDFA2274961783D5C7A724B27A07FA23F4AEB05B19B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474088, "uuid": "50a8f15f-6c2d-4276-8815-c82b7e5e5bf9", "value": "6144:+Oq94BgLBMx0E/bJghAzZ6DvFc9NqHH9JLOf9E5:VyEgFMx0E/bJghAYvFc98HH9y9E5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474088, "uuid": "9ff7dcc3-f2e7-4247-bd0a-c006e8e5cfb5", "value": 278072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474088, "uuid": "d24becd7-60f6-4528-974b-330a6405756e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474088, "uuid": "69b06535-8d2e-4568-80ee-38ee11af260c", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbd0788-7b0d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783543356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543356, "uuid": "f6b393d2-43e2-4fcc-bf93-cc0dc2cd5cfd", "comment": "Malware payload (Mirai)", "value": "e7cfd08361f4e49076d6480a55a643e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543356, "uuid": "c93d7762-5fb0-47bc-a31b-e384b5ceb1c9", "comment": "Malware payload (Mirai)", "value": "06dfb8f076118342091b46840df9888f7f41db37356a1279f361451ef82636bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543356, "uuid": "86065d10-5b9b-43e8-89a4-a558a39145d8", "comment": "Malware payload (Mirai)", "value": "816baab6fe924c4d7a46e78a9e4b314d804cfc41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543356, "uuid": "d15b6b44-6e05-4191-b705-a39c4f8dae21", "comment": "Malware payload (Mirai)", "value": "a9fe7885c22db42e77cf9ce2314e4836d5a94cc94e3ea3304d8fa09d82ec86847aca1d442705040e1ee11044330c8b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543356, "uuid": "bd88178c-c523-4e5c-bb11-00f92e4ede9d", "value": "T166B2D0682145C8FDD52EE97D028B0F843B542EF5D923ED0F621DEB0E29627A479C36C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543356, "uuid": "f556ac40-13ca-4078-b6c2-07b0c72ffe7d", "value": "384:UYaBjkvjtaS/LcL15DnhTa7VUoJT3GCPl6+jkQuASTJgGlzDpH7uNj1JpbU:UYaJkcILcL15DnhWyoJTx6ckQuASTJge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543356, "uuid": "fb6c79c6-1da5-4a54-91e9-ea8f9ecab54c", "value": 24348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543356, "uuid": "907c06bd-b87f-4d58-8304-a53a20db1a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543356, "uuid": "f01ca015-f9ea-4d0a-926a-f84d0e7dbb1d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19ae2b2-7ae3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783525431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525431, "uuid": "17f53a08-d156-444e-bfac-235cb022ef5e", "comment": "Malware payload (ArkeiStealer)", "value": "32ba76496cf54bf0c9302e6ddab64cd9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525431, "uuid": "f25f6171-5122-4a0a-a0b1-3a06b208dd72", "comment": "Malware payload (ArkeiStealer)", "value": "06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525431, "uuid": "65e2d300-7ac9-49bf-a6af-06223bce748c", "comment": "Malware payload (ArkeiStealer)", "value": "73a97de7a2edda2419f060567ecd07ecc6b9b89e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525431, "uuid": "06dc74e7-f493-4ee0-bd7b-df4ca96a3407", "comment": "Malware payload (ArkeiStealer)", "value": "404a8c59f5156ce85b7e31c8da1a5831a98b11c606b61d75642d35bd38ab6b8a30ff33ff87f684bde0ae6892594c3e57", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525431, "uuid": "f254c56d-ba91-418a-8197-5dd4f5be15f3", "value": "T1BCD58C177CA009E9C4A967358DB712927B30BC194F3623C72E90B7382F72AE55D7A784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525431, "uuid": "e216ba19-ac72-4468-af63-6ede60aa3aa5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525431, "uuid": "264366d7-54d9-4b5b-bbf8-452ab2caa2c3", "value": "49152:ocogko4x61uHBflv5d+U6OZNdw553c8K1VAt8cqzh1:oc1GgY7W3K1Vbcqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783525431, "uuid": "2e71d935-9ca8-44be-b111-30a7259e081e", "value": 2957176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783525431, "uuid": "e8fe6b07-2ae9-4d07-ab9b-bc535fe4b84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525431, "uuid": "161c1e2f-6cf9-41b1-b22c-7418322115b8", "value": "SecuriteInfo.com.Win64.Evo-gen.39297812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4290dd-7acc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783515388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515388, "uuid": "54720e0e-9e16-4c16-a013-1a75914089ed", "comment": "Malware payload (Mirai)", "value": "2bf42c44a25a2ef7d86caf0a0df362aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515388, "uuid": "8980f1a8-ef7c-473e-a040-25dd8deb1c54", "comment": "Malware payload (Mirai)", "value": "07cc0b3a64a96ef43a209fa530b1744f0d87b3241cdd6961eacaf57d39ac9995", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515388, "uuid": "df40a0d9-b019-4cf5-a4ae-aaf365ba8c8e", "comment": "Malware payload (Mirai)", "value": "f1b442340cf926a765ce77d3c21ecd12a65a9135", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515388, "uuid": "d408fa11-709b-45be-8413-1be986ec4208", "comment": "Malware payload (Mirai)", "value": "acb178bf685359430817ff5498b58bb8e7f5c854e9dbabb16e34dc094ec46d5f40b9e91d625e43fe98cf5a0f697099bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515388, "uuid": "d6003a67-beb4-4eae-a58c-e3ef53dd9dcd", "value": "T1F2E3BE97F6472092C96302F407CB6BCD2E6362825F9BD9E7AD2F753B19360DB1402792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515388, "uuid": "ccaf1d3e-8a01-4f6a-b8d9-ebc535e623d4", "value": "3072:jfpcpGAcRtyMNJYPpQZE9wXyQbaYOdHgu7Zq:jgGF7CIXfq7Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515388, "uuid": "d451a1a6-ea6e-4897-afa6-615087493e43", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515388, "uuid": "4de2a707-e19b-4ceb-a4f2-32d86a3974b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515388, "uuid": "eeaad8bc-112d-4be8-889a-d6fbbdbe396f", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7169a77-7acb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783515133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515133, "uuid": "fcc97c5c-70fa-4a11-ac77-c93b28062946", "comment": "Malware payload (Efimer)", "value": "16f2b00efb6012eddafdabaf21f7e7ff", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515133, "uuid": "c11366c7-e46b-48f8-bfb6-172833717f9f", "comment": "Malware payload (Efimer)", "value": "07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515133, "uuid": "bbd446b0-8f4d-4a2a-99ce-71ca0090e861", "comment": "Malware payload (Efimer)", "value": "a237210c342b24325ac4cae7977613a85966c8b1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515133, "uuid": "01a46086-45f2-4d2b-8f4f-1f9a962c95df", "comment": "Malware payload (Efimer)", "value": "1c2fd8e116fe61120a90f9f582eb9722788fc123f5e2dbb0bac2e67bf38a276855747402594654bb5cb8cbf859eb3cc9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515133, "uuid": "79ed055c-8866-468c-a747-829b3b15473a", "value": "T1E7E63318A4E003BFDAB7413CBE9153B6E1A5B9725732CA9F472C86623D17291CE3D607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515133, "uuid": "5d060ef3-8836-4b00-a843-3db1b2674503", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515133, "uuid": "28bbe114-2e92-46ce-aa86-14c111ae46bd", "value": "393216:A9Dolo7EscN3zOSuGYvwOM54VXMCHWUjXqcuI3/PGTAI:A5FWKLGEMmXMb8XHH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515133, "uuid": "2d4b310e-7cd8-42c9-8885-6f1eea127342", "value": 14299702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515133, "uuid": "1dfce6d5-9b91-436a-98a8-f60bcd376cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515133, "uuid": "5e5441ca-e6ae-466a-8c90-f1b727427080", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d13275-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493258, "uuid": "e49a1926-4a18-404d-9ac0-bceb9fafd200", "comment": "Malware payload (ArkeiStealer)", "value": "95f27a2ad93d43a7ca067b134262d98b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493258, "uuid": "130a16c4-db81-4cc2-9240-ba1c2215ada9", "comment": "Malware payload (ArkeiStealer)", "value": "0a5f61085097eb8fc63159fca73f3c365e28860e3f37d23ff57a3af5736a5b1c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493258, "uuid": "eb124103-4efd-4f89-bde2-7a5e6ef52ad4", "comment": "Malware payload (ArkeiStealer)", "value": "0e6f07a1a7fe1df59a11a53e0f14708a74528aa5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493258, "uuid": "88fbda7b-d963-401f-83b8-a9d26b4d36d4", "comment": "Malware payload (ArkeiStealer)", "value": "65928a69375e0518c8e95420ddabd0b6d5a66631cac6287a44dfb4f9aeda09e4181a15a4d441c25cc207cfa66c5d489f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493258, "uuid": "061f5107-36d6-44fc-adc9-a696e7a7f7eb", "value": "T1E4D59D1B7CD048F5C4AA933289B651827B75F85A4F3127D72E90B3782F72AE4AD39740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493258, "uuid": "4982287a-6a13-4677-8b30-1048009ba386", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493258, "uuid": "9ddb1de4-73d9-4282-8b80-97e4c963156d", "value": "24576:Vinqxj4A7NP8oKrgxYhy2OkZUGYOgKTHVxmIxSRVYfJeUUPV1znUe0gItxJBele5:VinqCoNNKMx83ZAo8IxSDYfkzVtrH0XP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493258, "uuid": "679b7666-2529-469f-862c-354cc74f3c2a", "value": 2893696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493258, "uuid": "0c87bd06-38e8-4baa-9f5e-3be1cefbe9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493258, "uuid": "570f0161-e6bf-4e7d-a8b9-84caf5d3254b", "value": "SecuriteInfo.com.Win64.Evo-gen.36613281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d57e57-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493276, "uuid": "bfbe9d29-96f0-41d4-bbd7-7d8d4c3f1089", "comment": "Malware payload (ArkeiStealer)", "value": "8d8c40dac2995b6124d5d05897471ba7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493276, "uuid": "8c73b1e5-1b5e-4203-a698-22020a321029", "comment": "Malware payload (ArkeiStealer)", "value": "0b352d3e66ec7b97e9d26a04d625f1cbafaa31376f753c6beba1d42af01ac504", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493276, "uuid": "8497d9b0-86e1-4452-933b-7397050bde7e", "comment": "Malware payload (ArkeiStealer)", "value": "0eafe38a85ea4663d886eec6118cd4790fb509dc", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493276, "uuid": "79c32aa7-866f-4f31-9b94-b86c38bcee44", "comment": "Malware payload (ArkeiStealer)", "value": "ae5e87cd53af6f1186cb2a47b6779bcd6e60a51b8cc14eca289305de68d8315444155602466de30baf07f945a8377853", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493276, "uuid": "4e3e2d13-753f-4fb6-bab6-eeb4ac2f8816", "value": "T1E6D59E0B6CE009E5C46A573689BA42967B30FC4A4F3127DB2E80B3782F76BE25D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493276, "uuid": "7b1f2da4-c798-40f0-b540-5ec9a4d59405", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493276, "uuid": "8cf27358-221a-4ab1-9d12-189d3c272e15", "value": "49152:8h11tpOgDncMlXjuzL7pLlWGYhUJHQ2LJ4Z12Vi1SG4xe:8hhtciTWl1/w2LaZAVKSGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493276, "uuid": "93613342-af23-4cde-b8e4-78d609df8ca9", "value": 2932072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493276, "uuid": "af86e004-98d3-4b00-835b-f5ab4e92c61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493276, "uuid": "9c9993ab-83a5-4a9b-8ef7-776a785995a8", "value": "SecuriteInfo.com.Win64.Evo-gen.11314199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae375ab-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473934, "uuid": "b7ed093c-e03d-471d-992e-69c030b78e1a", "comment": "Malware payload (Mirai)", "value": "7cb584fbe20a10a90fab49bb29467fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473934, "uuid": "a475ede9-dc82-4033-8608-1650e0b31a55", "comment": "Malware payload (Mirai)", "value": "0b6f0857667812293553e16851e032db675666ee17b52385fb33dc0a6c60f24d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473934, "uuid": "1e1dbafc-0e7e-448a-bf93-295ee3003c9b", "comment": "Malware payload (Mirai)", "value": "14328faa3df136fcee12c6403406065a7184e45f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473934, "uuid": "23a71483-42b2-4f1b-8821-5c77c7f41b75", "comment": "Malware payload (Mirai)", "value": "508e45a4ed4c446ae62e2ba38996dc39f82c56df389a84fd6dd926bee75945f84f9db9fee6aa1f02177def33993b6970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473934, "uuid": "9a2af345-31a6-43dd-91c8-fd3f25884e63", "value": "T14D44F85ABD419F17C6D216F7FBAE4288371A7BA8C6EE3113D8146F50339B48F0E26251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473934, "uuid": "5e8f3f63-a516-4875-bb64-074cc162f4fd", "value": "6144:m5iqxCLQPTeAAQi7XNHVF45Ur2jSHACGCj2o3q:m5sLITnyVF4OkATN3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473934, "uuid": "90f8721a-8438-41f2-a857-d65657a1a1d5", "value": 275476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473934, "uuid": "cc3451da-231e-436f-b964-2c7d146ce73a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473934, "uuid": "23cf5f92-22e1-4d56-9690-a53a6bb79476", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d222b61-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517049, "uuid": "de9caef0-8684-492f-b8ed-09b565c9f3fb", "comment": "Malware payload", "value": "93211172a8af9d03d5757a023b4528cc", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517049, "uuid": "fe846c4d-b8d1-413b-a7ad-b166384e06bf", "comment": "Malware payload", "value": "0b80747950cf05453bcbc2bb800d954b35f84e2fbec640f132c4a62f6c99a786", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517049, "uuid": "a8b0f8fe-8d57-417f-a47b-5afff38d5a50", "comment": "Malware payload", "value": "44e23e58c78a2a4894250e774f6b813473c0375c", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517049, "uuid": "ae4eb215-35cd-457a-9b94-c445d1d2da67", "comment": "Malware payload", "value": "ce92fb06f99564219e8da845bdd88c3e20973a2930ec102dd3778703640dc1e24901084d307c374bded889d10af9deb1", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517049, "uuid": "49d6bbb2-0d88-4bb3-98c6-ce8ab764b513", "value": "T1BFF0E1AFF815A608079527A4C1284F75D5D2E36794A49429AF0CD826C40D0FCF579F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517049, "uuid": "ad69a0f7-cc3a-4331-b867-bee86aa8b2fd", "value": "12:l8YVQvDz+KUeGKcHa0RaB7MJCaaEdSD2yy2:BVQkKcBRGnG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517049, "uuid": "4e4ddfc6-b10a-451f-8641-93999786a4ad", "value": 605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517049, "uuid": "36355e98-b41a-406e-b53d-5abd89a0bec6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517049, "uuid": "0972a202-30fa-4284-8c6b-d8e181cf4f23", "value": "uhJrQBGm.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33b1d54-7a70-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783476042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476042, "uuid": "9754e9f2-c174-4c26-ab9e-8bb9cd96cccf", "comment": "Malware payload (Mirai)", "value": "dd8a8c786bee729b89c4d54ca2ebf507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476042, "uuid": "2bd4f066-28b4-427a-8f2a-10ff9290fd4b", "comment": "Malware payload (Mirai)", "value": "0bfb8671ec522cc77656f514c3cff9034ef67f97a780672ade79804eccafe7a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476042, "uuid": "a0ce4d5e-a425-45b8-9c3a-3fd30bb1ae23", "comment": "Malware payload (Mirai)", "value": "50dd7d65e44a69c16a4ba37489deab900e7b8a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476042, "uuid": "c3687271-5f66-4f8f-8eb4-791500df44d0", "comment": "Malware payload (Mirai)", "value": "2dbd2a56867c6722f81fce3c4e4f43b0dc73caecacd95fa145967286426f03138c6a4cc8d2ea7452e7c4367013f10a1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476042, "uuid": "9a7c5548-630e-4408-84aa-a3c559225d18", "value": "T129A2D070616D6930D325853ADFAC84071B4B8E78E1FF32182A1D2638B8C790725FE66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476042, "uuid": "5f5d9314-4253-4159-95d1-6aaed78f7479", "value": "384:KckgAL0EJP1jbF+bMfOsJuIMPbLMRXlJUo6hymdGUop5hMV:KckgAhSFsJ6jLkVuo6s3Uoz6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476042, "uuid": "48b26966-1458-478a-9a67-647d5ae5be0a", "value": 21836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476042, "uuid": "8a732671-19c5-4f8c-b81a-045c81b52eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476042, "uuid": "ec2b9654-104c-4577-94f0-13c7e0cb9329", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ab544c-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475298, "uuid": "b616007f-5ecf-428b-8736-eb7a669056a4", "comment": "Malware payload (Mirai)", "value": "752427e0ff54c99ed7773694b7320db9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475298, "uuid": "265a3b93-344e-4628-8582-43923ca4df57", "comment": "Malware payload (Mirai)", "value": "0d0e414d42ca89f5556132fece6b5e9493e6f3b349edcec249edfb32c38fc3d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475298, "uuid": "4a3f0043-05f0-474c-872c-6306577c7c30", "comment": "Malware payload (Mirai)", "value": "a3f9d1dcff084c53fda971e5586a87110bfee25f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475298, "uuid": "12793fb6-de2c-481a-a150-c07daff535a3", "comment": "Malware payload (Mirai)", "value": "26ea70cbd7eeb78149f405c9679adcf345e20c34ff2eb44f2d340d5e27cd1ecafffb7f459334fe2b923dbdd01002a52a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475298, "uuid": "e3be8724-a674-4bf8-acdf-c4d1c9700ddc", "value": "T1E2B2D09DE294F646DFAD2EB9519A87F06DE222E23359079CC3302CD6B22191F744E03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475298, "uuid": "0747f245-295b-4f77-888d-4a696035a360", "value": "768:JibGdJ/0Bf5uPc/uqisCYz7gg3NvRJdWx:JhD0BfIP0ufYzpbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475298, "uuid": "b5b8cd73-fbd8-43e8-98d7-d789fc38d4b2", "value": 24704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475298, "uuid": "ff96394c-04c5-4be7-b870-607a0691c0c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475298, "uuid": "2419f1bd-f258-443f-928d-45c45ecc904a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd48f9d-7aa7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783499385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499385, "uuid": "88c32ddd-34ea-4569-9c07-cb032a34965b", "comment": "Malware payload", "value": "787402117341cde053bef8fcfa4b91a5", "object_relation": "md5", "Tag": [ { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499385, "uuid": "61a848d1-482c-456f-84cd-ac1192260754", "comment": "Malware payload", "value": "0d72a1542b4a02342f55fc99d24da79102d5a9cac9212e63233ecbc79d0e7a79", "object_relation": "sha256", "Tag": [ { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499385, "uuid": "953432c8-056c-4e6a-8387-38b2f91b9a89", "comment": "Malware payload", "value": "67314f68ca3c3410b4e122a70a24bfa4c2ad1db8", "object_relation": "sha1", "Tag": [ { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499385, "uuid": "f489befd-e4a2-48f0-996a-e978420cf0cd", "comment": "Malware payload", "value": "e62608de28d2ce4aec766d57c30dac395bd4711448aa05f2452150cd8412af6ceed26c8e43463aff31018b10dd087b70", "object_relation": "sha3-384", "Tag": [ { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499385, "uuid": "e4a816e5-3a6c-43c0-b091-0039a6214d91", "value": "T13F642306C964456FCF2EC6BB45E24D9C57904FE2C0A9CF6746807E14ECC8BBA390B697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499385, "uuid": "1b42d283-63a5-4807-8a6f-cebc3d94fecb", "value": "6144:+tQYwLNV/V0/BhQ2Z8kMbpYSrktYNyo3CYAXMxrMmkvhYTFpzUkJNQ5weNOT0:+tANV/IBhVZ8NYSoFYC7Xkk+TQkJabq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783499385, "uuid": "3e02f0d1-c306-4c0d-92c6-ac9fec67a824", "value": 335518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783499385, "uuid": "dcbdf9bc-f2eb-4942-a684-b04354ad9b1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499385, "uuid": "7a86e346-042a-4827-a4de-0466b5f2fb0f", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e030f0-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473929, "uuid": "df78740a-7a39-4c47-a99c-08f4a76f98a5", "comment": "Malware payload (Mirai)", "value": "9665df56a7849acaab86694a8c4b5c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473929, "uuid": "31ed4c55-abcc-47d7-a960-29128a90170a", "comment": "Malware payload (Mirai)", "value": "0dcf6d7ee47fb371d7ebbca1d4f62d4707514237215d8044e588783cf0aae1bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473929, "uuid": "ffc1237b-02b5-41ff-8549-8a250e0c7b1c", "comment": "Malware payload (Mirai)", "value": "e4b64b2f9c47280aa43a6578519b75b6f4741aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473929, "uuid": "9790e265-df9c-419c-bc06-aab6386a3caa", "comment": "Malware payload (Mirai)", "value": "3233f15f6d012ea26ffbebc61bbe137efdd9b286a547cf684c721b2316bf2bcfdc6c78d79a25b5f136d1c56bc8d4014c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473929, "uuid": "d9078a8d-0598-4c26-b1a1-9cb08ce406f6", "value": "T17BB3AE36E81968F4C07E8574E5A4BE790BA3F48052931EF716E6C6B65047EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473929, "uuid": "8f590d32-80ad-428a-90a1-dc7c42f5030e", "value": "1536:t/juy48gLDajwrmRZ2QprowQi1YKiC7p74Pe/9C/6otd1pHB:t7uy7eaMYZProwQi1fiQye/93efpHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473929, "uuid": "1869be8f-a355-45e7-8e79-a63a33766110", "value": 109776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473929, "uuid": "8e1f1ac5-942e-4c29-8de7-38e2dc204ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473929, "uuid": "5021965d-55ae-466e-bcfa-4e5bf942fdac", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a0df47-7ac2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783511298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511298, "uuid": "6452d7bd-f08f-4dd5-8fb6-dd1f23f83292", "comment": "Malware payload", "value": "ecd50eb0a3beeaa3654f580ace461ef9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511298, "uuid": "5001a0b7-7ce1-4b89-a6bf-c77d01723727", "comment": "Malware payload", "value": "1041d97075bb877f483ef9c79cd12bbf6ab5a4f28afef65c67ce74e512000285", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511298, "uuid": "7e98b913-dd4c-4c45-b934-f5b407caa195", "comment": "Malware payload", "value": "2a0f8f4ef9e7aa39a450753c2b71f58fc50da2a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511298, "uuid": "80f110ef-b1b7-4556-83dc-aaf22f150b19", "comment": "Malware payload", "value": "0dc43c8ca046254c5139904249675d8bf8af2e5ee50deecbb0168ce8f7b9a766ddff900ac6c0d9c27b6bf09f73ab1381", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511298, "uuid": "b5bd1ee0-9687-4217-802c-bd0a931984f4", "value": "T12DB733068F6F9E2F8ABC215C24BF0F4E26E48E544105B9E767E67CDB9A4FF11204616C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511298, "uuid": "091d104a-873d-41c9-8913-aa20f8d01842", "value": "49152:BF+1Z8nS6+ScO88pUQGNL70GNecQYVMIVoQ2UDPOT83SAdQ9t7HBFUQbneE1o+JK:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783511298, "uuid": "892e4faf-0516-490c-9620-f380c5845a75", "value": 52431330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783511298, "uuid": "eadf75f4-adad-46e0-8a15-7f3dcdf243c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511298, "uuid": "eca9ee93-1312-492c-b863-cfccdbcc3f99", "value": "Approved - Project 070726.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13abc66-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473945, "uuid": "678c2e83-e44f-4741-a14b-7578026c1f1f", "comment": "Malware payload (Mirai)", "value": "d3725c717fafe309bc1e83ecc124c693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473945, "uuid": "96d5072b-4862-4139-8d5f-70c2edb421dd", "comment": "Malware payload (Mirai)", "value": "10c76163201a46c7a7e5df1f2bb2d25bd79bc348baba7c17ee46bd4eef5148f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473945, "uuid": "855344aa-c5cb-4bc4-97f3-ce84c6260f6f", "comment": "Malware payload (Mirai)", "value": "b49563ff1ddcb83890bea4a621d3116c381b1a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473945, "uuid": "bfecb6a7-f4c7-4e7d-a4b9-4eca36f50ee0", "comment": "Malware payload (Mirai)", "value": "7b1f7fa3c762974f286aa997193323ae27a405aa8cb69bc032cbbbc2589f3c16c9140dc14be58b82ab6ae57a85ec69ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473945, "uuid": "c65d00f1-5123-4caf-8628-fd632e5212ec", "value": "T136246D43AA43DAF2E01315B112E79B665A32FC3A0C2FC5C6E7653DA1CDA11C4A716B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473945, "uuid": "04bd8931-c3fa-4b35-820c-3c7d39ef2586", "value": "3072:QHW83e61SCSGGH4s0j4Azl2J5FFFboLMeexI36rozh37eQ/EogR1O:ue6DtFs0jS1/s3bzhC4EoU1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473945, "uuid": "f5d2081a-6a13-4334-b85c-8deaf7198eaa", "value": 229188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473945, "uuid": "bd5bca5e-ea33-446c-9e55-f5da27153fda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473945, "uuid": "6c86d733-ec11-4ee4-922d-2f3cf9be453f", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a385b6aa-7afe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783536950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536950, "uuid": "20c0f897-6d86-4d2c-a8c4-a7f4aa8052ba", "comment": "Malware payload (Mirai)", "value": "c65195e091f95317a1e16ef0fd9b98dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536950, "uuid": "27e82706-4dce-4c95-a3ca-852138673b48", "comment": "Malware payload (Mirai)", "value": "1183ad0536c58299e6a80001a466be358d596fc9d130bd2112cb25b957d784da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536950, "uuid": "273240f7-39e6-4621-a230-5a2e240bfb89", "comment": "Malware payload (Mirai)", "value": "730c35ac6856f902f4360ac7e906b7bb5368b873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536950, "uuid": "8f094a1a-e580-4d80-a3e3-68abce67a5f4", "comment": "Malware payload (Mirai)", "value": "389d70f3c102dd4f5d161c5cfd15d2a54d6da25d0a3d56b45b37572be0486029cd83b9e13185a7ea6150e95dd9e65476", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536950, "uuid": "a7c1a033-70b3-4475-bb26-fad244448f81", "value": "T13B334B02722C0F57C0A315B4252F1BE587FFFAD122E4F685294F8B5A8A78E371485E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536950, "uuid": "a6b0fa32-b569-43e8-925e-77b440001be0", "value": "768:U+ikjyAV8/eVlRlYF66s3nOhzqq3lJaNCxbM/oVGr+GhVnCtiWIkZzKwm:/A9GQS3nqqQlYMxb0nJWIw/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783536950, "uuid": "c3cbc0b5-77a4-4325-bd8f-e9ea3a219ce6", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783536950, "uuid": "10556f82-f1e7-487a-ae7d-b005a378e80f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536950, "uuid": "06834550-e295-43af-b4b1-f5b24cf5d90f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f71c510-7b0d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783543171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543171, "uuid": "a2c36c92-8a0a-491d-b075-cd3cec507be1", "comment": "Malware payload", "value": "93fc205b36709cad85e713a8c039e1b2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543171, "uuid": "17731bb8-f6b2-4045-83af-14072b1429a9", "comment": "Malware payload", "value": "11c05dfdcb941e7542aa21f72025106ad107599116a28367c7eace8d272ae035", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543171, "uuid": "cf7ff08b-7957-443e-b91d-e9580ab8c587", "comment": "Malware payload", "value": "b8da540ae93c74ffb301edb12cbcf10864d32a25", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543171, "uuid": "937625c4-759e-441a-ae8d-41604b285c2b", "comment": "Malware payload", "value": "b07d4da8bc27b1c17a2600bf5bb811cabecdf289001d656af6c51091c0ffaf5708573ea04bea3fd78aabf632f23dbf92", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543171, "uuid": "1e04a9bd-5231-4d56-a7b6-28151719b921", "value": "T1C5714C595162506CC55948398FDFD9026933BCDF8E10DBE72D1180B2667F222EFAD284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543171, "uuid": "de374d7e-1f92-4368-8442-2f01e871c648", "value": "96:ThJST4TsrnmjEUl0RxU6Sowwurp2cbOL0BC/ToLr:rST4TVIPxU6So2FOoBMToLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543171, "uuid": "b058c04a-56fb-4950-bf80-7fefc6946cc2", "value": 3505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543171, "uuid": "d296814f-df47-410f-8a69-b6736b1ad9d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543171, "uuid": "5009df5a-025f-4d6e-938e-1fd97430454d", "value": "zoompkg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bb798b-7b0e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783543848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543848, "uuid": "4d529e09-82d4-4dcd-8c6b-68c0049c9a36", "comment": "Malware payload (RemcosRAT)", "value": "0c130e9b427b38de6cbb7062895f5a69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543848, "uuid": "230fc539-fda9-47ed-9673-e6b9479ab64f", "comment": "Malware payload (RemcosRAT)", "value": "11c9e5f53f0f64c9633bb1a2179ffc990651b31b52c18a212f05c2efc3824404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543848, "uuid": "a44d07bd-21e6-450a-8faf-cb278c17875f", "comment": "Malware payload (RemcosRAT)", "value": "6bdef737797277a7562b3d50e78bcf3cfbf76895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543848, "uuid": "5a551800-2379-4ac1-b3b5-c31c68cf6964", "comment": "Malware payload (RemcosRAT)", "value": "96c3dab8d3cfcc439806fd5c50aed2066e370bf3aa0ef23dd3ca405bc910ea0c39b3c5d3170669f2caa7c631e0907cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543848, "uuid": "9c8186c0-c2d4-4589-be2d-41823f9b05ab", "value": "T18974F0B0D20C4A42CDAF4BF37755217E8C38B627E020914AECBDF7317B529F54A69968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543848, "uuid": "46af7bd0-678f-4e86-a400-4d37e98052da", "value": "3072:1Vt/P2i4vduLRhLFyfcqgO1YheBAP18SmP7:hP1GQLYfco14sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543848, "uuid": "38cc30d6-e68c-4cc4-bc82-e8542cc06777", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543848, "uuid": "c712b1ae-912a-49ce-b051-efb5abeaf280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543848, "uuid": "82f16a29-b9c1-4f97-aafd-09d29dda0b98", "value": "0c130e9b427b38de6cbb7062895f5a69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11df8ea3-7b28-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783554745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783554745, "uuid": "fbdd5b0f-beca-45d3-849f-eab2a8894bbc", "comment": "Malware payload", "value": "31289b7cf051068cae1da87d31136f4a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783554745, "uuid": "56eb88cb-e63b-4f51-b7a7-aee58c837c43", "comment": "Malware payload", "value": "122195049d764efa725307e935ebe9fd34c4bf14b6ca72188f0b9cb3df407b96", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783554745, "uuid": "891c60b6-0c72-4e8d-8d4c-342d98eee528", "comment": "Malware payload", "value": "b186c8530d4d97b8cac7e9903e90f7cbf656f6ba", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783554745, "uuid": "38c9aa12-7e1f-4203-924f-c7f6ebf1f506", "comment": "Malware payload", "value": "c0b52647cce0673451ed352607f3eda931f845f4328d2e9dec65dbf6ae908e0cae0b71091fb7a1ce7237e54625824538", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783554745, "uuid": "40556499-cca0-48ef-903d-ba0715e36724", "value": "T163E6339C95E005EBD4A3613CAEB05595E1D8B4BE4732C9DF43E8D3A16EA33D14A3E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783554745, "uuid": "f693af59-d15b-41bc-8ecc-76ddb0cc6ca0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783554745, "uuid": "7fd5cc8f-6341-4e48-8bca-7a241b2faa8e", "value": "393216:fPIscKIKQAcZ24W2U+Kid9yiCXMCHWUjXbcuI3/PGTAI:f6AQpZ2J2U+x7VCXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783554745, "uuid": "5cbf2226-5689-4d42-a7eb-addfe604e10a", "value": 14310895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783554745, "uuid": "864f5b00-a5fb-4206-b62f-4841e3fb0b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783554745, "uuid": "c6265361-303d-4b78-9600-0e1d48379e28", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5b00ed-7ac5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783512432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512432, "uuid": "04dbd5de-ca24-41f5-bca9-2301c81ba38e", "comment": "Malware payload (AgentTesla)", "value": "516080cf0436c188eaa2a0da37f3007d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512432, "uuid": "8c2be4aa-4e83-40b9-af3e-fbca2d898535", "comment": "Malware payload (AgentTesla)", "value": "12dc3bd74949a3306d988ee7d2b28865f8363670b2a910063e72de46c9301380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512432, "uuid": "261dd259-1994-4b8a-af42-6549f401553c", "comment": "Malware payload (AgentTesla)", "value": "22f34f26e786521d1a655958e3e5148563ac28d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512432, "uuid": "d73aec83-8ea8-4e1a-a81d-2dd8548249db", "comment": "Malware payload (AgentTesla)", "value": "d339409ffa135621c4c5d7d9d856f99b1b52d5e2a8b4c0c80cbaf15e5067c23a98419e06388b7fb1c0e01855e44aa60b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512432, "uuid": "28b243c1-c1b6-4346-86ef-0fb4c3060891", "value": "T18122BB254DE6996E313956F5C208B6408AA17C2F1753A9C5FD3D874BE723222037EB3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512432, "uuid": "da9b8fce-2b0f-412c-be74-2912fa5b51b2", "value": "192:Fpen6/HgkrjP7nbdKR9W9kjsgvvc5TUIXIAbDxa:FVgHG7l3xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783512432, "uuid": "0e11d88f-9fd8-4479-8f24-581b9448633b", "value": 10334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783512432, "uuid": "645c9ac9-72c1-4e1e-822f-37b002bad30b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512432, "uuid": "a054458c-efce-477a-8ecf-18699cb930c7", "value": "goodtoseeuhere.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2112fae-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493247, "uuid": "979b2dfe-0ff9-45a6-a9db-98f0fbcc02bf", "comment": "Malware payload (ArkeiStealer)", "value": "76facbe766984478e7419110c0884329", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493247, "uuid": "34e32874-d9d5-47d9-9813-c5c0d5fc76dd", "comment": "Malware payload (ArkeiStealer)", "value": "15988f3d46d1c569f90fe3e9afa46f018be526b918102b8b2d20c0088f025c29", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493247, "uuid": "10b6362d-767a-49c6-9966-eaee27bf245b", "comment": "Malware payload (ArkeiStealer)", "value": "2a85e5f41f175560422f14e53c555fecd86805d8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493247, "uuid": "2420129a-ac96-4860-84d4-984696b3f3a3", "comment": "Malware payload (ArkeiStealer)", "value": "8e7db66d3fbf1d6a960d06d9ad6a96a6305147add4713459edef5f342978a40624cced557caabce13f209fc67ae4dd6b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493247, "uuid": "adfaffc4-14a2-4d5a-8069-ea90d2ebb9ca", "value": "T10CD5AE072CE009E9D8AA93328CB642867B34BC194F3263C76E50B7782F767D09D757A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493247, "uuid": "b89453e5-c463-45e9-a5a8-eca1d7d09f3a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493247, "uuid": "d7c88cc8-c824-4c24-a44d-dbdffca3f21f", "value": "49152:0Ro5+qAHYcjLOgjZBYmN4bECAdUlaAVIcJQAGCTxxBxEqM8Uix4t:0RlrnGKdSxBxjMlCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493247, "uuid": "fdf2e549-1b9a-4457-b79a-f879438df4ce", "value": 2984280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493247, "uuid": "0b90c1f5-73a9-42e7-b35d-bbf2446db93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493247, "uuid": "b7450679-e1e2-41ca-a60a-6444ae6a92cf", "value": "SecuriteInfo.com.Win64.Evo-gen.71917217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71afe3a-7ad8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783520743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "eb758888-9918-4b08-8cc6-113d9ac3ad92", "comment": "Malware payload", "value": "7af9e996028996b9ec615ee3b293ca93", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "f4dfe3d2-761f-46a9-8bf0-e90846f5fa1d", "comment": "Malware payload", "value": "165bce49f6cb23a7a5c4e3f6d43fdc5968dcc99fb5aceaf9d93c345848fd0505", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "16c852f8-c3fb-4c5b-845d-f7cae3aa9a7d", "comment": "Malware payload", "value": "1c8926895ea263d7ea339a1d413dd6e46e8fc89b", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "243c00a4-bc82-4b6b-9ad8-5fc38ff68172", "comment": "Malware payload", "value": "ea1c2de0f35636777a883d93e6a7f55eda0b7cd769d3698660bfdd8702de3dc4db60b989033ba876c61b028ee697546c", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "576e7a19-0039-41e5-97a1-8fed813a4658", "value": "T1F1F42A89E68298B9CB6620B111DF9736D535191A4327DDD3CFC94E206E333D38B3E629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "855b9f1d-5532-4cfd-939b-4a3c2b41255a", "value": "12288:F8bWiq5V7efxwSXCrIToLU1RrjhMp8crAtndE:FoHxrXCETjvrjhMp8crAdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783520743, "uuid": "bdb1d656-0266-46a6-93ea-dc41a75cc6d7", "value": 756172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783520743, "uuid": "baf83677-72fc-45b6-9f71-6268f0fe3151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "3c1f73b1-1297-4802-ae71-62a1de493dae", "value": "v00lk.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fa2bdd-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493255, "uuid": "9ed234cd-ff9b-413e-b404-0a39202cb9b1", "comment": "Malware payload (ArkeiStealer)", "value": "516e902855fd5c7f19dec140928a7384", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493255, "uuid": "66352367-85cb-4d91-a0f6-f5a6b2f95c4e", "comment": "Malware payload (ArkeiStealer)", "value": "175a7d2a8dcc50665e5f3dd5f0513cc091184065b424907d3e544a56c163e2a3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493255, "uuid": "9a5d1ec7-d471-469b-ad57-db501eb653ae", "comment": "Malware payload (ArkeiStealer)", "value": "3a44ad738967990504385af8fbeb1316a11cb313", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493255, "uuid": "bc8bdd72-2ef6-401e-8f00-b06ceadc48ae", "comment": "Malware payload (ArkeiStealer)", "value": "5718f0a55202f9effd52d2276b077b7f1dc4144173f0ae0f2036d0dba3f0f81158b142addb5168aca850feb63239ccd3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493255, "uuid": "b1de16fd-89dd-44f4-aa40-83778e7ba01a", "value": "T146D5AD0B3CA109EAD49A527688B652827B34FC194F3633D72E90B7383E767E15C35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493255, "uuid": "2ea414e5-718a-47d7-9e01-3e6586b90a97", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493255, "uuid": "7ef239eb-a08b-40a3-bebc-088ee57334a4", "value": "49152:PmDPtcXnerB+cUXVJUt3fKx1SbUruKFnTYCWVgV:PIq6Ulu3fK6bUrzxY1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493255, "uuid": "09526999-bec6-429a-901e-9402170ca58f", "value": 2995560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493255, "uuid": "393e22e9-9b93-474a-a266-b9a0cebd9d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493255, "uuid": "52c6c7d5-bf20-4e3a-8ce4-576fcba23f7c", "value": "SecuriteInfo.com.Win64.Evo-gen.56624925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbdda98-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493270, "uuid": "bc90cb68-0d8c-470a-af73-095603f9bcc4", "comment": "Malware payload (Vidar)", "value": "21c8b48e6b1b223ee3316cb04b180e64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493270, "uuid": "5e56be97-58b3-4d2a-b41f-85010c088181", "comment": "Malware payload (Vidar)", "value": "195231de9197a9283f11ca7e731120b5694a034fc498a255e98b2827320595cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493270, "uuid": "e4fe226d-287c-460d-b92c-c5b22af48f06", "comment": "Malware payload (Vidar)", "value": "170636809b65d4755f2001bb1ee4a55eee56457c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493270, "uuid": "3391d5a6-51b8-4cf2-8f32-9ada20290cf9", "comment": "Malware payload (Vidar)", "value": "9c061217dd2f601d18b5ef9e61327d010676ac70d10a5b7e30e9045734bbe75db2c8defd7bbd6cce1482716e06aec408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493270, "uuid": "65668d2f-8058-4958-8140-e2c7e9518f90", "value": "T16ED59E077CD148EAD4A9A73289B61192BB70BC490B3267D73E90B3782F727D09D39794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493270, "uuid": "01e6071a-489d-46b3-a865-dc09eeefe324", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493270, "uuid": "4ae2e249-883a-4a4a-a1f4-adaab1b25b75", "value": "24576:rwOkIkqdgEO7ScU5e7YEM4gaOMVNLQllNIP4wCTEY5XoS5GSSb/ITvicGRtxwBew:rw1bYgzSbktM1454wCYWPG5wTaXE8l07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493270, "uuid": "e51ced14-1eca-4b04-8996-70299478cf6f", "value": 2995056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493270, "uuid": "89847e4f-36c5-47b1-8394-1b88477f99d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493270, "uuid": "b05106c5-4c98-4fbd-be16-75bafbf1ee6e", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40276.30279.4916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccc45fd-7b18-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783547891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547891, "uuid": "1c7f271b-5b1b-49d8-848a-1afebee164d2", "comment": "Malware payload", "value": "35dce80eeab6047541f7d3af1d571be2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547891, "uuid": "daa04b7f-2f03-4e34-9db4-8244409710e4", "comment": "Malware payload", "value": "19b8cc08c112cc738cbf3de08b8755c68fae2d5b731fbdb4c4a848ef79ae89f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547891, "uuid": "bba840d5-2cc1-4a38-8174-7111cc9d1668", "comment": "Malware payload", "value": "b4e6fac0c24fec0236db039841ea1451746b12bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547891, "uuid": "3d9573c1-f6f0-4847-bb5e-6674e0426991", "comment": "Malware payload", "value": "ec3b448b58d29e49f58140f8f9936c1adee37b8d146ed25ced1194a5e09fd890daee54d0f10fc1b12a882618c1def29a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547891, "uuid": "3103dc50-ed34-46ad-b75b-786bd8298756", "value": "T16A21D0DEFA137B391BD109DDFA1418BCB5A38EA65814EC34F2529C2C4084359036FC2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547891, "uuid": "7a10e473-695d-4f73-a9c3-5fffb6bfe704", "value": "24:lmGWlv4tMGakyJIrbMGSUG+qpMGakyJIrbMGSU2cJ:0GUv5RkyB6GORkyB62cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783547891, "uuid": "e181912d-4e86-49aa-a4ac-529db2d560ad", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783547891, "uuid": "5328e199-a8eb-4a54-b6fb-44168754f8e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547891, "uuid": "95941662-630b-4a20-a7e4-026be3ba0669", "value": "check2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45413e9d-7b01-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538081, "uuid": "16931adb-df20-4e86-9cc8-50e56fc82326", "comment": "Malware payload (Mirai)", "value": "5c41c9663e689e75256858dd3c1613da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538081, "uuid": "3c934e15-93d7-4a90-b6e9-2b5ac6ebb70a", "comment": "Malware payload (Mirai)", "value": "1b9c73c1e4dfc4643ac50d78af99963e0adc9e28ca35cb5f38fbb01293ee40a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538081, "uuid": "f11220f6-b77b-4e19-a2ae-e24454a2176d", "comment": "Malware payload (Mirai)", "value": "ee02e4052bbaa9bfed2a4956bca6ced65325d1a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538081, "uuid": "59cd4f99-503f-480c-955d-6222d3c811d1", "comment": "Malware payload (Mirai)", "value": "59e535c2bcdc879ba73d47c9d9aa864bcb0c52838f486894d8a35aca780e39e6d2b015abfa26c369b1a4a88ce8866dfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538081, "uuid": "76fda5d5-1bb9-44c2-86dc-506fad602883", "value": "T1883349C4F547E8F8DD4B16746032FB379A72F1BB236CDA43D7A95533A841642E802A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538081, "uuid": "6dfdbad0-2d1f-4e60-bc71-bc9a356756ba", "value": "1536:kPF1+1QwMSsBI8Ga+C6bdUYZ6qcqgEfJNc92Yrzq:kf+1QwMSsBI8Ga+7bVZ6qGEfPg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538081, "uuid": "6c64c41a-df68-41e3-831c-bea3a0ceef77", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538081, "uuid": "cf8732a8-bb4e-4687-b466-0f160f48271a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538081, "uuid": "e0358ba4-295b-4a33-ab52-bc376f06a66d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69c1a08-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537385, "uuid": "7970f0be-a3ac-49d4-84e9-7a845bea28b6", "comment": "Malware payload (Mirai)", "value": "3ba03317f5664c0e61ff3eaa27210470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537385, "uuid": "68099af1-eed2-43bb-9a06-c781efc836b1", "comment": "Malware payload (Mirai)", "value": "1bdeb2287faa1145ae1b4aae2bf6049f428ae5565b929a3b3273582e2e854d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537385, "uuid": "b558bf0e-c815-4d28-8a74-fb38fe366659", "comment": "Malware payload (Mirai)", "value": "cdee3f769345c577928b7e6ef9c15277589fc082", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537385, "uuid": "ad3c53d6-ac8b-4522-944e-e57730d5d92f", "comment": "Malware payload (Mirai)", "value": "f20d723e2308ca54349a2163be50dfb61671666280598134f88698b0dd3f80aed647744b826244d4d32213adb18dd4a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537385, "uuid": "2b4976ed-2403-4f0e-a1f2-33a33cc4dc95", "value": "T163431921B9361F17C0E0A4BD21BB4B19B6A15ADE26A4C64E7D720F4FFE216406942DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537385, "uuid": "67cee906-57cc-4a90-9c9f-22b28b25ed79", "value": "1536:bdHVy8b9XLv75k9uj7/z50lejPz5ljzBkpgr:hU8XvjPtlvKpgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537385, "uuid": "b27d37b8-421b-4f6f-8177-56c32b14c2a8", "value": 58688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537385, "uuid": "8e427995-3dac-42c4-8f82-201f812783c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537385, "uuid": "56fb60e1-1082-450e-980a-ca5df28cfb20", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f3eaa2-7aac-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783501648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501648, "uuid": "e39b28de-b0f9-4604-8af1-3dee6632dda9", "comment": "Malware payload (Formbook)", "value": "d91b89d43e0ad4044cdf123a203f2699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501648, "uuid": "93104964-4ac2-47d5-bf11-f66c49bdb1e5", "comment": "Malware payload (Formbook)", "value": "1c275edff53298c21d94ebac4cd30199666a0872e5072dcc704b74fb440d9d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501648, "uuid": "e7dd3856-0f45-4c02-8c3c-1a65d36b4bf0", "comment": "Malware payload (Formbook)", "value": "b86db98e0fab929c29fae94e3c2d2566da482f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501648, "uuid": "5b6509d8-b6d1-40d0-b1d6-05b939b376cb", "comment": "Malware payload (Formbook)", "value": "53a75bd071ca11cd35c1a8e130fd9273c984a16c5045601e5b89761bbd3f7cb42c1a210b1b06c840c651f52f53e697dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501648, "uuid": "d81cd2c0-4bf1-4a64-8510-b49b98e2d3ee", "value": "T1EA2522903B05DE01D4D30B72D071F3FA13B62C9CEA52D2038AFD7EE7753A65A6819692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501648, "uuid": "4aa6b022-6671-4e90-8de6-6bf026abe7db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501648, "uuid": "0ffe2227-8499-43d8-81f0-8f7f068b8322", "value": "24576:7930JvfcdiF6P9LqAIB0+bevaORgc/LDnJy:793i0di49LqAH+bewANy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783501648, "uuid": "72e85465-529c-4b5d-99f6-bd6dcd6117d8", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783501648, "uuid": "2e4836e0-d6b5-4ada-8e6c-106ae320c164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501648, "uuid": "3c733f90-36b2-4236-bf30-4bb288e568ce", "value": "ZPIN2566050_S2424-035 RSdI28yZFV91YV3uK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47c5d47-7acb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783515101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515101, "uuid": "0b5bec1d-77ca-40f0-975c-f51961f0e691", "comment": "Malware payload (RemcosRAT)", "value": "5c0046363e87ed639c0b37c11f7cea35", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515101, "uuid": "717c286f-c49c-4b76-b8ce-f3002eafa29b", "comment": "Malware payload (RemcosRAT)", "value": "1c57a6d4b88891e24d54341772fc3d32342e9678d024b6007d1b7abbd42fb302", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515101, "uuid": "56995031-c06e-49d2-84dc-8a9df21f49cb", "comment": "Malware payload (RemcosRAT)", "value": "a4e5f34188006a29d215fd597f14202729f977a9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515101, "uuid": "9e48bc44-c421-4a57-b896-c75f82d597a6", "comment": "Malware payload (RemcosRAT)", "value": "0840c86511e1d779eb422a32c0e739ea2725300022302fe077027e4c3143473dfae3a35a3f29fa058c9983d53dd49141", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515101, "uuid": "b1ea89de-2a42-44b6-93c6-c144fa21680a", "value": "T18C032A61DDC11B794E5707ACBE10795480FC5B2D863680DCEBAE271E112B4BC9B3A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515101, "uuid": "620f30b2-5ddf-45f0-8f11-784a0c001020", "value": "768:S6+R/syOa3QEvLNV2hKmcxzJRRQhVJQdTx9SPTllIUaEVLIni:S7d/d/T2hKnxzn6hAIbHIwVUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515101, "uuid": "66e5b26f-3210-40c3-bb0c-8f1cddbc3d3e", "value": 40326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515101, "uuid": "09cd5c3c-513d-40f1-84f5-2697bf7c9629", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515101, "uuid": "14bf0c99-ca3d-4598-93ab-77373c9de70e", "value": "QT2026-03-0300 Pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385f87b5-7ada-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783521309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521309, "uuid": "64ee2f61-432d-4fa8-b698-a75832c8239f", "comment": "Malware payload (Mirai)", "value": "89709992699b07cf38a763618445fe5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521309, "uuid": "ece6bd37-68fe-4b3b-b7fb-5972fe31c51b", "comment": "Malware payload (Mirai)", "value": "1c5b6f1f42749cb4ed1352efee249a4da53953aa4a3bc63d9df461c50d530260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521309, "uuid": "652fb391-6399-4ef5-8ceb-d10ec5b3d2dd", "comment": "Malware payload (Mirai)", "value": "2242b8c45bd3835608c7a1ae4d588c3242147570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521309, "uuid": "384d08d9-3091-402b-bed0-cdbe3026a7ad", "comment": "Malware payload (Mirai)", "value": "5c13e82c44206aabc86d7cdc0d8a7f5355e8dcd2e959e2e57aa941f71f3c51011ddbd98f088fd7fdccdd28374192bbbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521309, "uuid": "2b8c5cbf-eb2e-4c11-91f6-b62248a3c12e", "value": "T1DD934BD7F800DD7DF80AD73B48534A09B271B7540A821F7A6297B967ED331E81927E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521309, "uuid": "94d6c3e9-033a-409d-bd7f-4d834cc3e76f", "value": "1536:RfWODP4tOpGTUrNh/8utg+/9F3lU04Ajkn1W/pbuNDIy0RItp:RzDP4tOpGT+NhxtgY3a04ulbkIy0RItp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783521309, "uuid": "679a1c94-6929-40ad-9dcc-d5762aa7d667", "value": 91796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783521309, "uuid": "c96e7e89-bec3-4dca-8fad-f198cd1481d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521309, "uuid": "2ee1ae88-d383-401d-9f57-f2ea8e147359", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a280477-7b03-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783539055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539055, "uuid": "de47eb59-346c-479f-abec-737b62bf5fe7", "comment": "Malware payload (Mirai)", "value": "e78258b8ee49a2f89b17e8737f98f429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539055, "uuid": "b38b9373-afef-4915-80d8-d26d6f9b2d13", "comment": "Malware payload (Mirai)", "value": "1c621be2cf23e511aead32e47549a2dd1f2740ba35329a5948798aeec0951695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539055, "uuid": "43e7b163-9eb1-474c-805b-f6f6fd249bdd", "comment": "Malware payload (Mirai)", "value": "c039b97eb4066491f42a2a6bef7bda62bd0898dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539055, "uuid": "f452ec7b-e9bd-43f0-8ed7-19be85ef7565", "comment": "Malware payload (Mirai)", "value": "a08c3b13a206c77699941dacdea4a34a0100de7607634d4e03f2396b5aaf3813a62233c371dbf4e5e6b9a6a1c9140d28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539055, "uuid": "0b919db1-bd17-4f14-8d42-437641bb833b", "value": "T1FC23E691B8819A2BC2E01379F5AF958D3360B3E8D2CB7227CD614B507AC651F0C7AF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539055, "uuid": "6e1bfb97-9ee9-44d0-b0c1-254e61252263", "value": "768:iI9z3mM6JkpQXb770ClxZxmJZQc8CYX1P3/20kFrMXrOtCE62/DAWUWYb6ZPLbxV:bmM870UZxmfpYX1Pi8X6xgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783539055, "uuid": "1ea64b0f-86a8-408f-b1d8-31881cec6188", "value": 47292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783539055, "uuid": "3dceec2c-bbdc-4f15-9570-06398e8904c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539055, "uuid": "18b9aca3-ae0d-4900-a7ed-53466a12d0b2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cb297e-7ae4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783525928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525928, "uuid": "ed2de031-d656-475c-9ee0-0e46329a20a9", "comment": "Malware payload", "value": "9d33fd947701d888ea43ce6ac1c78cbf", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525928, "uuid": "0097a993-3d7c-40e3-935d-63c83887339d", "comment": "Malware payload", "value": "1f0780dc6c9b55e082a504bea8cff6b367fe775b8fa34485a0231024d9470e31", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525928, "uuid": "7945d815-194e-46b9-a833-177bfe12eb07", "comment": "Malware payload", "value": "65ba94bd79f2ab392059f92dc0d58edd4b28cd6d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525928, "uuid": "65dcd694-5bd9-4521-9773-6b4efb9678aa", "comment": "Malware payload", "value": "2e6f9171eacdfd159e42ef8cd39294f3f26bf436dbc18b6140be43e671e3e1cdac0872e51f03a434be07f4c1d284bd61", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525928, "uuid": "45d1af7f-a084-40ac-a128-03c49cbdaa4a", "value": "T1E4E633086AE012EFD9B3423DE9E35A66E49C38750B72C9DF13AC46A17D171A10C3E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525928, "uuid": "a6550ab1-bcea-443a-a1dd-3ed0e2152733", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525928, "uuid": "3924c74b-dd76-4779-b02a-67773af51fca", "value": "393216:KgDPJc1tlaWFsZnFXMCHWUjXrcuI3/PGTAI:KgtiaWeNFXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783525928, "uuid": "c2663c31-8a3b-4163-9403-766fd1b507ae", "value": 14312686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783525928, "uuid": "1ba29301-536e-4928-b41b-f08b07f902f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525928, "uuid": "ad0b1a7a-3618-4eb9-8870-a0330ab2c2b2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e961a907-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473932, "uuid": "04aee51f-90d0-4b83-b56e-5ce95532f98c", "comment": "Malware payload (Mirai)", "value": "9392643d268f3d02370be753947c51e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473932, "uuid": "b9463d29-4934-452f-800f-47f15554d13a", "comment": "Malware payload (Mirai)", "value": "1f152c19dab01a8928ac2f7fc48e69c742983e05ce5b98437a88c7f3967854d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473932, "uuid": "4efa0a4d-d04c-465b-abcd-ad8f22ae67f9", "comment": "Malware payload (Mirai)", "value": "dabd56a3edfa13c3d91ccba1a3db5845f3eb1e4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473932, "uuid": "458bbdb1-8fa9-45ac-991a-a2cdd05409f0", "comment": "Malware payload (Mirai)", "value": "51ee2c1d2c65e80e300d0c5a139c8fd2f28cc4e06cd4ffe7eb8fa75443ba5da88db8170d7f8f4efb3c2a4bca436922df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473932, "uuid": "82d5eb4d-0857-4a28-9c22-a034e305c2cc", "value": "T1FD543A02FB1C0E03E1272EF0263B87F197DFA9A12DB4B640695EBEC54273D71A545AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473932, "uuid": "6fa7737c-8c3d-4dd1-a99f-a5578f7fce9e", "value": "6144:fSGhpUkufLSkbp6egFmEGIsBx9c4mFL5FwjcOc0Uo:f3pUk4zbXg0jXcvD6jrUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473932, "uuid": "2e4fafe3-2562-482a-b2d0-a52abe2375a2", "value": 278904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473932, "uuid": "c511c14b-cb37-457f-9eb0-4147d2df7107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473932, "uuid": "4866f35f-6b22-4480-bfdf-8aa168b6d20d", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee4aae4-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493241, "uuid": "ecbc466f-b0c6-42b8-8099-b8f2af60a888", "comment": "Malware payload (ArkeiStealer)", "value": "feb2ef2b1038ca50fd0551920d5b878a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493241, "uuid": "9a12471a-5bb6-4145-9cd7-4ed61888201c", "comment": "Malware payload (ArkeiStealer)", "value": "1f2b4cd5fddc89fe846556ebba5e96458cc56bf935bbf34055744ff54e0fcecf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493241, "uuid": "ebeeaf14-0caf-47fc-8a03-31f7ef4f8c34", "comment": "Malware payload (ArkeiStealer)", "value": "c61e12fb003866080ac0fa5434d4110154ffc0ab", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493241, "uuid": "f9efdcf4-2694-4a00-8196-4408d6e5e70d", "comment": "Malware payload (ArkeiStealer)", "value": "b1963cfbea2a95bc8a5cd0c87baf3823b28ba002e246505733b3fc0f40cd134e2434f6c604c6b6c89891bdc2a740cd28", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493241, "uuid": "16f2f19f-3f4a-437d-a07d-48e84faa1ffb", "value": "T145D58B0B7CE105EAC4AA533689BA51967B31BC4A4B3237D72ED073382F766E28D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493241, "uuid": "6a46b6eb-9c13-40c1-8b96-b85ea83c4957", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493241, "uuid": "42790a5a-d1d7-4bfc-b7ec-739600b7decb", "value": "49152:DBtcSIxDtRsbJjZQpItLHbrWqOAadasbCzcxF34Nr:DBB60RttLHbrjm9xF3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493241, "uuid": "2bbb5b13-4429-49f9-aade-c37f86adde40", "value": 2932584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493241, "uuid": "7e6d8b38-1c30-43b3-8ae8-55b6afff6e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493241, "uuid": "48be27a6-9092-4b49-859f-64ab3ebc3345", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40316.12810.15091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe618b50-7aa8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500166, "uuid": "3cce7c4f-1eba-4042-85ad-0178f08514d0", "comment": "Malware payload (Mirai)", "value": "973541567bc9412da2ec2fd978f5085c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500166, "uuid": "85304b73-dd8f-4f1a-93c1-5f6f4c038f85", "comment": "Malware payload (Mirai)", "value": "204430026d5c39004648eaf691dcd8ab843a74cce8a65140b107b30b3921e1ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500166, "uuid": "7020501e-4aa8-4e8e-83ed-dd2e7d378b89", "comment": "Malware payload (Mirai)", "value": "e09d5297c4394676598710238212f04cccf70a1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500166, "uuid": "170a082c-3214-405e-9ce2-1b697034fc10", "comment": "Malware payload (Mirai)", "value": "6f1244a050195c97603eb9664398da8832d3b6c32ce61c21917bc8493c3a6f06a64d275f69df5034d85fedfc4d381700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500166, "uuid": "c3fda661-1d70-4a06-84c5-9df0edb5fca9", "value": "T104C34B0273180B47C5A319B02E3E3BE687FFE5E021E4BB89251E8B564575EB75849FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500166, "uuid": "97bf2f7c-7bac-460f-b9e7-b72a328b7c10", "value": "1536:KqL5Jj5lED60/rhmvQ+f2evxDNScNGPuFZ+1mWdHKyELsHvI:KqL5JjQ2w5qbDPfFUmLGHvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500166, "uuid": "5bd29a88-976c-4611-a027-cdc38d1a9f40", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500166, "uuid": "cb4e868c-a820-4fc2-b327-d8fe190d73ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500166, "uuid": "faff82bc-fc6b-444b-9a08-56c178ee1543", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda83e82-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473939, "uuid": "1f269bfc-096b-44d4-a89f-d670a3a201a3", "comment": "Malware payload (Mirai)", "value": "e24da9195399831f986432b6f5c766f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473939, "uuid": "b8a62c62-bdd6-49d7-adf1-7f1f1c7d7f8e", "comment": "Malware payload (Mirai)", "value": "2081580b46e6903e856f457ee1511c1a89d571a2285e2f227308fafc402db71c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473939, "uuid": "d59190d6-8897-488b-80a3-a6975364f123", "comment": "Malware payload (Mirai)", "value": "752ea337bb50fdb53de3893188499abc73982d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473939, "uuid": "20016a83-8cb4-4746-872f-0e2f7100b1f2", "comment": "Malware payload (Mirai)", "value": "cc460fd6e7a84f2e8df0e77c0058e8c49f40224167b99eb823109c4d416eee9719628313441836d96a7683031dec3c45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473939, "uuid": "32ac81df-1c20-4698-b95d-2c4c61323cb3", "value": "T1A38422FB5823A4DBF296943579B3C628360C37867E422848BBBEADC10F2D5AC5D453C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473939, "uuid": "6b49d8a2-2d35-4946-9d43-754f892badee", "value": "6144:UHhGHABxUR4fAGAPF83McRxccQ3TwCeiyTthE8SZuGHc9yWYfBxx+SuxQKt96snh:9gB+PFQ23aiyRhWlAyZ4xh1crH4XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473939, "uuid": "17be398f-2330-444c-9a8e-909670d65668", "value": 403812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473939, "uuid": "b848df98-57a7-4be7-b789-c2b9b02ba261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473939, "uuid": "48ccaa58-20ef-4e3b-9af3-0649dc77f3c1", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af726546-7ad6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783519791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519791, "uuid": "6d7eabed-d13d-45df-85a9-2d5476382731", "comment": "Malware payload", "value": "a87f808d7567ccf168323217b60b761e", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519791, "uuid": "9f623631-89df-4474-8a5e-492798a1dc5c", "comment": "Malware payload", "value": "2131cf9393df3e9b210aca80bbe332ee705f57acf0db48d6033e75432c6232db", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519791, "uuid": "3442c862-d653-4911-8d1f-5dec2e7fef5f", "comment": "Malware payload", "value": "a21e4029877908ce10c8a4f11de57ab99d6a4af8", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519791, "uuid": "3e56c36d-6e9e-4b75-bf53-f07c0a885910", "comment": "Malware payload", "value": "3648515224c7f43075b82162e20c1f5620e166de8596eecb9c1575b9cb714700ea98e59508b105fcfc3efebceb15feb7", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519791, "uuid": "91bdca05-16a8-4fe2-bdf8-adb32c223bb2", "value": "T1166633D90CAC981FCCA7862C25D57B765720DF8B4FD213365072A262D18DCA19EB1EB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519791, "uuid": "6cb419f8-4466-46b8-8dc0-5b9147ad51c9", "value": "196608:XeTsKjIrptC5nllyNWnpnUxELUlPA8W7xYOK9i2RLbap:XeTnjIlmnkWnaELU3/93Rf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783519791, "uuid": "21410fb4-921f-4436-89d3-df7fcf0f6915", "value": 6974904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783519791, "uuid": "dbf1cd6f-6b9e-4a97-bbad-c7a427252af4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519791, "uuid": "53e52a04-85b0-4627-8584-405d6effe9f4", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad57ffb2-7a85-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783484998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484998, "uuid": "9d517687-eadf-4f91-a940-fad3b14ac051", "comment": "Malware payload (CoinMiner)", "value": "80e7089cffdbeb0595e33227e9b4bbd6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484998, "uuid": "0dfa1743-d648-4dc4-9b6d-d8c515945bb8", "comment": "Malware payload (CoinMiner)", "value": "2181e3938d19e6b620e9f95f0790504d64ba19d3f450c34f4ec4d1e87c39026d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484998, "uuid": "f6325e94-3402-4d7b-8237-ed9ddf470c5e", "comment": "Malware payload (CoinMiner)", "value": "994f9d84007faab75d516b997331fd010c18956d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783484998, "uuid": "d81418b6-3027-461f-9d85-2d812945ccc4", "comment": "Malware payload (CoinMiner)", "value": "921d1fcdc22c83ee95fa680f7d6339e3b858b66533aa3b737003db299869fd88e70d653bba51cc37580e631b314d8612", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484998, "uuid": "651588d6-7855-40f9-9ff0-f392fec56397", "value": "T11A22192A7E4A0331D3D488F45479838F653D5563A787E3EBF373A59A0BA63488440DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484998, "uuid": "b7c4f933-6642-4a11-9180-492cf9a0a29b", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484998, "uuid": "1fbde2b9-6d1b-4986-9090-2714fe455e5b", "value": "192:A6LoqaTBgx+ealq50350EPFJxTEZmFhSKOmV:A6LoxWwpBPFwZ4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783484998, "uuid": "1b01ba8f-ab7f-49d5-bfcd-f6d2592f8218", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783484998, "uuid": "ed71baa7-6071-415f-9c92-07b4c5ca731f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783484998, "uuid": "309f4b43-047b-4ab3-90fe-b214c9df5797", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a339b048-7a93-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783490994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490994, "uuid": "5f9cd872-199f-46d2-8b87-33a2ee89dbcd", "comment": "Malware payload (Mirai)", "value": "4969712019cc36cc5567eab6c1c5a723", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490994, "uuid": "a6c88dfe-92e7-4743-b480-46ab20273724", "comment": "Malware payload (Mirai)", "value": "21c25061c4b47dc528f62813dd6baae6d9827c6dd71199ed5c7db63872a4ea24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490994, "uuid": "a7368c19-61e8-4e07-a2d8-12a2455e1ccd", "comment": "Malware payload (Mirai)", "value": "a6e612c48319c859b82cc45288cedc4e4eb6f8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490994, "uuid": "858901fe-b5db-40f6-8209-f2924ac872ee", "comment": "Malware payload (Mirai)", "value": "da9afa10789b580f3c70bfb0997094a2efebf04b14a3c7fd2f3e9a58e91457e13603e049693a9eddd2a6ed959a3b832a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490994, "uuid": "f0100b50-5599-48a0-a3b9-ddaf407a1f34", "value": "T1B4C32945B8829622C6D723BAFA6E21CD336163E9D3DF31038E219F1137C659B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490994, "uuid": "d91b4ec1-acd5-4a60-9e71-97ed7b7f41a7", "value": "1536:lKSmAASQ6ei2cdv/Lpl+9RKp1anmmA4zQyCR8PajUSi0CmOlc45PLv7HGt:8PAA/6eedYZAlmPajU3xX7HGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783490994, "uuid": "bc758454-db30-47ba-9a48-292c764a0774", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783490994, "uuid": "6b16023b-0234-446d-87e3-5dd6b465eaf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490994, "uuid": "bcc4df2b-4d50-4ca0-90d2-cde8ac791007", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34ea318-7ad8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783520737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520737, "uuid": "97ffbcb4-47d7-4139-a942-45979057f661", "comment": "Malware payload", "value": "8e484794cb9765cc5ba80ecf14292f6c", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520737, "uuid": "6157bc25-2233-44c2-86cc-54f15682d823", "comment": "Malware payload", "value": "22350f77af96b09d72d473c3f7d666ef4777ebf61d7c81c4e26d46b3fe97d2c1", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520737, "uuid": "17ba504f-4d17-4336-9fd2-6292596c19c3", "comment": "Malware payload", "value": "4b29e62c2102785a3925fa821a75309490ddadb6", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520737, "uuid": "597bc2c7-ee70-41a4-a9ed-ba31e5324351", "comment": "Malware payload", "value": "0e3a5416f0d8e8ab5a2ea25f7982ea92ab2f015d698bf3da400112f9430b4cac4a254f4603372aec14565fc39c6689aa", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520737, "uuid": "684edcec-5071-4857-8ab5-a0ef35688e54", "value": "T14594C089F297AF1DC2AF9076FEC105C13FA4480AF06AFF7D767D5436285A1511C32AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520737, "uuid": "3dcf3b39-a5d4-44ad-b7ee-a97e095d1546", "value": "12288:/1CSAj4v3kEwR5vFMlxuv/Co5LoEmPZvam:tCZjyK5Nvq6Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783520737, "uuid": "6c24748f-f362-4fd3-8083-06b07fea0bc2", "value": 436148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783520737, "uuid": "a01ccbf0-c6eb-4130-bd48-969e9eb15ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520737, "uuid": "dbb7d246-f8da-42e9-95dc-02c2b8a423b0", "value": "v00lk.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66a0f7c-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493227, "uuid": "76306056-19cd-4f94-a8f5-6dde0bb3f28b", "comment": "Malware payload (ArkeiStealer)", "value": "87beb88db535029419a3ac57f51642c2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493227, "uuid": "dc2e0388-04b7-41d2-aa6e-2e148c38cd91", "comment": "Malware payload (ArkeiStealer)", "value": "22dd141a82c74ef617693b7007f98e681765f0726a0657618d5fd7d1eea0e0c7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493227, "uuid": "17c1a45d-a44b-4212-b2a0-17ebef2da592", "comment": "Malware payload (ArkeiStealer)", "value": "2db2928d2a718cac9be50fbada7d86f258d56122", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493227, "uuid": "4625a954-c815-4aa1-934d-4be1c0e76bd4", "comment": "Malware payload (ArkeiStealer)", "value": "554fe009e37f236d1e9b26647f5d7b2f1ebeea887ffe4cc736cc442cecb591b9239a4dcf543925242a492c889cd6de5e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493227, "uuid": "ccd23c50-4c18-44d6-8aaa-15a5ac489257", "value": "T1E5E58C1B7DE005F9D49A933289B655927B74BC480F3223D32E90B3782E72BE19D36B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493227, "uuid": "d8d1071e-066a-4671-aaab-114af31f8be2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493227, "uuid": "ffafacef-58bf-4035-933e-62533e3f21b5", "value": "49152:mdDJTzro8TQ/K47K/AHrmFHrBfPFt9q1moziVlgSG9L:mdBzm7gAqFLBfPFt9kmy2lpG9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493227, "uuid": "aa71d173-046a-4a30-9d9e-41e5ab77a699", "value": 3022168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493227, "uuid": "a2baafb7-9ced-42ab-b489-fec844cbf072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493227, "uuid": "c23b8f98-aa59-440e-8abc-b57964eaf92a", "value": "SecuriteInfo.com.Win64.Evo-gen.22881146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a7a897-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475291, "uuid": "f5a8e989-a6f4-4178-8769-36742ff5c9a0", "comment": "Malware payload (Mirai)", "value": "cf90d30ab36738d663feb8eec7de6913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475291, "uuid": "7a1a30e6-8e77-4c9e-b649-aa160f920dc0", "comment": "Malware payload (Mirai)", "value": "2318a3412ad9136dc4b997a1159748cd6f15e2cdf9efb861f7461076112e498c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475291, "uuid": "07d0c8c5-71fd-4004-a518-0874cf7ddcda", "comment": "Malware payload (Mirai)", "value": "2439a69764c84ae1e7107972e7f221174f8c1d5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475291, "uuid": "56d548ec-5b10-4cd4-943b-f02058a52a1f", "comment": "Malware payload (Mirai)", "value": "f0d07f1d2c77ec1c632599e44c635b80397f586d29f0873fe21f6479e22d2b94f922af6dab5f112bdc22b57042a005c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475291, "uuid": "27e5651d-9157-485f-af03-dc53702c3a7a", "value": "T17B135B77E46A5F94C0464170B5648E781F13F5C493832EFB1AA982B154439B8F90EFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475291, "uuid": "1f067585-70be-439b-a7d9-118c6a2eb425", "value": "768:SauEhehYyJEEDKR4LrNHHRLW3VIC+locjdwSaCYqw:SaRhg/uE2StxL4VI+ctaCYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475291, "uuid": "239d450c-2416-492b-a1b2-dea0906a3026", "value": 43540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475291, "uuid": "ea1d1f32-43f6-42c3-b6da-ef24210a007b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475291, "uuid": "9c64d49f-7d61-4863-99bc-486767b5619a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ef0208-7ab9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1783507299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507299, "uuid": "a1dd4def-212f-43e3-9b98-53a37cb27e4c", "comment": "Malware payload (DonutLoader)", "value": "f504a5cdc9372377b5374dd4b04f0713", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507299, "uuid": "a51b40b7-9951-480f-971b-c1377c4d65c3", "comment": "Malware payload (DonutLoader)", "value": "23f9c51c704fbf90c089dd0544491c3e1e810b7f5ebe0c736022a805b48fbc5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507299, "uuid": "d8e6fc47-de12-459b-9d20-da7e0dcc860f", "comment": "Malware payload (DonutLoader)", "value": "d9b1cf530c80a6f64255db9e08953d963dd6ebe8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507299, "uuid": "221b5621-a6e5-4086-bde3-1cb70966d4f1", "comment": "Malware payload (DonutLoader)", "value": "cd2155bb2900d579283c08e27343a93bfac4f35758b64cc913e8c230656e73d873d84f516eaccf4fd2308984fa782457", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507299, "uuid": "56ecd419-c902-4fc7-ab62-90630a6998ba", "value": "T1162733D8F0F1D85BF6E8117662A85E61531CB2E73445E6AED78C53FC260DBE08387162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507299, "uuid": "e487944f-b69e-40f0-8e4c-3da4ad63b734", "value": "f82e75f211170f25ba008d10a68527b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507299, "uuid": "91f8ba88-7b9f-4158-9b54-bf6961806df2", "value": "393216:xkA5LtbkA5LfZakPJTM+kexR5//clhdZakqJTM+kexR5/W2eSB:+AltwAlt3xz/UlBcxz/rea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783507299, "uuid": "558a87c1-987a-4f49-a618-6a9ae082e65f", "value": 20915987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783507299, "uuid": "36984c0c-4c03-4685-8b85-2bfbf356d038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507299, "uuid": "0b05da04-fff4-4f6b-b7e0-99e7dbc95a0a", "value": "oledlg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1d15cd-7aed-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783529529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783529529, "uuid": "6f4102ae-6eac-4b4c-b3a5-7daf5c91885d", "comment": "Malware payload", "value": "2efe1039f963f6e846c796ea2e831b0d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783529529, "uuid": "ad76bb60-ffc3-42c5-81bf-f34fa37a3ab4", "comment": "Malware payload", "value": "240bd779d68fa536939d9eb47e61d78cdc760ad0dd8a885ed70c3077e44e13f5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783529529, "uuid": "cc012314-bbef-42cf-bc79-8a967d1ffeca", "comment": "Malware payload", "value": "8e3f6e296b2f55be7af4a8172ea7e9fa6ec038e5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783529529, "uuid": "5ab70712-163c-4177-9ebe-e9c9730848f1", "comment": "Malware payload", "value": "ff5b14c2ca2bd7214d5ba709492b96f96f80c22753dfcce2e82c74a8a20a953887ae828966898b4c2d4945260d1093e6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783529529, "uuid": "c54a4bf8-ecac-4020-ad02-30eb40beba04", "value": "T1C1E6332C9AD402ECFA33803CFEF19596D4E634B61B32C69F1BA452A95F570E04E39746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783529529, "uuid": "da0eead4-4d66-4f17-b945-4c9eae39f67d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783529529, "uuid": "2743ef3c-748e-4efe-a4c5-b0c75533d1fb", "value": "393216:7c7BNa0auqCj80HXMCHWUjXbcuI3/PGTAI:7gBNa1HsXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783529529, "uuid": "44d76192-c431-4208-b09c-4e0744706da6", "value": 14304124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783529529, "uuid": "3db6609a-e0ae-4ac5-af49-7a15feb151bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783529529, "uuid": "ae6df9ee-dcb1-40c5-b962-75a2f454f6ba", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7627b67c-7a78-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783479322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479322, "uuid": "5dc121fd-85d2-4733-acb8-4a462e747f8a", "comment": "Malware payload", "value": "2edb118e4db7268d2b51963f1fbbe72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Yephiler", "colour": "#096CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479322, "uuid": "544e9ecd-bc91-4120-8dd3-c8d503a7fd63", "comment": "Malware payload", "value": "24b1c3f96179633ed7a40190ea103c558cc182c32cab38e3399a81524cb578b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Yephiler", "colour": "#096CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479322, "uuid": "0f378fe7-d3ea-416d-98a3-b38dcffae220", "comment": "Malware payload", "value": "9606c6cf4d6ad6cfa143845e80461539f942d589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Yephiler", "colour": "#096CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479322, "uuid": "73226fb0-6375-4fa2-a273-2b5129a61032", "comment": "Malware payload", "value": "aed0269b7a519fe92581ff955a2f5007501297a26743cbd4199f1441f0f95f8bf8d566f450280ba66349fb6b204ea542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Yephiler", "colour": "#096CF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479322, "uuid": "52fbb378-3991-4fc8-af25-a578d616fa1d", "value": "T150A73347914E94E2CBA8B4B21016098C277850F33C30A6DB77AF0D49D7696DB2FE9D9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479322, "uuid": "ec45ba52-9dd4-4cb3-93f3-560251a9f73e", "value": "4fac38a977655de0f2858087be1ed60a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479322, "uuid": "ba677322-54bb-45a7-a268-588bacd0188f", "value": "786432:MqYWNfsvVp1VhX1D7k2Jhk0SCiQ/Kr2fAz+oGij+xzUqz4AOG6ai:M/W0L1VhZk2s0SBMKq4WxjvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783479322, "uuid": "975a93be-e8cd-4110-81ee-01f98cd8acaa", "value": 47654073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783479322, "uuid": "38ccc30f-ede4-496a-8210-d0e86e998004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479322, "uuid": "16c9b6c8-1cb8-4bd1-a6d4-16ecb4300802", "value": "Clash-X64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f440f7-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537382, "uuid": "c965f619-6fc0-4bcb-a907-0e2ea4bcbf85", "comment": "Malware payload (Mirai)", "value": "463e245aa4d2a5b64a79c505d53e5542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537382, "uuid": "c1884ee9-a5ad-463c-ac78-f7bdd3824754", "comment": "Malware payload (Mirai)", "value": "284189d1927f940980ba488c7472a8874e0bac8fd98dc3ae474a68b96a537ed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537382, "uuid": "1658fe53-d2f3-4839-a401-ce8554a95c8b", "comment": "Malware payload (Mirai)", "value": "f4b75e3a4d9f3c0084118d66485eee21ddfe6f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537382, "uuid": "ca9ec0ca-108b-40f3-a0ba-b3a7bb169be2", "comment": "Malware payload (Mirai)", "value": "674ede628ba5861af13e0b62c2d96987a6f5309b9bd9065b7589a3e1baae55ebf07d97e33f5aa576ef7b4458f89aec9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537382, "uuid": "1c7656d8-8ab2-4448-bff6-419bf027b90d", "value": "T167A2E10E81A8148BCC77F178625F91B7583D9D0217F6E3D536CAABD6969B089E03C4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537382, "uuid": "c911cf3d-22a9-4608-96cd-18cdbdafdbd1", "value": "384:Mds5Bdw+1GZEwCFcp8wM4IY7xovh5vxKoTNwiiCSs2RQf9Z/gwWk2/+v1R0:csDCmGDiwMa1MLvlW1srZ72o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537382, "uuid": "f597aa85-ccc2-4c2d-8edf-5680321c7900", "value": 22868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537382, "uuid": "f7d3ed6c-3bb2-4a28-b420-8706e1077f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537382, "uuid": "13ccc8e2-90a7-4d07-bbed-b3a502c7ec30", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66382ff7-7b06-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783540284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540284, "uuid": "1306251b-02f9-466b-bff7-0423113e89f0", "comment": "Malware payload", "value": "25d22b170f8655c89f9acba8923fa752", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540284, "uuid": "88448fca-94e5-4dfe-a978-20ef6cac5364", "comment": "Malware payload", "value": "28f88f69a165f5bca7bba2f7aa2add6df476a7f48d5963c331ed27abd063c07a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540284, "uuid": "cf4ba655-42d0-41c6-8033-61636b46bef0", "comment": "Malware payload", "value": "1c79777b12c2e857cf8123c4b1b9e5a19ee36ab0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540284, "uuid": "9fee9659-ba23-4b9c-ad71-4501cdd924d8", "comment": "Malware payload", "value": "81f617c2033cbf73d640700fa02d39610832ea7c794e5b242f82045198a41ce03a5ce1295049ecd96a183c4d15766067", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540284, "uuid": "a69a6d44-bb75-4366-a203-ec5ed5afb5b2", "value": "T1A9336C6616817C24EA98D8361D7F1F0CBDAD43E6320492DE7FCA3CF28C5AA9D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540284, "uuid": "8268e69d-9fb4-49c9-90e8-94d6f62db021", "value": "768:DXRWNGxVk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:9lxbcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783540284, "uuid": "2ed99185-c57e-4863-9d86-50853ed08249", "value": 50362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783540284, "uuid": "3e9591d3-f92c-4742-9252-18a8cc1cf64a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540284, "uuid": "de2b7b63-418b-4111-9e7e-075a827889f9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d1a522-7ab7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783506546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506546, "uuid": "626619f3-581e-4f86-8f65-9c2be20105b3", "comment": "Malware payload", "value": "7c59e2ef7dfdd695f3158e0d85f12c37", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506546, "uuid": "5b0a3eb0-32ca-4f9a-8d8f-4a09fad03ecd", "comment": "Malware payload", "value": "293addd95ca1a334d29be0732ea85f5a1c6dfcea9ac6fec3df3357438f682fa4", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506546, "uuid": "6f403eef-594e-4b05-bdc5-e81cb7ded33e", "comment": "Malware payload", "value": "bdd2372f8f5d7e2d8c428b0f701445847590a0c2", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506546, "uuid": "7a04a935-199a-49f6-8609-b8b461e6e99d", "comment": "Malware payload", "value": "726c2bab100e5dd9c832f93f10a391ea2efe563fb24ad62f482aa279064a9f249c076aedda5d1a192aaade6a00399ffc", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506546, "uuid": "0abaa2ff-904d-42b2-822d-745e5fb65556", "value": "T15AB3D963B6FA153D3967D8E726A6578A3030C003D947C6047AAC61A98FD2DC6D9F3BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506546, "uuid": "9b24da7e-9dbc-45e9-a779-e8e8afe592b0", "value": "1536:WbZQqeb2yAWu4cJeOG55QfDQvUWX2LbgqE:ufyPQFmqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506546, "uuid": "0e9a9cfe-ae49-4951-a662-0bb3e112069d", "value": 111556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506546, "uuid": "10849057-b350-4a75-8fc3-f6ca6d561a01", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506546, "uuid": "aa8a4072-74d0-4585-b52c-73cd03c820ab", "value": "call.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd96569b-7b01-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538283, "uuid": "ce5addd3-49a1-4aa1-a8a6-eda2fb4170e0", "comment": "Malware payload (Mirai)", "value": "ea1be5d4a7cb7b2fcddb44e99a08a409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538283, "uuid": "1a239372-5154-46fb-abb1-0c16b2f37576", "comment": "Malware payload (Mirai)", "value": "29f5392bfbad0ee2111af3f4cc1e0ecd605e1019131bb25c99b325a036e3b86c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538283, "uuid": "3f41e0e8-114f-415d-bad8-e1f6c721fa43", "comment": "Malware payload (Mirai)", "value": "82821a40aa0eaf4f95c02d4cfdce95f028c47f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538283, "uuid": "4e2bbc3a-17b1-447c-88e9-43e60663aef2", "comment": "Malware payload (Mirai)", "value": "a4bd332af3e5d8514cb2b49b3f85d3d589ceb77a91080fe9610bef25d161f7f2b2de9e67a208a4bb0d248cb26f8e4996", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538283, "uuid": "f136eff6-92fa-497b-9a95-049d59ba7b1c", "value": "T1F6337D35E42A9ED0C9564434B0688FB41F13F2C883532EBB2AE546F16453968F909FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538283, "uuid": "35da324f-a0da-41ea-975f-56c1ff86d417", "value": "768:Sasye9VTqZaeJtcLrwOUafoatFC3b/9j/sC37oeCgBBCQTw:Sazm1YWGafVep/sMcefBCQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538283, "uuid": "a48116d5-be69-4c79-9123-72d95326b80a", "value": 50484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538283, "uuid": "3783662d-9196-46a4-9ba3-73d299bfef01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538283, "uuid": "15d6a85e-8b1f-4371-87c1-27f3d3f8517f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3122ec-7afe-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783536728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536728, "uuid": "a9eab431-b6be-4137-bf5c-456fe3fdf1a9", "comment": "Malware payload", "value": "b6390a946a741829561f9fcbf50b8164", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536728, "uuid": "18f00f67-7a74-454b-8415-6d89f5e54122", "comment": "Malware payload", "value": "2a5585d256e92580fb2752fcfddc0a7d9b31256a72006e78e99795c5236301db", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536728, "uuid": "d6d20c48-a49d-4ba7-b379-4b961116f6c9", "comment": "Malware payload", "value": "9d05a56cc52746b98b94498e75f635fd085f72de", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536728, "uuid": "924ff916-e3b9-42f2-8390-a47f8b1dbb23", "comment": "Malware payload", "value": "e450896bebd698ca76adc301d411e3fc95a28c8de5bc04cf4fde5f086a3d0e1a8ba673bbf4385e0fe8228de89016da1f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536728, "uuid": "444d174a-bf94-469f-a344-51439623e581", "value": "T137E633089AE022FADA73403CDEE145D1E979B0B6A731C9DB57A8D2A17D132F14D3C16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536728, "uuid": "d4edb0b8-52db-4ea3-b1f7-8aa29144c186", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536728, "uuid": "70d3f427-35e5-463b-ab25-fcc1196c76bd", "value": "393216:8rKw3XXXMjUiZ6Q3RiCWpHKGXMCHWUjXvcuI3/PGTAI:8r7fQM7pHKGXMb8XkH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783536728, "uuid": "aa193862-8e6d-4714-8276-b2686f7da88b", "value": 14316871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783536728, "uuid": "dcd70c89-3525-4d3e-a51d-5ca8173913e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536728, "uuid": "12617a72-77fc-446c-8bb9-ce8b8a381f52", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a759bf-7afc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783536152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536152, "uuid": "1b101a03-7d65-401b-b2bc-bdc3057190c1", "comment": "Malware payload", "value": "18b701c0ac105fe44d06ff4a8b51e6ea", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536152, "uuid": "61813378-3e24-418e-ad8e-8e277630c328", "comment": "Malware payload", "value": "2a57354f1393e07c42b82322d2b18ee2c6da7b18212db5788c94f857e4cfe121", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536152, "uuid": "755a8457-fd54-4f36-82d4-24554780334a", "comment": "Malware payload", "value": "7bbc5b1c25378bbf5e04280af8ec3b47b2eb328c", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536152, "uuid": "ea297ecb-f1b4-4960-a20d-878e37dfb956", "comment": "Malware payload", "value": "ac715d8e21bb4e4a3ae0e4a1503df090a5c8a849fc4ce068a4ad1364fe9e37bb15587de8fb5aa7ae6b9476baabd2b9b1", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536152, "uuid": "4e94f520-ffd0-422a-af2d-0cd3986c5c25", "value": "T1A6D62333B28AA53EE17A4A394972D214543B7BA1AD038D1ED7F408ACCF251B13D3A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536152, "uuid": "631d6aed-8a6a-416e-9242-497efc9760b5", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536152, "uuid": "9c89a3d7-ee60-464e-adba-4c994c7d420c", "value": "196608:P3lUcAVdGpOgRg2g1czFlxULr8imllMt5moD:P3lUczpOYg71czFlxUvR0mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783536152, "uuid": "c2e0bb6d-b0e3-4892-8b07-21b904b1c6c6", "value": 13215898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783536152, "uuid": "c4345eca-ca5a-41d6-b5e2-be83cef3dfd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536152, "uuid": "542556f2-33fb-4017-a303-107352f8a391", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83381262-7b18-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783548063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548063, "uuid": "7f1e7a83-f440-47df-8506-19d8cbddd81c", "comment": "Malware payload", "value": "4f2ab71e9c4270548b3d8e9e62bd7279", "object_relation": "md5", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548063, "uuid": "c9f4a103-9f8d-4e81-8fd6-5bae2aaf4994", "comment": "Malware payload", "value": "2b5fa9b9db15a70b3f902632459d1fec97dc834149dc2a0bd5e8e04c6c3f494b", "object_relation": "sha256", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548063, "uuid": "93a975aa-0374-4d34-88d2-e81eed54cfc6", "comment": "Malware payload", "value": "06dfe02acdeae34dac7f09584d0d75c750fc38a6", "object_relation": "sha1", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548063, "uuid": "1f1315b2-c215-4cc3-af8b-06051e1f8288", "comment": "Malware payload", "value": "c1bee7bcb84122ca46ae912cbca7806fe2ce8b7a9f678ec671e088132b8ff71356cc2431f69345a2098b064567de644f", "object_relation": "sha3-384", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "clip.dll", "colour": "#3A8D51", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548063, "uuid": "b8143e36-2e1e-45b2-b722-05a947ea696f", "value": "T193C35A213467C071E99D597E1CA8BBF0476D7910DFA14DE73B840A279E206D3AE38D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548063, "uuid": "3492fd39-442f-4c47-97c7-4fa115d6e37d", "value": "41a061f19f2a7afce4f3586f40ee23ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548063, "uuid": "7aaae74a-d099-48d4-800b-678a2092a0d9", "value": "3072:jYOCGInnVo+TOVQET2bGWG6ZoRgK1vVy5RmVSb:jGVi/8GWPZIkaSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783548063, "uuid": "18a8e2c0-b641-45cc-9cdd-d5fa6e0fe404", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783548063, "uuid": "60a4288a-7739-4573-98e9-fb569af8f37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548063, "uuid": "64b17814-f45b-4235-87de-0a1f204a0d2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52771602-7a92-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783490429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490429, "uuid": "78cac378-5ea7-431c-9dfc-4b15088442e8", "comment": "Malware payload", "value": "81f9d6fcbf98c84bbbabd21e4a8cfd2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490429, "uuid": "bc7bb6a9-861d-4470-bbba-b33f092591aa", "comment": "Malware payload", "value": "2d647f18fa45771544d9ddbe713c1d41d6a0e287fdad42326a64addadc73e89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490429, "uuid": "0554c556-2828-48d0-84ea-08ff40944f62", "comment": "Malware payload", "value": "85776fe4bb334d0846787ba8afac9b7089ea57b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490429, "uuid": "e20af33d-4081-4d01-bb89-5adda2a3e3b9", "comment": "Malware payload", "value": "cd5df66264dacccd9063926fa6856cf7b7147dc4da030681a37a9f56a7f7addba7e2610c43b0434b1b19feb8cdf2b749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490429, "uuid": "ace44c4a-8cae-4acf-ae68-96d667d1cadf", "value": "T197E69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490429, "uuid": "4628a82d-2887-49db-9df1-83a0691d4ae7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783490429, "uuid": "865d6234-5e23-4307-9eff-0dda68192966", "value": 14942208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783490429, "uuid": "8a1c9b12-1b01-406a-b14b-1d3d512a8f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490429, "uuid": "0ddf75cb-52c5-4db9-964a-d5c4efea89d0", "value": "2d647f18fa45771544d9ddbe713c1d41d6a0e287fdad42326a64addadc73e89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c77b70-7aa9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500170, "uuid": "90267beb-d3a6-4990-bcfd-155703f50020", "comment": "Malware payload (Mirai)", "value": "cc1b5524eee230b3e339d84b444e2639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500170, "uuid": "79aba85e-66c9-49e2-adcb-30f640b7d942", "comment": "Malware payload (Mirai)", "value": "2ed88cb1aba8a20860971f262226096bccec5314a7fc5583d980627e6b163bb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500170, "uuid": "0671f995-27e6-4b3f-abd1-276eeac95fec", "comment": "Malware payload (Mirai)", "value": "d707177d0a217c102dd6d9a048a374354035c186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500170, "uuid": "a5cba9eb-f0f0-44c2-a3cf-85044ad05810", "comment": "Malware payload (Mirai)", "value": "a581f987eeddb023bfeb6fccfd4c748f874718a173e673da498a4ff1dee227deafa4c87f2db7213401329124ac2e509d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500170, "uuid": "341a1fa8-843f-47ec-9632-4602a87e6237", "value": "T1FAC32AC0F98B81F6C40B88305166F73FDB3198A95163DA9DEF959F72DA73981912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500170, "uuid": "a918e076-64a5-4178-be82-abade9f7e526", "value": "3072:aFjlzYNVoZXRgn4c30tItERjnzWBsHs2rhKcHX:GYNVoZhk73OItIzzRwcHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500170, "uuid": "4fee2b7c-504f-46e7-85e6-9d2e1b9e4534", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500170, "uuid": "efe0939d-432f-417a-b5eb-4dd913ae95d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500170, "uuid": "c51c87e7-ba10-4fb0-8fa7-84cf9a706c51", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea226dcc-7acf-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1783516883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516883, "uuid": "78ba1c3a-ab74-405e-bd2b-e7bae785bc79", "comment": "Malware payload (DonutLoader)", "value": "4c2d6eb4c6c66b4133f11287394abda1", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516883, "uuid": "2f7881fc-f70a-43ab-9404-13232f087b8a", "comment": "Malware payload (DonutLoader)", "value": "302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516883, "uuid": "71dca966-9144-42f3-afc7-07dcd8d5da0c", "comment": "Malware payload (DonutLoader)", "value": "d310c046f97771d0d4a990be4aa3388eada0c0b8", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516883, "uuid": "d7122d3d-7d84-4582-b1d2-d461a1730c6d", "comment": "Malware payload (DonutLoader)", "value": "a1c831ea5a1b7e1218df4c0d86184b0ff305fc892f0ff496e1fdc68a3feee920370911fddf5b8f5c8f82f4ebdb019dd6", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516883, "uuid": "d779a0a6-4320-4534-8e23-a982121dc9d0", "value": "T1DB453346FF797DBF455CC30931AB2FAF4C700DC68A9DACDB9690AAA7424E5D84217038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516883, "uuid": "939d7510-714f-42ed-ae10-8d7497943b33", "value": "24576:xXJ29SjY5zzPuqsFn2hhdtNl9NNgb5sljizBXDq:+I0hdT8eQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783516883, "uuid": "00ad1355-033a-4c48-bdda-de235dbf60df", "value": 1278303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783516883, "uuid": "387344ac-792b-48dc-b5d6-25ab588bb6e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516883, "uuid": "a8c8f65d-b20f-48b9-9ed8-a2ce0739c1a7", "value": "New_Order_PO031430.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a8253d-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517034, "uuid": "d0260a82-0fed-4de1-8bb6-4f55a1c3127a", "comment": "Malware payload (ConnectWise)", "value": "73167f265dfbd888e514a3730228d82f", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517034, "uuid": "861a823b-d135-4191-863a-372e0905dfa2", "comment": "Malware payload (ConnectWise)", "value": "31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517034, "uuid": "67a86a8b-a7a7-436b-8f0d-f29123ebb472", "comment": "Malware payload (ConnectWise)", "value": "2c32f560af970493724544b19b05363db6e36d25", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517034, "uuid": "87bc3624-77a7-4745-b6be-ed52a351c710", "comment": "Malware payload (ConnectWise)", "value": "983e1a837f72c4d19bc2f1d003fab1810dbac923f0d8f56cdd50553b016b3c687561a207f9298a3308027f64acc51d3e", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517034, "uuid": "68dfb546-e10b-4e23-9241-737b81ef1617", "value": "T17C411EA220153409CB338A21D05703E2F69A2396DA113BAF70F5C891F826BD5D79FD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517034, "uuid": "cc236d88-62f5-4bff-bcaf-f559244124c6", "value": "48:/PUbWk3ldUDWqhNx3y/KVFmU5i335ZJRCHPZSBBq52nC8o:aWqDRqhf3yCzMpZmvZig8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517034, "uuid": "0a5c14fc-e821-471c-806f-724e1bea1572", "value": 2414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517034, "uuid": "333a55c0-477b-48e1-9087-56b924e47d4f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517034, "uuid": "697d2a67-8e37-4722-b0ce-b4677639bb90", "value": "SystemCheck.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d34ed0-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472926, "uuid": "3a28cc3d-ea0f-4ef4-911d-d98fcc08e161", "comment": "Malware payload (Mirai)", "value": "f475387fbcc555e6c7a1d2278ba79370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472926, "uuid": "242ff036-a3bb-4fb9-bf98-ed44e958c278", "comment": "Malware payload (Mirai)", "value": "32884e5b3f5005b89af62bb44fab9e112e59f5c97fe465efc99702627cced30a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472926, "uuid": "d6a5b84a-e221-49c6-80d2-b78fafe863e3", "comment": "Malware payload (Mirai)", "value": "ab22344537e74b478c0b334da94c6078475aa3a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472926, "uuid": "094f919c-ac3b-4872-ab57-d8a43c7b3c3e", "comment": "Malware payload (Mirai)", "value": "7143758126f086c7041f09a44c66f9fc19c5742f34a8be0a7e02fe57b6f74109690c4aa257705eea8dea242f1b5bfd1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472926, "uuid": "266914d4-843f-445c-9ec9-e5ceb025181c", "value": "T117133AC8F543D8F5D85705702137EB37AF72F1F62229E653D3A49633AC92A02E90699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472926, "uuid": "90e27995-4ca0-4564-bbc8-6ccc5d99b75d", "value": "768:r8ZB4sEag3ZTr8VMILNSiXkuEA3Y5MYpv1X7hgHqs:rq2dag3ZTr8VMILNvX/3JYptLhgHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472926, "uuid": "2c9c2380-ad97-4758-82e1-756b560b2c03", "value": 42448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472926, "uuid": "386ede15-4459-48f6-ac4b-b9e58fb998f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472926, "uuid": "2efbe799-1efa-4f12-a813-e5fb29d4ce5d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce25753-7abb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783507948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507948, "uuid": "ec0d8b78-b50e-41f7-b777-26bc3ec1f8cf", "comment": "Malware payload (Efimer)", "value": "7e5dd473c26afb3f385b6c72a3e061e0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507948, "uuid": "616d1b8c-2611-4600-88db-4203bfd25d89", "comment": "Malware payload (Efimer)", "value": "334b3334a295a16ba5db87de79d8d3db43b5f87021eac82efaa18a5fd5bd9e17", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507948, "uuid": "b3346ac5-1f5f-4d29-971e-95fca4656b80", "comment": "Malware payload (Efimer)", "value": "fdbb69ce0f608ea2c840284ce9f48fc814533c37", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507948, "uuid": "6cee9ffb-fe6b-4eed-9bbd-b713dfde8779", "comment": "Malware payload (Efimer)", "value": "8ad84101feeca736c2b89373159fc93a57aeb0e91d782c557e74701d28de1963b2a3c21c0767f79252e0973a178a71da", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507948, "uuid": "732cc886-ac36-4991-904d-6b3d5071032b", "value": "T1B8E633545ED103FEFAA78278FDF24659E1A978760372C6CB03A886B2DF131D04A3D616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507948, "uuid": "10188e12-8514-41d6-bcb0-d5abf4ced548", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507948, "uuid": "80c8067c-aeb1-42e0-9dad-e08ec456f4e3", "value": "393216:hkjdicLR6oXT/SsJq7EXXMCHWUjXIcuI3/PGTAI:hkgJoXNJq7YXMb8X9H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783507948, "uuid": "49422379-effb-478f-bae4-d4805e816b07", "value": 14311659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783507948, "uuid": "15e9d04f-eb5a-48ef-9109-b5a08089e2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507948, "uuid": "c199a167-81f7-4b8a-956f-e28ced452d73", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32ae40c-7ae0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783524119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524119, "uuid": "bf73a119-c94a-4844-b76b-6d7a6f56ed95", "comment": "Malware payload (Mirai)", "value": "b3231ee6cee9263cd04061392ee70acf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524119, "uuid": "cf85c4f0-d9a1-4562-b6a6-d9f987a68435", "comment": "Malware payload (Mirai)", "value": "338b63bcf5a869c55b2bcaa72d082991319e175addb6efe6eda5873bd2ed9843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524119, "uuid": "568325e3-d7b6-4867-bda9-86e410587b58", "comment": "Malware payload (Mirai)", "value": "0d4760fae874bd9245a46156a4af0324c05ee2b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524119, "uuid": "0e1e4151-4470-46cd-b6a5-cb4fc74f5068", "comment": "Malware payload (Mirai)", "value": "92e399427407369300d85ce0b1c0bde170f521514bb11e9f1264e4977d0f36e3a848c39de3de8bc4a7ac9ecf1b683b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524119, "uuid": "9d4de37b-fd44-4429-ab66-6811573b0e74", "value": "T1EDB3AE36E81968F4C07E8574E5A4BE790BA3F48052931EF716E6C6B65047EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524119, "uuid": "5ce53993-6467-4a9f-9b3a-055d1efbbb35", "value": "1536:t/juy48gLDajwrmRZ2QprowQi1YKiC7p74Pe/9C/6otd1pHu:t7uy7eaMYZProwQi1fiQye/93efpHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524119, "uuid": "6d74bdeb-6d8a-42db-ac31-5856af549c66", "value": 109776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524119, "uuid": "8766bf1c-c47e-406e-b01c-9e7accd45e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524119, "uuid": "09d937a8-b2c7-4288-bee4-5b112e44216b", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7802ea-7acc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783515496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515496, "uuid": "f7510c87-1e34-4e3b-83cb-8842c1cb9008", "comment": "Malware payload", "value": "b29ec3df6739e03f83cf6760e201950d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515496, "uuid": "132040a5-d333-41ce-80e2-023f11c1891e", "comment": "Malware payload", "value": "3462a0a47bc1167fac93a701fcd5314c8851cb0f3529fd18b10743980dcde008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515496, "uuid": "c789918a-8919-49e7-8359-d463eda7e068", "comment": "Malware payload", "value": "af9dd424ca312b954b1506d9680c60fee085086e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515496, "uuid": "d0e27e98-9654-4000-a1f4-ba48bc5efd8f", "comment": "Malware payload", "value": "26a8dcdc7b60a0471a598a964984dd868f7e1475eb66a5b904c73e0bf2623aeab5d417dfaf5047e204bef1a75e9dec21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515496, "uuid": "b74a5cf6-1167-4702-9927-66025e9666be", "value": "T112D51196C39E7E58AC80F6B658C561E8DEE3400D383A06B52D83FA4801251EDE76FF71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515496, "uuid": "d5dcd92e-331b-42a6-b4c8-c9ac09703035", "value": "768:sGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZGZt:G/tZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515496, "uuid": "01827893-b138-4f94-b075-b832c458c74a", "value": 2793830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515496, "uuid": "96c98d8c-0968-4b16-a6b5-240e6e5f20a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515496, "uuid": "236fd1d6-db6a-4027-b8dd-9a5fe7c1fee9", "value": "Justificante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ed20a5-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493278, "uuid": "55566c15-0c57-45ae-a053-7f4d25638423", "comment": "Malware payload (ArkeiStealer)", "value": "4359900845817a787f71afaf463fd70e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493278, "uuid": "4c99eaaf-e6ae-4597-bf06-128ac4c29f91", "comment": "Malware payload (ArkeiStealer)", "value": "3625de02e6d829a337ce865c719c078466c7aff8c89e9b88384fbcd9003b918f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493278, "uuid": "52cf0c2c-b91e-4f34-b0a8-25013f4c22b3", "comment": "Malware payload (ArkeiStealer)", "value": "cb89c6fd2a80a343ed8de8871af0d6b73c26971a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493278, "uuid": "06f23aa9-1420-4300-838d-d978ec652d4a", "comment": "Malware payload (ArkeiStealer)", "value": "8caa87fa1e8be3e09c8e4dac04c87ae9d64c862fd17991db876d251c411d269b998d31943664e6ae0b32efa5e59fa623", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493278, "uuid": "53c43f5e-edea-4437-915d-7e18d054a934", "value": "T15AD59D077CE008E9D4AA973A89B652967B30BC494F3627D72E90B2783F727E15C39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493278, "uuid": "5adcb716-ab13-4f0f-b6fa-5242b2ab1ddc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493278, "uuid": "cb121afe-8089-429b-9db0-5ea49d17164f", "value": "49152:5XCeyEqZsycE1QhDdUsJtX6XiBJAMUO+p1d8V84mo:5XyfT2xUsJtKSBJAMWLA8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493278, "uuid": "9ad4e2f9-0e2a-4d54-8aeb-dfdee56c4b56", "value": 2932576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493278, "uuid": "08e64292-1a21-436a-8bf7-f7f2ce89ca33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493278, "uuid": "1c3b43b7-1ec7-4b9e-a647-67c89e48eef4", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40309.29955.16000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187cdaa7-7a97-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783492479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492479, "uuid": "21548920-e77b-4e2a-9249-2d76ac8672d3", "comment": "Malware payload (NetSupport)", "value": "ceb754b9acfe7b7bddbfdedb3982abe2", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "d-briskbeverage-com", "colour": "#857804", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lporfinance-xyz", "colour": "#C2EABC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492479, "uuid": "688525fb-20e3-4ea2-bbf1-3a98b239a2db", "comment": "Malware payload (NetSupport)", "value": "378389637bf1a818f395c034f1b207bccdc6306f35117e27d163727664df748b", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "d-briskbeverage-com", "colour": "#857804", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lporfinance-xyz", "colour": "#C2EABC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492479, "uuid": "61cb2e98-435f-4fab-8796-2b6f281348c5", "comment": "Malware payload (NetSupport)", "value": "d1fb0a1eb45d63663129c0f4551a54a33e36772c", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "d-briskbeverage-com", "colour": "#857804", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lporfinance-xyz", "colour": "#C2EABC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492479, "uuid": "52217d78-47bd-4a01-bb26-a5bde410a03a", "comment": "Malware payload (NetSupport)", "value": "71031ef76b50b196cf0f8d4f6ae7988e80cc49c5862453a310e242b7a63109e7ee4823b6117555e431d71a0c8191f8f2", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "d-briskbeverage-com", "colour": "#857804", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "lporfinance-xyz", "colour": "#C2EABC", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492479, "uuid": "a2cea4c8-f19a-4409-a155-202e0b155f4a", "value": "T155A2D130AB7CD256EB1C09F3B2DB798D8FEC105816804286E98CFD410A4FBDF215A179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492479, "uuid": "ec9ff1e9-e8fa-479f-8c8e-aeec8585faaa", "value": "384:1qXoDuqXts6YySzi/urdMvRLPpW4yJeBb316bq5Yp2jwRkrefnzJKSsRkeLS+5Nl:1qXKuqXS69Szi/urdMt5lBUeuhJrsRxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783492479, "uuid": "a6783d82-c06d-4f0f-8465-280e658f1593", "value": 22017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783492479, "uuid": "6cd46c7a-b4ac-4fe8-a579-3afd8900e854", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492479, "uuid": "90993b7f-5134-4579-9a6f-22cd8628c8c6", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddc7537-7a99-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783493535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493535, "uuid": "91bc8c46-1941-4fe2-a1f8-3a5209a19401", "comment": "Malware payload (Efimer)", "value": "32e2915b6395335a8c206fd26da50064", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493535, "uuid": "fba6609b-ff1d-4220-90a6-e1c0cd52c7a0", "comment": "Malware payload (Efimer)", "value": "38917247ac41fae313ded776f64b0380068e117ddc412a256bcd313279fd45d0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493535, "uuid": "ecf74a38-19ac-4c0e-aefc-f3c2ef5099ee", "comment": "Malware payload (Efimer)", "value": "f00b2f31c9b823d3711bc72bfa976b1895ca27ad", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493535, "uuid": "78024469-760a-4373-9732-7a354822b8e6", "comment": "Malware payload (Efimer)", "value": "72532666742873d6cba30a1ddef7cb9c1eefffc726243a896119063705fe09b51f86bf3e5c471b470ac0b9ca4d7cb819", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493535, "uuid": "02854752-8b81-4e97-b156-ce5818fb3952", "value": "T1D4E6330957F400FDD663503CA8F251B9D16874B52BF2C9DB276863AAAD172E0883F727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493535, "uuid": "74ccf0d4-8220-4473-827a-d3913756df0f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493535, "uuid": "70e97bf3-1e4d-4d44-a3ff-b44f4c91b2a3", "value": "393216:sR7IlIzW1p0isDutsXMCHWUjXxcuI3/PGTAI:ksOzQu9i6XMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493535, "uuid": "452d63c3-201f-4a1a-9e9e-9d7c14d847e8", "value": 14324162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493535, "uuid": "22d2f95e-7916-4bdd-bd8a-52eb0449b0ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493535, "uuid": "a733531a-a802-40fc-b0fe-dbfa871c2b88", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cffff4-7aa9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500316, "uuid": "7cf21926-38d7-4f8e-afa2-ff62c46c4c52", "comment": "Malware payload (Mirai)", "value": "49733f620812fd2d3dc2af384b2308e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500316, "uuid": "66d10b2f-e66c-4357-aa03-5701074d7f1f", "comment": "Malware payload (Mirai)", "value": "38e26e2e39b206a0ac983904cc58a8f3c967bef1c394acb423997944c9188226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500316, "uuid": "bfb6391f-e3d3-4c6d-967b-584764505fdc", "comment": "Malware payload (Mirai)", "value": "7e7a268cab595412da3d1b1f75f98dae34d11575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500316, "uuid": "41f3ec27-9f8c-4279-aee9-b6763e242bcd", "comment": "Malware payload (Mirai)", "value": "a76286061a878b945413516e2be076812ffa27d0d1214a5d5125f9ff2c26733ce3659daf9f69a66c1da2ec43ec2bc703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500316, "uuid": "6db5ce2f-a09c-4cde-a1d7-ada6c3da3738", "value": "T1F523F242158E34B0EAFC533C7E9E998FA3550AD4C6C5730B273927E8B7887196BB7600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500316, "uuid": "22400e19-192b-4de5-956b-617a33d6b268", "value": "768:sa4qwsMicR0iSKWLgPZEmWI/rMSUqJQb6PldfHny0HKAUGqX6j7bkUks3UozS:sqGR0/ELJUG0KXX5Mq7vzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500316, "uuid": "99f6dd4a-8a6b-4ee2-a299-4b3fb1c66aed", "value": 49272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500316, "uuid": "168f6343-3d64-4e03-b93d-403f90984e1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500316, "uuid": "a81b551f-d17b-497a-9d61-44dd56ddc86a", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7410ac6-7ae9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783527964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527964, "uuid": "2696a388-7af5-4de7-9457-e8d21cbacebe", "comment": "Malware payload", "value": "8a2f745da465f21cc6e19cc353d04143", "object_relation": "md5", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527964, "uuid": "af2d091b-697d-4225-9532-4c0117f5fa7c", "comment": "Malware payload", "value": "3905019787477bee5434351d44d8477ea3182c124b8cb43d142e0e02b1da4210", "object_relation": "sha256", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527964, "uuid": "7e8a6cf9-8a24-4e7f-b78a-cce215890ee5", "comment": "Malware payload", "value": "2b3a45916d1627799eee0a293964e56beac50264", "object_relation": "sha1", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527964, "uuid": "ab243f65-e79b-4647-81f8-07dceebf1cbf", "comment": "Malware payload", "value": "3c82952af6b02b7009c6d23c539933c9cf8bb77dd80757ef32d31186ac94f08f2b6bd9f2263978f6ae3bb0eafd29ea38", "object_relation": "sha3-384", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527964, "uuid": "e1f97fcd-b8d4-45cf-bc86-8d477d1e8e96", "value": "T1F1F4B64316EB0CE9DDD32B7C21DB633AA735FE708B6A8B6B8144C13168135D16D6EB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527964, "uuid": "c6e222c7-d3d0-4b66-b2f1-900c59ea87d8", "value": "b739855d3038833d4299df7d3546b7b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527964, "uuid": "5378abb1-17f9-4aa0-b407-e408366df6d2", "value": "12288:DkxHlJ7N9DeNrOE//L8GSH+6fjQFIYon99+jf4:wxHlJRhQrOEb8HYon99+jf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783527964, "uuid": "5a4de13a-b724-42bd-be17-e50707b3d67a", "value": 775519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783527964, "uuid": "e5421913-3b0d-4ee6-916c-d65ca5ab1f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527964, "uuid": "08407caf-50e5-432e-b72f-9c117a0fdfa4", "value": "3905019787477bee5434351d44d8477ea3182c124b8cb43d142e0e02b1da4210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f7ed37-7ab5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783505710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505710, "uuid": "f9ef6123-8475-46aa-a7c2-3be288780eeb", "comment": "Malware payload (njrat)", "value": "101607edb03318b46350b1076cb07ae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505710, "uuid": "a14fa4d3-796e-4a3f-af71-8fe68d5171e8", "comment": "Malware payload (njrat)", "value": "39133cfaa9175968006a5a6a2085ca53d6a43f582910fc32cbdcd7c9df23748b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505710, "uuid": "2d934582-59e8-4712-9db3-bc6cb8b8008d", "comment": "Malware payload (njrat)", "value": "c7a24b5f68922f301574dd1a0af317ff25e03405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505710, "uuid": "ff18b431-2759-47b4-88f9-d1267e476a78", "comment": "Malware payload (njrat)", "value": "e7a5923777540db08f77ae4eebf27cc7777a6a34f060a8fe12569335f48be3c8926457c0f169971098eb667c4d2b121b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505710, "uuid": "2656b21d-11ca-40a1-b068-b4839c6aeb9f", "value": "T17B432844BFEA5A01E2BD8F3469F645150634BA63E532EB1F48D668DB13327C58C80FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505710, "uuid": "b46260f1-4739-45a8-bca5-9ca5739d1803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505710, "uuid": "ed811ab5-ac52-4c2c-a719-bc885cd4332f", "value": "1536:T+r8DnjNxaVCae+D0wsNMDkXExI3pmcm:e8Dn68X+D0wsNMDkXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783505710, "uuid": "b577c7cb-dda5-46bd-aade-fdb2828c4def", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783505710, "uuid": "960c37fe-cc53-4f49-8632-4fb8596015b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505710, "uuid": "37570c7c-b3a5-48b7-a713-7c60e59afe9b", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cde1e2-7a7b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783480477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480477, "uuid": "642fb760-61c2-4864-87ea-8679d2c9f8e4", "comment": "Malware payload (RemcosRAT)", "value": "8090ffc96151a7b7cd83dd60d607f63c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480477, "uuid": "520862c6-a8bb-4d64-8752-6e9a4cb7ff29", "comment": "Malware payload (RemcosRAT)", "value": "3a2ce5b01dc23cbe768df69bc04fcb4e68ee58f1341a767f0cbfd3cd15440a59", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480477, "uuid": "125d35fd-3b97-41c5-b521-45c42140fdfe", "comment": "Malware payload (RemcosRAT)", "value": "b85775c4503835306751de188a9668795c459ac7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480477, "uuid": "e936674f-6250-48fe-a16a-fb6cb4dea18b", "comment": "Malware payload (RemcosRAT)", "value": "3bf5170376c35cf8d68f4e2dd4ecf27cd7d9deca6bace5e145f918ee760c6c226883b986a77e154b2712c8ef8ff48bbb", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480477, "uuid": "2572ef18-5317-4b36-828f-b5c116bc815d", "value": "T1FB433B11C9C44B3E5D0307FDBE405A64D0FDC6194B2580EDEA9D332E541A6ECEB7EAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480477, "uuid": "60629c51-28cc-41c6-a76a-b78d79cd50ee", "value": "768:99Zm72CFcvEgxWnClzOtGi1ea6pmATGtfiAO4+BKCnEwneX0k4142Cc14GPet6nR:3ZmSvNm+ztraW+tfihDKCn144lecnlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783480477, "uuid": "b27f083b-37dd-462d-a97a-abbf84700215", "value": 56137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783480477, "uuid": "74a64ef1-2f7a-42f4-b0ee-8cb6d0804b3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480477, "uuid": "3fe7d2bc-bbae-4305-ad2a-29849fc83159", "value": "Sprogvidenskabsmandens.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d92d0fd-7a71-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783476140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476140, "uuid": "fb2a7ce5-d22c-4a99-abfe-e8cac9671928", "comment": "Malware payload (Mirai)", "value": "7e531e28099ba33434b92f8698f7973d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476140, "uuid": "a94965c5-40b0-44d6-9fab-605c630ea00e", "comment": "Malware payload (Mirai)", "value": "3afefe3a97b3df9dffee6259161dd4e1c37a59f4726f68d9194921a631b1058b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476140, "uuid": "e9b87b53-482e-4e84-a6b5-aa5f5fd236a3", "comment": "Malware payload (Mirai)", "value": "09cb3b96b11395ea767e78165ebeada5d961f52b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476140, "uuid": "7c2e5b16-d6ab-4017-a83a-147f7f6d361a", "comment": "Malware payload (Mirai)", "value": "539ff807ac220eb3e94cca1183e3f818e7a28efdfbe8861e701b181c7b537fa0dc9ef01898bcc48821aaa9e0bc583cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476140, "uuid": "bdae1816-1cbb-4b9d-9c08-3ae42e7ff604", "value": "T194330741B8815A23C6E1137AF56E46CD3B3563E8E2DFB21B9D226F20379681F0C67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476140, "uuid": "77a01864-aaa2-4a9d-9ea4-f9231b9f6ed8", "value": "768:9QWX82FGIw2wzsVaOshfCYjIO9XNn/06zVhToWNLyT7i3F/YbP2pw:z82FGN2wzcjedS6Jhm30UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476140, "uuid": "588d0ace-c0bb-4982-9723-2ec3cc36e77b", "value": 50492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476140, "uuid": "40fa85ca-db7e-4d23-8716-457996c13f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476140, "uuid": "e3f6aa9d-fdef-45c9-a4f7-c4baadd9522d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d0ef64-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472877, "uuid": "6af83312-cc52-41d3-bc66-c517d06a1aff", "comment": "Malware payload (Mirai)", "value": "3656c2db63f828021bb59db5b8bc1b29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472877, "uuid": "2a0f609c-21fd-46f6-b3ed-69007eee360a", "comment": "Malware payload (Mirai)", "value": "3b5ba0aeaea18d4a15b3959b0ec7fd105d9da813121734d7b3f37929b9a8a9a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472877, "uuid": "2ee8e54c-8e27-449f-a8b0-7b4b0c3308cc", "comment": "Malware payload (Mirai)", "value": "111ee79a7cc9b76abb285e4e2af84f83cbd11e86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472877, "uuid": "432b977d-c5fd-4c7b-8851-8fb9bc1c4ba0", "comment": "Malware payload (Mirai)", "value": "f77f8a9e5bad49d639a946c50230f2066a2ea3738c98e7bd39923814985234605f56394e4d82b9e525607bff23db6299", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472877, "uuid": "bd795cd5-43ce-4894-ad5c-e1594f61d831", "value": "T1D492E0F8699D0643DA69C33F322B488FC0A58D68C38C92C95A6C8A5FD683045273D4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472877, "uuid": "1a8d209f-5d34-419d-a32a-b0f00406c537", "value": "384:MkgKiCWhs1ttJskx81N+EUw/g6cOGrYD8inlRX+v1Rs:WKiCWhgttJv8j/UucZw8inlRgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472877, "uuid": "10860019-f1db-4fda-ba47-c2b9344a6a15", "value": 20892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472877, "uuid": "8b3a0c63-8499-4516-88f6-c2240642735c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472877, "uuid": "13aaaad9-5f42-475d-8119-25cb0fcea19b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1865944b-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472722, "uuid": "0117c761-94d2-47f7-a4df-2f60e81c40b0", "comment": "Malware payload (Mirai)", "value": "0aa5a8445b91cc28b4fa1fbb223860ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472722, "uuid": "affc442c-5685-4fde-b737-626ba36c9ba9", "comment": "Malware payload (Mirai)", "value": "3be63fb0d1ddaef2a579aa419ce6762d50817620bcf0484e083b1c1952d9964e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472722, "uuid": "2f93f553-78c5-4cf4-97b2-168a0f6b77bd", "comment": "Malware payload (Mirai)", "value": "290f185925c2613bcc5a531ac76cb2bcfbf80899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472722, "uuid": "61478189-aed6-46f8-ad81-a1ac386648f6", "comment": "Malware payload (Mirai)", "value": "593cd0109406f151d9a3d25c588949a14919fa760ec1402da0d88468be62556a7b3e66afb4c93ec9bf8885673e58d9d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472722, "uuid": "1c469466-a8ed-48b5-9ca7-d94d1b22a396", "value": "T16DA2E068D5D10557C82ED43DE7FE8493C42AE845976F23C8B7EB9627854B819C730A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472722, "uuid": "719030d2-7c3c-4f4a-a678-72656885aa72", "value": "384:MtPFIlqax5D9tN4uS61t2qWVl/cMReX1zFGCOHFfx4+fkY669C+v1RKe:P5ptHKLV23l5GCAx4+cd6nKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472722, "uuid": "096f1d8d-95f7-4519-b954-7a74d966715c", "value": 21580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472722, "uuid": "81e5c111-9727-4660-9ca1-f15f67db5881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472722, "uuid": "707891ca-f64d-4366-a747-0746d2d1dca2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c462fd-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517112, "uuid": "474a3861-76c2-46e3-8c0f-ae495314fa9f", "comment": "Malware payload (ConnectWise)", "value": "37da3d949d76c4867c6e8812f2c38f94", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517112, "uuid": "cc6dd0a9-2958-4a34-be1b-9d47e5373d8f", "comment": "Malware payload (ConnectWise)", "value": "3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517112, "uuid": "d5a1e5c7-ad77-4e64-a4f7-4603156595cd", "comment": "Malware payload (ConnectWise)", "value": "f67016820b113661570f3cee5c070d84bc1b534d", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517112, "uuid": "544819ee-013b-4c66-bfdc-af0056277968", "comment": "Malware payload (ConnectWise)", "value": "433f1055105676d2029c6681b42e9ac20fc7676d609eb2eb12e221e441b2bfd9ec157bfa042ae3094ba680708f39972e", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517112, "uuid": "76ce1c7f-efb1-421c-b2be-49c2ee796164", "value": "T12DD622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517112, "uuid": "618526e5-6284-41ce-ab8d-6ad651fc15d9", "value": "196608:CHxcp9ym3nltDUJVOHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3LHO:QGplpFGpPGpjGpeGpOGpVGpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517112, "uuid": "6fb2e7ca-a394-4c7c-aafd-f38cc775e615", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517112, "uuid": "cb5d37cf-76d2-4de6-befc-5ba4a56c0ff2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517112, "uuid": "c8087cfa-031f-496e-827d-0b87d0dcfecc", "value": "Document-review.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5356c2-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493214, "uuid": "d2cbcf96-1310-47ce-b29c-d5b9188ebaa6", "comment": "Malware payload (ArkeiStealer)", "value": "29f241f7b2f12e1cd3fa87dea48cb3f8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493214, "uuid": "553e1e20-2401-421d-83b4-988879345367", "comment": "Malware payload (ArkeiStealer)", "value": "3d7fc882384188cee82010f0d000e37f758a626d2b394b52f87726d9b0333053", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493214, "uuid": "6616b2ff-a1a8-47a5-90cb-21eaca09a4c0", "comment": "Malware payload (ArkeiStealer)", "value": "e1de7070a8576af76f4c2c9921cde9a2b6850b6e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493214, "uuid": "6070baa4-4ec6-4bf0-9d5d-8114596b5abf", "comment": "Malware payload (ArkeiStealer)", "value": "ebe1b80ce6fe28657bff3d5c2d820620742459415007916999e86e00efc88e29d6f042c3477caef288268d94a515bfff", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493214, "uuid": "3a1d76c7-3967-4895-8085-e74101b04ebb", "value": "T190E59D0B6DE045E9C4AA923288F612967B75BC5D0F3223D72E90B3392F727E49D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493214, "uuid": "ff0e3a79-efeb-4606-8f67-b7e1a982a444", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493214, "uuid": "1e28138c-557e-4982-b3bc-9b92131ca996", "value": "49152:ixBDDDDtySZSpup1KU1sK+NtmjqWWVLyk1yt/gUmk:ixBrjHp1n12tmjqhVm4yt/vmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493214, "uuid": "6d8deb35-814c-4d17-a185-6db1cf3ef370", "value": 3020128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493214, "uuid": "c72075eb-4451-401f-a2ec-7f952d769710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493214, "uuid": "e4a5c3c8-c131-4ef6-aee9-432395e7e30a", "value": "SecuriteInfo.com.Win64.Evo-gen.25546151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757a67b0-7ad2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517975, "uuid": "d949d868-0e67-40f8-8ece-de3f1aeacf91", "comment": "Malware payload", "value": "5beada4350c24b1fb58c80504f76a580", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517975, "uuid": "2e11bd6d-9a32-4fad-b66a-0df60489cebf", "comment": "Malware payload", "value": "3da5005749afcafd5d55d1ccdeca715e85e47c934df3c0843a567bc4fe4af1a9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517975, "uuid": "8ec0e198-026d-4aab-8c8e-bfc8d24a5039", "comment": "Malware payload", "value": "493de525ab0f3b147875adb20d8d7abd897fb9b6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517975, "uuid": "fb87c411-d78e-4f15-8e64-ccca15680dcb", "comment": "Malware payload", "value": "1aeb3d4d14ddda1e24f0a80571a710666140ec2e88536d516dc3b774631e26eb3b80446ccea2f3f2140d0adcef03a209", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517975, "uuid": "2dfc2d66-d80e-4836-9fe4-2543bdd3274e", "value": "T198662381FF56D82ED9B784374E620731125ADC1EC68AA38795EC391C5C7B6D80FC9AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517975, "uuid": "e2d919c8-5012-44da-82ca-8aff7cce97d6", "value": "196608:M22JJIUtMd628moIS/Aa7vlfVnp/rjUTR:l2Jg62FCnvJpp/rjUTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517975, "uuid": "7a6c9ea0-a123-421d-a9d4-a8a35886e7a8", "value": 6581589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517975, "uuid": "df75ea1a-b98b-49bd-9949-f00834a7503c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517975, "uuid": "ebb7b55d-dc86-473f-bd80-2369be82de4d", "value": "\ud835\udfd1 \ud835\udc7b\ud835\udc96\ud835\udc8c.\ud835\udc7b\ud835\udfce\ud835\udc8c\ud835\udfcf\ud835\udfd6+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d98e0e-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493275, "uuid": "1e30c6f2-8d80-40bc-b6b9-664df62a46be", "comment": "Malware payload (Vidar)", "value": "759447355f8915e5d435656aa7d5c475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493275, "uuid": "27dd6729-c04c-4679-b46a-0795a0175772", "comment": "Malware payload (Vidar)", "value": "3e2e9ca2f1ad47e319d7960802297e97cde7624648ac8d0a04c522fa0a612f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493275, "uuid": "42fa5736-3c07-4484-8e7c-c2b4a6149c60", "comment": "Malware payload (Vidar)", "value": "10f376f6abbc7d28e4509c093eece0c84ef95d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493275, "uuid": "40466c6b-7480-4f6c-a7a2-9ca435256ee4", "comment": "Malware payload (Vidar)", "value": "8bb8c3d699427487e01e4cd6bcfb8bfcbfb64fdd1bebe4b4f0f3ea1ff84f9c53bb3029a6e76581b342edae87580c11e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493275, "uuid": "0f43f59c-3999-4fd2-9eef-7a3a1acc5d6f", "value": "T1D6E57B46BCA148E6C49E92328EB611927BB0BC090F3663DB2F50B7782F727D15D75B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493275, "uuid": "7299a11b-502b-4b1c-81f4-e7f40dbea1a9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493275, "uuid": "084a0934-b8ec-4180-adb3-851bad1398e0", "value": "49152:Jt5jd5WW50U37foAvntDV4ZMffGEMaJCHpLeHkOlKmP7gg:JtVZBmjIf9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493275, "uuid": "d3ebbfee-dce0-49ed-a479-5829b1ae3ed9", "value": 3087208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493275, "uuid": "a2c73ebb-37a8-4c24-839d-8e6975335777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493275, "uuid": "788d774e-5228-4ac4-9790-ee5e0d0e3421", "value": "SecuriteInfo.com.Win64.Evo-gen.44729212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb478866-7b0e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1783543889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543889, "uuid": "a3d63d3d-84b0-4e43-9f60-d5cc61e355ce", "comment": "Malware payload (Amadey)", "value": "5df78c9004f6d5d5c623ea9c463e1a3b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543889, "uuid": "3c432e09-4f13-4bf6-ae0e-c156b6e937cb", "comment": "Malware payload (Amadey)", "value": "3e9eb8d346a1c1d1fc6e8d575d35cf4766d5affcae97dc2d22ff9eb2e452b06b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543889, "uuid": "31edc41a-ad5f-4200-8a08-a8c70d79e36e", "comment": "Malware payload (Amadey)", "value": "73fe8ed8e4817c52c30ce3e49d53894038f3a5fa", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543889, "uuid": "69fe8eba-af5b-4f4a-a705-351ebb5258d5", "comment": "Malware payload (Amadey)", "value": "aaa841af266a22e4860a6a9934f76a51b54b0e101bb5d8989b6c5ac1e749ce6a5ca760847b95e58e6df6376661fe4359", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543889, "uuid": "e4af60b3-3510-4ef1-b327-2f7dbd5ce0e2", "value": "T17FB57C0B7CE049E9D4AA573289B752927B34BC594F3223C72E90B6782F727E09D75780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543889, "uuid": "617d4349-0278-4763-9808-974a6fcbf5d2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543889, "uuid": "dfdd2117-b261-4e44-bd8b-d085ea235a95", "value": "24576:H5rhHjkyORpZV61RT0ahIWlQSqV9tYDH1tvSel2XsJyDU06txtxzBele5rK2p3ly:H5rhjkfRnY1J0383K+JtyDUvzAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543889, "uuid": "a7dc4186-ee2e-409a-9cdd-9ce85c0a3ed9", "value": 2452336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543889, "uuid": "be789bea-0145-44f4-adba-c3a71f793f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543889, "uuid": "946dc82b-da9a-4e38-9d06-dbf491b1b1cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6178c9-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783517208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517208, "uuid": "f5341e35-893a-4dba-a64c-bca9a6d2ba0f", "comment": "Malware payload (njrat)", "value": "75f68d369e48fba33a4d53d45f32a6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517208, "uuid": "d5f810e5-1673-43e2-ae78-f7927fd322cf", "comment": "Malware payload (njrat)", "value": "3f434324ac709227290512410977bca99eb164fc86cae6f22cd4844eb9eb9130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517208, "uuid": "0e856735-e09a-4b10-ba07-2950ba8f3e42", "comment": "Malware payload (njrat)", "value": "e2ffa36e0a8661af0695eb11fe11ae21aca77367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517208, "uuid": "df2d0eca-7c4d-4184-b5d8-88b0a2ac87be", "comment": "Malware payload (njrat)", "value": "46c3f3172aa6184eb64c9f1574a215ab632e8fea432d0f5dc0c73ac0d64e9a4b28480085620ddc4c51582ed3f8d02a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517208, "uuid": "e8739ce3-faa2-4992-ae3c-1f78b820be67", "value": "T18006CF407BD4CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517208, "uuid": "325706a8-3750-4183-8dda-a4fcf544f60a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517208, "uuid": "2dd3910a-7fa7-46c5-bd8b-8ddd59ef7cd1", "value": "49152:Jmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sk:Sq0WgVUuHjkDGjYQeqpgmltk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517208, "uuid": "069580ea-5acc-4579-962e-264739f212f3", "value": 3695616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517208, "uuid": "94355e47-984f-478f-877b-bfd71cb56bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517208, "uuid": "ffec4a2e-6247-44bb-815f-496ee8db6aa1", "value": "raton.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d753f44-7ad6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783519734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519734, "uuid": "3e314313-1888-4e38-87f8-34e907132227", "comment": "Malware payload", "value": "7fd78d0ce44d3c025e8d1ecc05e93d74", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519734, "uuid": "c94ea56c-2243-47b8-a953-9564a8de5f7d", "comment": "Malware payload", "value": "3ff99773187346e6d7a2717142d579a626bd60b4faabacad1fc0c3f1bd8c0c05", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519734, "uuid": "1e8957ed-0258-460a-9a01-e538a71afc97", "comment": "Malware payload", "value": "33d62251f703aec7ec475d4fac420c614ce8456c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519734, "uuid": "d093eadd-be05-403e-92aa-69bdee98d159", "comment": "Malware payload", "value": "7334888ed66c9ab5b5fb004b93cc46a0ae6085c68efdc37c0802b9364857f1e410d8c40f400e420adb0be9139d65c715", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519734, "uuid": "c94ccd52-ebcf-431d-99dd-75fec291ac4c", "value": "T1BDA5E1670E6E8FACF5CB12B3D2044A1744AF75A48C1599DFA4B4FC4A66C3D89B00C3B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519734, "uuid": "e2c35388-1a84-4f14-a6c0-469a53c57549", "value": "24576:R9ZTpR6swMp7S9yfhpE8O5qyWfFdDHIcd28nE+kx1XEaBsc1GzujgIMs1WDPAzPZ:db7So50yrocAPzfyg+ucDPBYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783519734, "uuid": "6d8e42c5-403c-431a-ae14-21054b2931f1", "value": 2090720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783519734, "uuid": "f8a7f48a-f2b4-42e0-967f-cb266c04825a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519734, "uuid": "4e974928-e013-4c01-a089-a2209f75a232", "value": "Google-555549446e876cd97cf23c9984f014a9df80e377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d856dd-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537271, "uuid": "edbf407a-0565-45c8-9221-a6f6fc21c74f", "comment": "Malware payload (Mirai)", "value": "51b77cb22cf5f24e25b1cce5ba804e24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537271, "uuid": "7d0db133-33e5-4e5f-97e6-54521604fb21", "comment": "Malware payload (Mirai)", "value": "412cae438376a34129cd05ba25556a3579516b0fd6a956a42f48691ed3f26461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537271, "uuid": "98259a79-38e5-4620-8774-eb01d4f5e06b", "comment": "Malware payload (Mirai)", "value": "2ab7adde8fa9853097016fde99ffd252ce131138", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537271, "uuid": "1a9ef99a-bf58-4fcf-9b87-ff505a66521b", "comment": "Malware payload (Mirai)", "value": "22810a3574c1f5897f6f847ed56910e5d14785fb26ca7093e28fd55c0193c0ff987f943ad11b3c3e17f1c02c10d6ca0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537271, "uuid": "17ccfcc6-6acc-4683-9252-62c44be36ccf", "value": "T1E0333A45F747D6F0CC4205B0215EFF37AA3678A62364DD7BDBE0BA637CB26425816A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537271, "uuid": "05561c49-f29e-4748-b245-f3f68d1cfb43", "value": "768:4aLRfWzwpfsuf9MfAjs2XvefSTMVFzbp0k97gGGx63Qoh1fCk+LdFo31Tjs:BfWzWfsuf9MfAzUMxi1mc31U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537271, "uuid": "d30adb7a-fc23-4218-b9f1-3848e4b54bb8", "value": 54300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537271, "uuid": "636e9044-7992-48a9-afa5-5ee6fab78009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537271, "uuid": "e694ac6f-e7cf-42dd-a5d5-c4d6d0f4c2dd", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027f903a-7a8c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783487718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487718, "uuid": "c943bf31-de0d-41c5-9bf8-50d50b236978", "comment": "Malware payload (WannaCry)", "value": "c390cfb88feaad6b28df19c7fc99f9d6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487718, "uuid": "85b4db46-587a-4436-91b9-b1e98c655d7c", "comment": "Malware payload (WannaCry)", "value": "4209e30194b98b71170a6220dedf8928d52581895aa638ac47ef94664a06e5cb", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487718, "uuid": "a7cb795c-1ea8-44ef-a015-00eea2927db5", "comment": "Malware payload (WannaCry)", "value": "7794f3fd5a6f244a8991ee55b8449035a5d55b23", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487718, "uuid": "c1854b75-0e3e-4a19-9bc1-494e818a36a0", "comment": "Malware payload (WannaCry)", "value": "bf286d889a7b89116fb1749189a418c45003cbac986f771f642c463ec26e85f26d367116830196c4ab93c4421add9f53", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487718, "uuid": "b146ce95-35fb-4dc6-b632-c0d50ade050b", "value": "T188362226E1D89A78E19016B5A3268B14E27A7C0CD5679B0F33520F1B0F7374EBE59B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487718, "uuid": "52377008-3be3-4c0c-b8c2-1efec81025c4", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487718, "uuid": "a985d51a-b145-43ea-bfa6-7b279e8c791e", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdXC/AMEcaEau3R8yAH1plAH:DXDqPoBhz1aRxcSUA593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783487718, "uuid": "a215847d-8e6a-4a2c-a905-061878fdc0a4", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783487718, "uuid": "b4282e0d-078a-4ff0-ad23-30e06659751f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487718, "uuid": "3e1f3105-508d-4fbf-9eb2-ea142cbfb47b", "value": "4209e30194b98b71170a6220dedf8928d52581895aa638ac47ef94664a06e5cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0547bc0a-7b04-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783539262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539262, "uuid": "811b2a92-67be-4fea-943d-2efd47276725", "comment": "Malware payload (Mirai)", "value": "5e1758c5d1aeea3e7947d2b2017e6995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539262, "uuid": "4614362b-69f8-4365-8328-951edf37d484", "comment": "Malware payload (Mirai)", "value": "4293efa38efcaec7f68fb624a5a3f18a2dbcc2cb60da7233fc4f49ca4df751c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539262, "uuid": "93ed51ee-1e52-4512-ac99-4d0697a4237f", "comment": "Malware payload (Mirai)", "value": "fbf12da1f9c50eb93c7e91c2b63125516a3fb980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539262, "uuid": "338d732b-9647-44aa-90d5-abaf5bdb38b0", "comment": "Malware payload (Mirai)", "value": "8e91c8b40993130ce80e9daf569992e07262889027a4a295677b6e63e702aaa5602c4ba3c73262dcfd842da00ad9bd21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539262, "uuid": "79c5018f-ec54-451b-90d3-5d516d822b25", "value": "T18433F2A86E8C44E6E1CAE2B7D9F3CFB01F210772F043ED91B98859C68A859947DC35C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539262, "uuid": "621b77c8-3044-408b-90ba-74aff99772a0", "value": "768:/sq/h788rVWM1m+UcwUf8FkHBkcvATyba/05VSI3Hk590Wt9dcjc2dxkAS7ByQJw:Eq5QM1ttR8Ttybz5rI97POAUZS7BVJuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783539262, "uuid": "81133a6f-0491-4700-bd2b-63ac99e87d5a", "value": 50508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783539262, "uuid": "cc734c40-acb8-4c92-b1cc-576cf6a919a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539262, "uuid": "f1f9c509-4f9d-449b-814b-41439d21ed3d", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3868c010-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472776, "uuid": "ede6be53-3069-484f-a34c-6855a76c3789", "comment": "Malware payload (Mirai)", "value": "bec0822fe96acacec2e38251f8b75afb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472776, "uuid": "a3b2ec05-b795-44ac-91ba-2ee600f27d10", "comment": "Malware payload (Mirai)", "value": "42a1f2fa4c787a112d65ce7382d47c56e4747127ebc6dbef96e27cc2ff4e88f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472776, "uuid": "a18b4f7a-ad81-467f-8cf8-72a9753fbe85", "comment": "Malware payload (Mirai)", "value": "f1c285c7f4d8d4e41b6eb2fa3d1a47bad51d3a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472776, "uuid": "b7f12cb0-b04f-43c7-a173-2239b591c200", "comment": "Malware payload (Mirai)", "value": "a53875ac36e7e27f4a9b2c0d082dcaade2e1c5a9c01454cb537a3408c1935753a88310f353a13b568fba79dbcbc83bca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472776, "uuid": "25f7d49c-15c6-4e7c-8a8d-77a5aca5a177", "value": "T112D32946FC824A22C5D722BEF92D218E331317B8E3DE32129E245F6137C659B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472776, "uuid": "b3d49fa3-96f7-49e4-9ccb-a3de00c1db48", "value": "3072:whnw1dzzJI8WseDYgd7IafuDKxyCqiR/oHvM:+nAJI8F7gdMaEtCqUoHvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472776, "uuid": "80803290-f5d5-4598-8fa3-0a29be739193", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472776, "uuid": "5df7a4e1-2fd5-42a2-98be-c077b74454f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472776, "uuid": "714f4344-572e-455a-90c3-4dfc719be32f", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913f99fd-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517163, "uuid": "35e15184-5d5a-44c3-8379-f5d1fba07fbb", "comment": "Malware payload (ConnectWise)", "value": "57d20ed65870aa249ca374142d763d13", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517163, "uuid": "d62b3180-1fb0-43ef-9dae-11950a03e99f", "comment": "Malware payload (ConnectWise)", "value": "433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517163, "uuid": "5b608eed-df71-401c-8432-7417685c7361", "comment": "Malware payload (ConnectWise)", "value": "897a9a38ebc67beb0775184520c8ce3b0bec04e5", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517163, "uuid": "12f0900e-3dad-4743-8abd-79d24bcd86c4", "comment": "Malware payload (ConnectWise)", "value": "e40ea862ef7532d0e32ecf7732a612f4f23600f1630103279e1b0a6d8ff046665105ae112d0c163b8bba1daccdbac2d5", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517163, "uuid": "849cccca-f404-4ef9-8480-ff25affe56c3", "value": "T12CE16501A7E94616F0F65B386EB34356AB75BC879F32CF0E1654011E6D327848D62F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517163, "uuid": "97f8c34b-9ec2-4748-b070-b844d812a810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517163, "uuid": "c394d7ec-1261-40aa-88b7-fc5b893bd17c", "value": "96:jLOsyiThgx4/KmNnat79fUQ23h3uZ8979UL6kw3JBTPFQeKp3zNt:j1XThgx4/xNnal9cBuZ8979U6iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517163, "uuid": "71fb3501-3756-4321-b4eb-5cfcc48ffc58", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517163, "uuid": "75f9ca26-795c-4101-bd7e-2c89d770dd96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517163, "uuid": "40c14978-5728-4770-b947-3c07f6cf452e", "value": "lirMkvpf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15d703b-7ad3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783518478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518478, "uuid": "199ae771-885d-4acd-aea0-f98d91cd2c7c", "comment": "Malware payload (Mirai)", "value": "a6de225b1a0c725435bc8f4a92ab83f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518478, "uuid": "d7e7de2d-6da1-4f3d-b5b1-5e50825ef147", "comment": "Malware payload (Mirai)", "value": "45388ec7a709b95a10794f388053118a81c35ad30b6e336716dd32b0568a10af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518478, "uuid": "5f6a91e0-45a6-4586-8537-18fd8538be8a", "comment": "Malware payload (Mirai)", "value": "ef5e68d8a034aa5354b9cb6144d56e2561a6a059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518478, "uuid": "757f7bdc-6ec7-47c9-86d5-9cf5bc7167f3", "comment": "Malware payload (Mirai)", "value": "567fff4d6c2459a8cffc3aad660775f2ae47dc18fae0e5c1df672527f019c8961d9a1daf001a678bced9ac537a104f44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518478, "uuid": "6264728e-7ba4-4a6c-bb77-5104fe1ae5e3", "value": "T1E823F16158D6860EF8654333C4DF3B5FAD40E26A5896DDFF53887036A052F293B19B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518478, "uuid": "e47ff222-ccb5-4b0c-8f2a-a94bb432c8fd", "value": "1536:F4i2BIFmypB9Av2grbeCvyAxm+WOnouy8HyO:F1Lmyp02nIhqOout1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783518478, "uuid": "cac1919a-f63b-41cd-946e-707e3e80f882", "value": 49832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783518478, "uuid": "616f49f5-9671-4709-bb69-30af831d18e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518478, "uuid": "35204883-37c1-4fd2-991d-41a33f7b4307", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a02dab-7b06-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783540281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540281, "uuid": "249060f1-32e4-47ca-827b-c1dd1a5560ad", "comment": "Malware payload (Mirai)", "value": "34be35deef74f4c0dfb23d25bbb7c594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540281, "uuid": "82f9dec8-d650-4b93-8ca4-8f15fcad1645", "comment": "Malware payload (Mirai)", "value": "4538989f272edff0f588a5980d1d5eff09ae8957ebd48cded280a390a9cfa752", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540281, "uuid": "529e6c00-4104-4845-bf35-b95dc3991cd1", "comment": "Malware payload (Mirai)", "value": "b5af1581b0b25f34447fe092ca3f332d2f060570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540281, "uuid": "a72a8d5c-5e21-4b16-bf50-5d5a1c76f999", "comment": "Malware payload (Mirai)", "value": "bf51aa63fbc60172b9a02a21d4d9e7b5dc63b7e11d09876b47ae5e69761e328c75859ebb776511a63c7a66d2449f56a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540281, "uuid": "23c9adb3-60d5-48c0-ad84-e5a1fd423408", "value": "T147832885BC919A17C6C6137BFA4E42CD37266398E2EE3207CE259F2137CB52B0D6B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540281, "uuid": "629d9918-8200-41f2-b9a0-73e88269b831", "value": "1536:ox2Gfa4tpq0D4MdubgPOEykyIyetOiHjk2MAN8ve:oUJsAMd83etc1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783540281, "uuid": "f5cb503b-a45f-4208-b0a8-0cc31a402d8b", "value": 88672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783540281, "uuid": "dd5c8060-2c05-4b75-a5ca-ed09fdb0ccc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540281, "uuid": "0c733491-f9f9-439b-a97a-01676f224b38", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e496e78a-7ab7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783506565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506565, "uuid": "f8c1a850-0ff9-4fe3-bb58-49ff81675130", "comment": "Malware payload (QuasarRAT)", "value": "e9b13e6c80d824e6d5e7da8a462bdbdd", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506565, "uuid": "415c88c8-64b1-4c52-aeba-184f9e47c1f7", "comment": "Malware payload (QuasarRAT)", "value": "453e8395ae2bf5ce4de758228eb9dfb60e8da309f59a7cea600de3b8d3e258ea", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506565, "uuid": "870d4248-a7c5-491c-9765-1a3fd29726c4", "comment": "Malware payload (QuasarRAT)", "value": "a70ba7ea8ee028f208bb32bce0ff34655a0d5882", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506565, "uuid": "86020e21-7c42-41d4-bb36-31932e150f10", "comment": "Malware payload (QuasarRAT)", "value": "52534d8098bdadda824726cb4d4a21239a864a4cf0250588ccebe8f9f4e5d02a9cd24d8fff2a5c83a39ff7318c94972e", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506565, "uuid": "639e82a0-3747-4baf-bd9e-ae5e3a426d90", "value": "T1F6551224BFD50C5F6AFB0A28B0E6C643FB64C1D3022854CDE6DF018B535FC5966BA52A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506565, "uuid": "b5177680-b418-40a5-8cee-488873d959bd", "value": "24576:C+U9RyR1nfn5s1FA0b3lIf/RTM7Nn36VOx+PZavKRrMH+wLtYStldJGmX:G/YtW5afpTM7KS0gv3ewLthldJGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506565, "uuid": "e8489e00-7017-4914-9f96-e8818f8438a8", "value": 1380824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506565, "uuid": "1a86a3bb-6b58-4b15-8b26-b799bcb692c9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506565, "uuid": "2d4b9dec-36ef-4d37-b52e-5fdebcb95e88", "value": "YHqyWeYH.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0fb343-7aaa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500754, "uuid": "ccf33025-ecbd-4de2-ba59-70a7742a999f", "comment": "Malware payload (Mirai)", "value": "2f7d705cbdf30ce09b15a700c11adcc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500754, "uuid": "68ddf778-81b2-42dc-9c47-77f1e676c6ff", "comment": "Malware payload (Mirai)", "value": "45d9d7b300ec1181ba48a102c1d486f18c1f9aa15f501e9542709f48175c53d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500754, "uuid": "9a3fd321-ef98-478d-92b6-30ee90f599e2", "comment": "Malware payload (Mirai)", "value": "9b4600119f0ca1d7f7c657286354116943a0d8bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500754, "uuid": "0fb3d790-e0ae-4c8d-8119-c4ffcfbd3da9", "comment": "Malware payload (Mirai)", "value": "eff5a7f2ee2b318daa34e6a0ef135b4f6c31ee0398d50ae769fab188c625b6d404fe3b1ea78aeb924216220db3dc70ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500754, "uuid": "c77e818c-deb6-416c-8591-6932ba537b16", "value": "T14223F151B89B8B94F5DF53B9323EBE5448A8615EC8D44213B2E873396C2AD3E311F247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500754, "uuid": "4b23c9d8-3bf0-4a96-a975-b4b9f7ffb010", "value": "768:49PozNGg5FpbBqyp6R+/ZQ1VrKkyHW6bFHpt6EKGAYKqy2665kKu/vT5nbcuyD7Y:49ARGgpYyjQ1V0BbFPKGKziIvFnouy8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500754, "uuid": "8638e850-ae0e-42ea-b3b4-18c64723aa62", "value": 46984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500754, "uuid": "79b67682-ffec-4d39-a155-401cea3fbf65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500754, "uuid": "51498ef8-577d-4b4d-9fc9-7cc258919f1c", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4989b5b7-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474093, "uuid": "5494a038-69c5-46e9-8cad-a940e6845d30", "comment": "Malware payload (Mirai)", "value": "f9dbf497d03d001a1e2ff0dafb4e20dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474093, "uuid": "10ec2919-bb2c-4d79-886a-b55960ec1107", "comment": "Malware payload (Mirai)", "value": "477948f3000fcffc496816eb3688faf63f9969d15211ce647f0bba17c25867b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474093, "uuid": "d2ec6e80-9b34-4838-a47d-60254ec1b069", "comment": "Malware payload (Mirai)", "value": "a357cbadc7a35f3c6c9509be060b3ecdd0b1b9c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474093, "uuid": "aadbee83-a677-4c91-80f6-38aed6b67857", "comment": "Malware payload (Mirai)", "value": "379ad6d4bae2c46b56f9757604866de22ee9e6be87e3ba1a136deb48ac73949341b93f95c73cd7666f9435f1c26ca04b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474093, "uuid": "bcffa381-aed5-40c7-b410-642ec50606d7", "value": "T163B2D1D84E85009BEDA145BA1BF407607FB91BB89543DE0AE50AF217DFCA1E07553AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474093, "uuid": "50e778aa-c778-447e-a6b2-46a21849c85c", "value": "384:r6jz4ptun3MEHBRp0HI7GOLNPKVrzbm06bIzHV8mQfRqG5ilcjLcXnQJgGlzDpHq:2f4p6Ma/RJ5x06shFGJgGlzDpbuR1JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474093, "uuid": "033cae0a-3f72-42c7-b1a5-a9e94f897b64", "value": 23604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474093, "uuid": "e8eff302-9e34-4b90-9127-eb01ae75287c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474093, "uuid": "0cfe9cd3-6c6a-404d-9990-a032f1867de4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149f286b-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475293, "uuid": "09f3bd5c-9c93-4986-a2d1-6f4bd9225c6e", "comment": "Malware payload (Mirai)", "value": "872047b160183098f6cb683fbd602505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475293, "uuid": "0e4041c9-65ef-4a3a-8c5e-dacc7d5a8d53", "comment": "Malware payload (Mirai)", "value": "490ea48be8568beaaa07f1f269b482fa3cf0515232720de76b9fbd6614465d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475293, "uuid": "5a1649e0-38b6-4b7b-8a1d-341518dd6076", "comment": "Malware payload (Mirai)", "value": "59909de7e6bc5344cfd97836ffdb92f311fbc730", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475293, "uuid": "b075d72e-acfa-4c2b-9e0d-769f67606f2d", "comment": "Malware payload (Mirai)", "value": "8078281c6a8e81133e2d7cbdcf948db46ba1ca54f478c9eabae6a1e2d1577dc99c89fe917eb8afc9a86385312bfe1da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475293, "uuid": "bed94950-dadd-465a-bd2c-91f0c6f6e243", "value": "T166E3BE97F6472092C96302F407CB6BCD2E6362825F9BD9E7AD2F753B19360DB1402792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475293, "uuid": "2210cda8-7114-4931-8e5c-119119720e70", "value": "3072:jfpcpGAcRtyMNJYPpQZE9wXyQbaYOdHgu7qq:jgGF7CIXfq7qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475293, "uuid": "b7104536-aea6-4913-aa76-52fd7d66f868", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475293, "uuid": "228c5e08-d3d3-4c03-9c21-f06aab7b3968", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475293, "uuid": "6f1ada52-298c-47e4-8d28-f0d9214137db", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5cf427-7af2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783531679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531679, "uuid": "5035d587-8b4f-4975-8688-273a0a4d456c", "comment": "Malware payload (ArkeiStealer)", "value": "b91e2a1522b70f58b3eca4c2724e5ab8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531679, "uuid": "e82f60c4-c3e1-421a-a7e7-1c51dbdbef1a", "comment": "Malware payload (ArkeiStealer)", "value": "4a120a71fdf8842724257c68c8e7f075e333297e50db2d5682b1b924ff4c1a01", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531679, "uuid": "0d05d604-4ff1-411e-8436-2322f9bd9198", "comment": "Malware payload (ArkeiStealer)", "value": "4b506b417ac5bb6a04ac371ea31011c12e4c8e56", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531679, "uuid": "6e2d8699-4542-468f-a4ec-025e301b722d", "comment": "Malware payload (ArkeiStealer)", "value": "3d3858f4a71064a528453f1f53f27a54e665b1eec2e687eb6dc7997cca0fe8ed7ada8677685af55900ca64a1ae83af4a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531679, "uuid": "b8946f65-57d5-450b-8cb7-da8fabd5a75e", "value": "T1D6D59D0B6CE145E9D89A63368DB646927B30BC094F3227D32F90B6782F32BD19C75794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531679, "uuid": "85ccbf3d-3c3b-4587-bf4c-c7c9d7255b17", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531679, "uuid": "ec2859fe-84df-4b49-85f0-c04a5c455091", "value": "49152:/XA/cMbzDMUFp/DZGC6YphiU/iXDbFGnOzFZ:/X16/IsCfFGnOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783531679, "uuid": "dabbdf6b-e2c4-4951-82a3-548bd9610298", "value": 2950520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783531679, "uuid": "b8532524-1052-400f-91ea-dedf00235edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531679, "uuid": "0b4c70c8-ffef-430b-90ce-8f782a5f7f40", "value": "SecuriteInfo.com.Win64.Evo-gen.27224398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8060dfa5-7af8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783534314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534314, "uuid": "73e135ec-a877-452c-8215-2f4f4ce6a0e1", "comment": "Malware payload", "value": "142695c2b211f515a7698122a6bc6abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534314, "uuid": "5f3c0c50-af22-469c-8b26-8f4fbccc2b93", "comment": "Malware payload", "value": "4a72842ff25b47bc912714046a833ace69d6cb68f8f2be8d65a6421c4a9cc5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534314, "uuid": "7176d13a-c918-4ade-8202-7ad59518e04c", "comment": "Malware payload", "value": "2e38eea1c132ca7c39db916b760326f62812bc3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534314, "uuid": "0e3849b5-f99e-4d00-9e28-7c208dee3d7b", "comment": "Malware payload", "value": "306b034bdb13429cdbbac6f1d58973a57abe11fb77f846680b562189d49727c40e5d0c5364c53ab9a344afd175acd28c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534314, "uuid": "380e5077-d18f-4900-a72a-9adcc53ea791", "value": "T12B77336C6A921588F0D7543BFDB3983F924339512B30458F9FE82E9639D31E0AD68763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534314, "uuid": "7bd864c9-1a28-4288-aaba-98892d0e1838", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534314, "uuid": "73bd0ded-9f53-4cf5-a9c5-78036950ac71", "value": "786432:ZPas/xJMheCMyXiFvW8wL5W+NjlZcKAj7dzvVgax5q2j3W4cqwyi1sL:ZPas/XMheC9yFvW3NNB1o7YEq27WfLDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783534314, "uuid": "b631a42f-ab8d-4eab-8e9f-d02bfc803207", "value": 32988463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783534314, "uuid": "051ad5ac-cb1c-40ba-9377-dd33612a4401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534314, "uuid": "b1af3f65-0482-446c-888c-dec43f556d22", "value": "4a72842ff25b47bc912714046a833ace69d6cb68f8f2be8d65a6421c4a9cc5a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7833b99b-7aca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783514544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514544, "uuid": "0f3b04f6-f744-411c-925b-e33300a4eb49", "comment": "Malware payload (AgentTesla)", "value": "3768f531412df785abcdfb25b0615b19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514544, "uuid": "d98e0027-d6ed-41d8-997e-e71b684dc275", "comment": "Malware payload (AgentTesla)", "value": "4b42736ecde39daded49aeed39e954dbda6536359f9b4c6713944d0658248c71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514544, "uuid": "94963f94-59a3-4381-9ee1-366f17aa374b", "comment": "Malware payload (AgentTesla)", "value": "e1afe263bedba68919565d60a7cadcabb78f68f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514544, "uuid": "975c8253-074d-48af-8342-a664388c9b2d", "comment": "Malware payload (AgentTesla)", "value": "4231cdccff0e91590eb7348310924548ee1165bb653566913846e1181ed982f5ae90b7f7d411c75ee9734b2cb8aca0c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514544, "uuid": "3b815c40-86b7-4843-b4eb-7bc0d9f5b39e", "value": "T1AA252391BFA63E7E52B4822AF017CD9D49F1169534648FBBA4D90ED7100E9C2B7CB930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514544, "uuid": "3faf2849-deb7-4b11-b254-1ebc7eb1527b", "value": "24576:vPRAHl1lWA6h6yMlP2U8Y/2bXIUWr78jTw:2XcbiV+xWrS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514544, "uuid": "b79f3a51-004d-45ff-9edf-c044747e4a00", "value": 1016530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514544, "uuid": "3cce59ab-c5e3-41de-9f5f-75152f9243d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514544, "uuid": "13299add-2fbe-4fd4-8616-aae76d5828f1", "value": "stubz.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b551c8a-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474096, "uuid": "e2890abd-fef1-4f25-a0ce-33612f994b25", "comment": "Malware payload (Mirai)", "value": "2fa5387460298364bb31a32a71cb8820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474096, "uuid": "d5591ab0-6703-4e36-8a61-909b00c509c0", "comment": "Malware payload (Mirai)", "value": "4b86b1ccd44841f0639b8946d9fae2f82e8b759e22cb412a0f6e3ec326737052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474096, "uuid": "ce29d0de-6afa-4ed1-91bc-dfe6cf5dfbf3", "comment": "Malware payload (Mirai)", "value": "547b3fb183152ad2b8ed813fe59444a236968fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474096, "uuid": "581d9554-e9ca-4cec-ab7a-c955484cc008", "comment": "Malware payload (Mirai)", "value": "23d11ee8e36f1daf6a3b8b0d238aa322276d42ee9e1b4eda6ff59f6762f02a02797248ece6874ca45fb394a8482dd9ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474096, "uuid": "538a9a1b-742f-45a0-89d2-b5ced4c673d7", "value": "T14933F1EBEA1B38C48ABC497D96DD6B755B5220F47137A35CC7952C4C530ABB83A9E00C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474096, "uuid": "5f662f74-1280-4526-ad68-1abeeb45db06", "value": "768:c4MsSKFz9Q3V71gRjZ6G7wxPiix0RGuoFhrzwexQa0fvIY0JjKE67PMHN15CiPoR:/FFOh157E81u+Wex5MX0J+E6Axx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474096, "uuid": "9b05c3b7-cb84-446f-a4c7-f820c03d63ed", "value": 52796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474096, "uuid": "75c7068c-0e00-4efd-b2d2-7d2e8ae422e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474096, "uuid": "6e08f034-6884-4993-b7ad-fa2dfc6c464a", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c87739-7b01-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538025, "uuid": "c40387cd-432f-4f6f-9f0c-ee5d21321d34", "comment": "Malware payload (Mirai)", "value": "0117d7e007483cbc84a0696d6286bc07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538025, "uuid": "594fe418-b4d1-42de-a201-cfefbbf09e83", "comment": "Malware payload (Mirai)", "value": "4d032532f4bfee05049fd3fba048a8da88936e4259be0fe9d8457ae05a68ecfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538025, "uuid": "f9cdb639-0612-4002-ad73-f65fc3cc5b47", "comment": "Malware payload (Mirai)", "value": "a0d5fbd5cb42930ad4854a66ffd52d02b980e89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538025, "uuid": "fff48aaf-3d87-4ea2-b302-165d5bdc2d96", "comment": "Malware payload (Mirai)", "value": "59474f2dcec5b9b3b4eeebfa630308f2c67de9fa55615e961382e8bb957c9467d740962908ebc272b68455bbf19400aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538025, "uuid": "3fc9f45b-5e26-447f-9750-4318e37dbf66", "value": "T108A2D05163B6AF9EC853EA379072B8B205DD7DA4939E43913310D1EF127F2922821DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538025, "uuid": "277df27d-e37b-4e1b-b31d-2253feee248f", "value": "384:MzFp6qzlS9A0OGT7PJ6Hjdw4euH+fwi+HVxDpbHPtKEqr2Qt9cYjR+tdJIoSyb:eOqziYGTd6Hjd6LfGHVxNPwEqjt9cntF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538025, "uuid": "43db7e36-f840-4d7d-b1ac-4d92b544afd6", "value": 21936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538025, "uuid": "57981c4e-bf2d-40ca-a723-b33791d75f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538025, "uuid": "3f98b73a-e013-4f4f-a5fb-abab9db4fa57", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02025c9-7a8d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783488465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783488465, "uuid": "fa145cb1-689e-4e1c-ab25-dfdc39739bf9", "comment": "Malware payload (MassLogger)", "value": "3a13e599e02c90ef764d84e62f7c0934", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783488465, "uuid": "f00f3d1c-460f-49ec-825b-f292b74e3b93", "comment": "Malware payload (MassLogger)", "value": "4da39914f4852295ca15245203d00e4351642f9b18fa10e1575f6167e26cfe84", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783488465, "uuid": "42f7a60f-0d07-4a4c-b0ff-359798c2898c", "comment": "Malware payload (MassLogger)", "value": "e1a02e63ff75b99387209913d5b8bdb3243b5496", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783488465, "uuid": "c8755b93-b50c-402d-bda0-ebc26f2f13f7", "comment": "Malware payload (MassLogger)", "value": "9da8722ab2af1b2ef5bd7062f1a84167c707cba3f8d53c98e7dfc0ce0ac3c2573293db11f540328f34ff9be49a93f68b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783488465, "uuid": "60aafd2c-c170-41ae-a55a-561fa7aca6cc", "value": "T1E6F4F11519C07EB5CBAAA23A64BF711AF3B55E865119D048FF23FC45FEEA704812B384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783488465, "uuid": "26e7e707-3c73-4ef7-b868-aa7bc7a39abf", "value": "12288:bJdm6qQcxjRTLCcX2vidXlPskImXkWePfHa2x7OZGIp+7dMJ:vkQcmL6znI+SnJx7OZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783488465, "uuid": "5f436660-f364-48b8-b4b8-4f236f3ed4aa", "value": 735444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783488465, "uuid": "11abcad4-027f-4454-af6a-2a1bc16e73f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783488465, "uuid": "096a243a-8696-49cf-8e42-423d9d91811f", "value": "offlinejs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee7a576-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473941, "uuid": "1145aba8-5ff1-4458-804f-906f938248b0", "comment": "Malware payload (Mirai)", "value": "7421638659b5dcfebf10a8a2b6ae7c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473941, "uuid": "f0ed5e7f-95db-4d0c-b48c-eb911f240b89", "comment": "Malware payload (Mirai)", "value": "4dc47959cb6437a9de370647fcc8bc63c2882def695e008536b539152acd103c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473941, "uuid": "c31c28c7-c48e-4bca-b371-aa0cf522198c", "comment": "Malware payload (Mirai)", "value": "4435c18465ec0dc7fbf3ef41aa6bc038473bc71b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473941, "uuid": "40c8b008-aedd-4eb3-ae72-2b767fa0218a", "comment": "Malware payload (Mirai)", "value": "3d5af6e027bf1dd39073bdf752421b2cd4f01cb8419aae81efec4c06f9419d5f46d9e9af0d45f17511abaf4f57bc73e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473941, "uuid": "22dbc7c6-0de3-4141-9bcb-17d884a5bae5", "value": "T1EB84235BB102F80AD84D58F238A3C6293D887F1E67632E08D175E9BC3B495FF5491A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473941, "uuid": "30556957-a27c-441e-9f54-04539ea7d337", "value": "6144:F7nSu4LTS7cnSvChIZtwFcfFyni9GTfnrdeXNBb7WpvGeDHG6ydmljryvDiHa4O:NSugS6LF74GXdGNleVmvmlSvDiHa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473941, "uuid": "a543f547-86b3-4575-a6e0-dc4622c15cfc", "value": 403876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473941, "uuid": "340dc451-de22-48d6-94ba-6ddf7f44599a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473941, "uuid": "7cc4a293-3e4c-4b63-9220-6ec719418edb", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10317e01-7aca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783514369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514369, "uuid": "5041f2de-0e16-4dfc-994c-a01deb78c6b0", "comment": "Malware payload (AgentTesla)", "value": "b58faa09f152be49265f882080ca8748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514369, "uuid": "f142be1a-9c7c-41ee-ad9f-0c3bc071990f", "comment": "Malware payload (AgentTesla)", "value": "4dc4c686951c5de770e1394883420d3a0394d6724e49fdc07a389ec0dd6928fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514369, "uuid": "036a5a02-058f-4cae-9e9a-671cb20cb7aa", "comment": "Malware payload (AgentTesla)", "value": "4f0deeee3e7e9e8b7148b5d8c808fcd3360736d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514369, "uuid": "79930af1-67a6-4a90-9b0d-bcf302025d02", "comment": "Malware payload (AgentTesla)", "value": "b091c733e1602cf537a391a39e5832b8b74b1ccd6410099f54fd81c3afe9cb8020c94df1c9e9b9b5fe07f299a5fc5640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514369, "uuid": "e38133f2-5580-4226-a976-c52d474ac771", "value": "T12A4384C93EC1B4609A42E43B3E3BB6E6F13D8C85A35D5088F7267858F8E8718D675718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514369, "uuid": "98e51ff1-c41a-4d5f-aa89-24e2359b097a", "value": "768:jwgGAFgTMq9merBlIyCMUN71ub1B9fZ1TGlKRcGqkWdrv60rqbxuxBI/BG:Ug8TMbseLNB0zfbClK5WdLprqUxe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514369, "uuid": "b43218a2-3370-4402-944c-fa3414a01f37", "value": 56218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514369, "uuid": "24efd7fc-9fdb-4893-a67e-556cd326e02f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514369, "uuid": "a2edbf7c-641a-425c-bd6a-0a73fbf3103d", "value": "JULY PO CV. SEMERANG INDAH.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd9108c-7a97-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783492620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492620, "uuid": "14f7c3ca-aca4-497b-807f-5d7d1c994735", "comment": "Malware payload (Mirai)", "value": "053e8652fc680d28692fe3261d9651b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492620, "uuid": "4f29f2b4-3243-43e7-9158-4de804a4c800", "comment": "Malware payload (Mirai)", "value": "4e844539d95862ea53a47d0ed5d1cf0809d83a79c24f59afc5b6186054edf54b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492620, "uuid": "74e2d2ea-c58d-4717-9dac-8d082e8b785f", "comment": "Malware payload (Mirai)", "value": "7ad79427adde9606789a48b694481edbcdafd8c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492620, "uuid": "031528aa-8ff5-4867-b7be-3a90c97c300b", "comment": "Malware payload (Mirai)", "value": "10c98d41fcf9afd8dd9a67250c4395039c416e38c369c72a8da3b03d70d71fc62fb215cb9cfbb0dcbfd17d20e8b4fffb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492620, "uuid": "d5fe77d5-ff49-4581-9146-7a2aedde1d91", "value": "T195C36D22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492620, "uuid": "21a53055-81a1-452d-87e7-afedaae86674", "value": "1536:qZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnfAlQAQKC1D+tAlPYm5XLxgFxHa:n3IbE/HnQBKC1ySNYOX1FXAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783492620, "uuid": "bc6b00f5-ff4a-4af0-af88-aeed432df947", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783492620, "uuid": "eb9a3f58-28f1-4348-a4d0-08de5cc6d2d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492620, "uuid": "1cd6f47e-28c5-4ef4-a0c8-97b3c71c0c35", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e000ee9e-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493243, "uuid": "d23140c4-8789-4b7a-baca-ddd7bcbce2b0", "comment": "Malware payload (Vidar)", "value": "180e07dda2e9ccb927777e0c034e3bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493243, "uuid": "1475e095-4825-4128-9cc0-9c1b8e8273a6", "comment": "Malware payload (Vidar)", "value": "4eb1c6fdd48256c19d9b639c1087a1184daeb263865582e557460b1358bbca06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493243, "uuid": "6642ea88-fad0-4b8c-83bd-37224bc3fcf5", "comment": "Malware payload (Vidar)", "value": "3c8ace5051315d3302611e9dec613a7db5733e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493243, "uuid": "99a12fec-4a33-4aae-894e-10cf191400fb", "comment": "Malware payload (Vidar)", "value": "2f4e112afbb09c91b625b64137b964717ad34ff0b87cfd7f3ddac2ba19e995f0e5871b29eedfe1ce735c9fd397c0f129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493243, "uuid": "b34577be-8edd-4e2d-bdd2-c78df8dd7ed7", "value": "T186D58E077CE108E9D4A9A33189BB51867B30F8594F3227D72E90B6382F767D19D3A784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493243, "uuid": "d9082542-617f-40f5-991e-578cac2d8f4f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493243, "uuid": "b79c9491-826f-435d-b49f-9c076aceefe0", "value": "49152:Yk0/IyymhHgJSLUlG4xuAITnihe8LdEd146Tji8eLn:YkyCGUlG4xuAIbihe8ZEd7iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493243, "uuid": "964ce290-45ea-47ff-ac18-fb074094c7b6", "value": 2998128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493243, "uuid": "b038ae55-8d12-4063-95ac-759b426189e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493243, "uuid": "35fcba66-2f80-49df-9aae-6f947bc4b7af", "value": "SecuriteInfo.com.Trojan.PWS.Vidar.509.31316.28575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c5e45a-7aa9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500366, "uuid": "04702e31-da9a-4e89-ad28-35314822119c", "comment": "Malware payload (Mirai)", "value": "07f8810e07fe69eae223cc4098522fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500366, "uuid": "eb571239-559f-4690-ba77-4685f391043a", "comment": "Malware payload (Mirai)", "value": "4fa80974a6ef58d198da67ad364938b067b36a1844fc36aa3cd20c298bad7a8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500366, "uuid": "9a0e6a7c-6738-4ffe-b8f1-2a62c7ef8213", "comment": "Malware payload (Mirai)", "value": "24d4825f0c5b04e69c5fdfb779e825c5db171b9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500366, "uuid": "6c043011-b98f-4359-9830-9a607a244713", "comment": "Malware payload (Mirai)", "value": "a0e45d30dfef2b5c102dad254caf207e1dd4f59498678114a90e9286fcc72536bfddfb413b4bf49e5ba0fbd27b9f4545", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500366, "uuid": "ccf7fac6-b206-43a2-9790-5d0263e63eff", "value": "T190C32945B8829622C6D723BAFA6E21CD332163E9D3DF31038E219F1137C659B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500366, "uuid": "62bbf72a-c920-4413-a61b-7ad94c646343", "value": "1536:lKSmAASQ6ei2cdv/Lpl+9RKp1anmmA4zQyCR8PajUSi0CmOlc45PLv7HVt:8PAA/6eedYZAlmPajU3xX7HVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500366, "uuid": "7919c967-ef96-4db4-ab18-8119658e7219", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500366, "uuid": "19bfe065-140a-4121-83db-3c5ec67b9c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500366, "uuid": "daf159b7-0dee-4983-928d-c372bf532c17", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269873b0-7af0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783530728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530728, "uuid": "5060b705-7374-4928-bc3a-ecf5ba53d7b2", "comment": "Malware payload (CoinMiner)", "value": "bdf2f9676976112b7d2ea2e37c6be373", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530728, "uuid": "055f680e-86a6-4c8c-b694-fd9aec43b61c", "comment": "Malware payload (CoinMiner)", "value": "5074181ece52b0e35f86c2c1acd023c7205f861426f21d303cbbdc23e8b50a68", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530728, "uuid": "5679a6cf-fd83-4bc0-bdf8-e9c0dd738057", "comment": "Malware payload (CoinMiner)", "value": "4aef7302f845089e4a16507123570edb4b12197e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530728, "uuid": "83b76b49-a2ed-4547-ba23-958d6e92a81d", "comment": "Malware payload (CoinMiner)", "value": "ed779bf860835c6cde2ffabc7db491df0484b77e9ab80dd2718e0f1ca436f43e1abb0c46fa14a53112c5b4e4da7ab272", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530728, "uuid": "7fd83d10-3714-424b-b9c1-096388bb448a", "value": "T1DC22910E2D4B4321EE5108B0F675464A543D1EE37346FBDBE632D5CB0AD6E4884C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530728, "uuid": "43325faf-3664-4a94-a231-85aac6e03af2", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530728, "uuid": "492eb8d4-0a3a-4725-95f6-14f70d657482", "value": "192:GolpS5BHVxSHO825fWsUPFJxTEZmFhqecR:GocVsubxFUPFwZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783530728, "uuid": "11ccbf62-7c57-4ffa-ab2e-5a7988b34768", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783530728, "uuid": "2f40cbd8-dd51-4de4-9bc0-e01e59f020f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530728, "uuid": "1b1b4e1e-75f8-4729-bd8d-04d6a92466a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeceb1b6-7abb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783508193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508193, "uuid": "38bc545b-0f50-438e-b559-d190206eb553", "comment": "Malware payload", "value": "7f9c8da34d9a2266cc0e4c0f2f71e338", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508193, "uuid": "d3aa1e07-4175-45d3-ad74-a6136d085d7a", "comment": "Malware payload", "value": "50e531fe88375650a0445af545b6fa2d9648793aee3d90eee7ba8b12f3122bec", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508193, "uuid": "fd87f8c7-e5bf-497f-91cc-5a41315113bf", "comment": "Malware payload", "value": "094f1303c40b279c5415a4d1e06cf75aed6fffcb", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508193, "uuid": "e9645024-c8af-4c8a-97f3-2a04060b23e5", "comment": "Malware payload", "value": "79f10b90a72ce80f37a7e3f21e49f2431a6c0b6589da087359254d59b42638f2c312e23a8696177231181d6202627fc7", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508193, "uuid": "358bcc59-54db-4969-a0e9-8c394cb365ca", "value": "T117E533502FD3B634BC3DFB7C8AC758224D7CA8293A3D9853173B07685B58DAA5810F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508193, "uuid": "a35e0663-f8cf-4577-bdf7-5ddc549fd343", "value": "98304:IsBFLWORSPunXFga5gin1JLzVgPhpbXYcB:NqoHgOgi1FxgPPUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783508193, "uuid": "18419879-7262-4787-be08-e83bf62b529d", "value": 3153131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783508193, "uuid": "89c6724f-d381-4967-b044-976c4458c05b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508193, "uuid": "af368683-cc67-49f1-a32c-435e06b76062", "value": "943235f5fb2e6a7f7a8aa9d55e84f0759f029f468239c71306b4176857a2b2d6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079f775e-7adb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783521656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521656, "uuid": "0365dc86-dd89-4ec0-b89d-99ff626c208b", "comment": "Malware payload (Mirai)", "value": "14a6fe7a83bf5a239bb33dc30e2de9fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521656, "uuid": "dc16e86b-3010-4bb3-97bf-87fe2239c148", "comment": "Malware payload (Mirai)", "value": "516f6fcf43c458fbd2e64787855be540005be7f59e9400a5e567767c446c4955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521656, "uuid": "af66d1ab-8c3e-4b90-9078-ce754c823df8", "comment": "Malware payload (Mirai)", "value": "9b75402e9c3166bd656b364b251dd43c0ea00295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521656, "uuid": "72f05bb7-72a6-4a36-a3b9-2035a4a99e6f", "comment": "Malware payload (Mirai)", "value": "b14dbe3d4ea8b7da62dca6965b3d3ed7195738f50ac546ae7e1c0840e61347b232e55255d9d31cb5cf5413cb1d7d6fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521656, "uuid": "9ab48fa3-8dea-4be0-8c8e-7bf0e08aeaac", "value": "T14F245C46EA814E23C4D7177AB6AF114A333297A4D3DB730689286FB43B8679F0D63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521656, "uuid": "8aa125a9-e62d-494d-95e2-b2ee59a1dfcc", "value": "6144:GUiB0UfyVEaak87zNos2thrCGFTHRGLavM/912s:GUiyUqVEaak87zNos2DrnHlk/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783521656, "uuid": "86e38620-0d11-4fbe-b440-13c1fcb5e677", "value": 210526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783521656, "uuid": "f660fd27-1072-4b9b-a426-c9e1137ae150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521656, "uuid": "c435acac-47f0-45bb-b372-79ca183b9c84", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30163807-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475339, "uuid": "455f5f14-6984-4cc0-a986-c0e94c1b68b8", "comment": "Malware payload (Mirai)", "value": "bc7b88d9f7b3950d439ef12647e1c1a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475339, "uuid": "d0bf2842-b4d3-4dbb-b42a-85c079cbf84d", "comment": "Malware payload (Mirai)", "value": "524fef057a18f499117e6ab2c3cde2bef7f6d2c9fc2b51a462b269261f3fa713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475339, "uuid": "3987cc32-4548-4761-9629-c84e1f9c9bc0", "comment": "Malware payload (Mirai)", "value": "a29b73aee998974a5277d85c6aa05f847853335a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475339, "uuid": "db4d343d-3f54-4546-88a2-8aa87fe83da8", "comment": "Malware payload (Mirai)", "value": "d7a0a56bdb05597333b5755eb0b7f24e4d082892837a343c25060da61682718b1010af5debeb98dc58ac7a79d6d79e4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475339, "uuid": "f92982d3-ecc9-495e-ac63-3c2a8a1dd9b7", "value": "T1ED53B616BB590EFBECEBDC3746A81B0134CC548A22D56B367634C868F40B65F1AE3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475339, "uuid": "0e47a6c7-84c8-4850-b4ba-25a0368469b3", "value": "768:4MyK7uY/Ot9ycpdoveHSeF9ePoxAkNMuI7BEm4THYZ2cSXi9I+XOctwF:4W7uvd02Sg9HekNMuI7BEm4sZ2chXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475339, "uuid": "28a03c01-394d-46fc-89e8-9dac44d79dae", "value": 64900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475339, "uuid": "47bde015-3532-4973-a531-23af5f0fab4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475339, "uuid": "8f47ef0d-d7c9-4554-8044-d6365da9ab1a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3f9502-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517072, "uuid": "7d0613c9-b52c-489c-ad0c-4910ebb5eb02", "comment": "Malware payload", "value": "04ec5209d922b98a947fea48c73ecaa8", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517072, "uuid": "33aae3da-0481-4edb-993c-d921436c0eda", "comment": "Malware payload", "value": "5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517072, "uuid": "ce7a3aa1-6196-48c3-a538-586f9fc486e0", "comment": "Malware payload", "value": "ea37f1e3004a5c20af5802c35eb2275594db9c59", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517072, "uuid": "bde9365a-56fb-4fff-b741-8ca686f9cb0b", "comment": "Malware payload", "value": "a5fcf32fb634032fce8c9d890fd6465fcde985c9b245d02dd6a4b00843cea624a943327e385f12d42721ff85bd2d4448", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517072, "uuid": "437b5ed4-903f-445a-93a7-232d15db6558", "value": "T150C77C83E86606E6C7A9C1F4C49B460677B4BC005326B3C75B11FB25BDA67E86E7B340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517072, "uuid": "5911ec7c-9b51-4472-8f47-b1d726ae8ce3", "value": "37d1583cdb053f044c0e668eac8ef6dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517072, "uuid": "c9a0d17c-b6c4-4aa0-8bf0-f9fcb4eda286", "value": "196608:aoh50/6Oto9HF8V8Z5DClDF6YDWWRW365xPhFzF9e4WzKt9uiLBccRLyGbgVwXY0:aMWZtoJeDoYiWRU6/z/dOJx/ShZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517072, "uuid": "bb0f9349-fe3e-4cca-94f2-1e34c805d401", "value": 54166424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517072, "uuid": "69dc54c4-4d1f-419e-8289-f907955bfdd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517072, "uuid": "f2dccac0-469f-4e00-b65a-5a792f20b909", "value": "cloudflared.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22bc6c1-7abb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783508172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508172, "uuid": "d5e7f7b6-4dc0-4e71-8067-84bdb1a4ef74", "comment": "Malware payload (QuasarRAT)", "value": "877ec872071100e04a4154315aa10aa4", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508172, "uuid": "82468f98-09d1-44b5-92cc-3509a4847eaf", "comment": "Malware payload (QuasarRAT)", "value": "52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508172, "uuid": "d7b1905e-5bea-4786-a421-c7aecc65349f", "comment": "Malware payload (QuasarRAT)", "value": "55848021964e52ef1cb1c0e3040d34880ef7a8e9", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508172, "uuid": "961a627b-8063-4126-967e-348d2cec562c", "comment": "Malware payload (QuasarRAT)", "value": "5e29df2c9bc93b2cfb3f9a223aaca43164dfc4d16d00a5297dd11a1cd762768cf224b07f7cacfdf215c068877ab32545", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508172, "uuid": "7b9d6779-0ccc-4bb7-8c2d-3cd27982d402", "value": "T124C423005DFB073E46A0876935638A8F27E94DEEC1A8B8A577FA04876F4F74A45DF408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508172, "uuid": "4d23cd4b-cb1e-4526-b535-2c33ddc34a87", "value": "12288:XtAQor6pJq1tV9PojubUkvhz58HYOyTnoZpFRAY0:dAQor6pJqR9hpF58Hh2WRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783508172, "uuid": "b54c9d91-dcc4-4abb-946c-d1e95b93db65", "value": 565982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783508172, "uuid": "ae4fe821-b837-475c-b536-e7b6050ab22a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508172, "uuid": "9aade4ea-ef8d-4ec5-83c6-d966d2aea80e", "value": "output.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aed9f0f-7a6d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783474552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474552, "uuid": "95cccc03-62ea-4727-9b79-1bc6a98ab9ea", "comment": "Malware payload", "value": "24b5d77a8c8a667787848bbbab1ef1fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474552, "uuid": "1bb04bca-236a-4928-af5c-ab5d199454f8", "comment": "Malware payload", "value": "5293f5c2af79144e8643cbdfd3ecd913eb5687551ee91376e6416c9624f7c96d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474552, "uuid": "6b7fb094-2a1f-458f-84c6-3f4e901d55a3", "comment": "Malware payload", "value": "27a221b763380b88e66cb54992d34a1d6a739dc1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474552, "uuid": "d093bb81-a520-4cf7-ab4e-e991394d45d4", "comment": "Malware payload", "value": "ddf9d7fdca1f1b6e2926db0f32d946f0ff1d25d4a2feac1cf12050639ac075ad567b73cce57e36f3d2035507d109af7e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474552, "uuid": "35abf306-6aef-467a-84f6-0658b4bdb28e", "value": "T1C2C2F1F1F8ECA435369D853ABB9CA805A9DF7C2F4DAB7D2014175938421CB1DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474552, "uuid": "7fe957be-2c0c-469c-81bc-49f1e35ebfab", "value": "384:NV9bud3s15u7isjsKG6q/A4UAbMdhQuW57:tQs5lUMdUA4z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474552, "uuid": "3541d069-8b18-4aee-a157-cab34dd647f2", "value": 26586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474552, "uuid": "92164341-b3e3-4667-9c5a-a6fc71013cfb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474552, "uuid": "e38bca92-d6c1-4bc4-8795-3ef3f1a13cdc", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bef898-7ac8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783513656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783513656, "uuid": "a70d9afe-2870-4283-91b9-a04f5bd8fd46", "comment": "Malware payload (Formbook)", "value": "0750dd62343644985db5b658418b8292", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783513656, "uuid": "bea34527-4427-4bd1-a339-9fba657d5ddf", "comment": "Malware payload (Formbook)", "value": "52fb1acfeb05dfcca47b00a79f6b5b7b35187a2f261c22ad358450280333fde2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783513656, "uuid": "ddd7eaf1-a257-4467-991d-04629abd5673", "comment": "Malware payload (Formbook)", "value": "47aa528fd03aef53f2543395dcde73da2e61b275", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783513656, "uuid": "c026cc9e-7e88-4c56-986f-d43bbffbb3e3", "comment": "Malware payload (Formbook)", "value": "02c1072c606a7882813bd5caae8ea6717ab7539cc9527188c2d7e88915ef9eb2aa9cde4ea551612a333cb6a1a96c32bc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783513656, "uuid": "dd0d9f5f-c187-4f3a-9bf1-2db3e4f4f6e0", "value": "T19B3327E0E7771510BBEF87352629EBA02D95A523034AF6C4743ADAB75B305A0DCB3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783513656, "uuid": "618feba6-091b-4de6-b4e5-c487549e352c", "value": "48:5NPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNPNP+:1m3tDQlEyA4svNh83SXYOY5x8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783513656, "uuid": "0b83d493-c183-4adf-afa7-5fddd9f9eefc", "value": 54346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783513656, "uuid": "ee6e6b73-c878-4b5b-a400-0e39e28c6fd3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783513656, "uuid": "cc11104d-b0d2-4f25-9457-f6c9ee68d730", "value": "08. 2026_Purchase Order_PARS_4500002352.xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b922f192-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475569, "uuid": "a57d4d9a-904b-4614-9089-728f01037b87", "comment": "Malware payload (Mirai)", "value": "ed872b0fe5df2c7175d2828e8495ca64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475569, "uuid": "d36756df-b30e-4f00-9ad9-fabf18cb224f", "comment": "Malware payload (Mirai)", "value": "53315d3131904093f56cffcccb235424aa53eb24ff814c68c6dece1a3744a2fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475569, "uuid": "820c2a2c-b2b4-4770-8e0a-f8ae2fb83f89", "comment": "Malware payload (Mirai)", "value": "61c74d2c193ec487fcfc0d6a8290b6869f746fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475569, "uuid": "89ec3697-950b-466f-b88a-68de3b918c23", "comment": "Malware payload (Mirai)", "value": "b099c0723e34e4eb7e70f86e3ead24c23c74b68f77c243d16dfed2f4421daaeaa4b1c7f17724eebc04eac64f035538c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475569, "uuid": "9299eedf-1391-4e13-b7bd-59609ec48870", "value": "T1C3B39D9BF24B12A1C86246F047CB0BDE3E6322925F5BD9E33C2D213A1C7A1CB5D05B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475569, "uuid": "934e721f-0bd7-4fc8-8f38-9ac6a0e7cb8c", "value": "1536:XQWJKy2BaeidhAVxQalazuYwyUg0n/LWO:XQWJKy+aei7CxQayuYwyUg0nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475569, "uuid": "c7c2b60e-5bd7-47f5-a27d-4d0178c9d06c", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475569, "uuid": "33a39c95-00ae-4a7d-b570-f7d24880569d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475569, "uuid": "5a8fee0f-b67e-44db-b351-3fc38ea1c9c9", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e07b935-7b13-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783545826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545826, "uuid": "398d0846-9844-4d0b-b895-f902c71e280f", "comment": "Malware payload", "value": "0585f6405ffced70db180757671c93cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545826, "uuid": "16c1f651-f08c-4764-87dc-e8715b1c7c56", "comment": "Malware payload", "value": "53d660b7a7125aaa4aa764ddcf46fae02e8f538c798426b7adf87babf701d0b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545826, "uuid": "7776dad2-d9d1-4c7d-9d6f-6d5f62b97e49", "comment": "Malware payload", "value": "ae8534ac1abdf6c9224167c6df9e416fc12c0481", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545826, "uuid": "e1f40192-f03e-4282-8de1-2cb9e16d9934", "comment": "Malware payload", "value": "bb7e9953c251938e603b02aa4950574b1d8a06bfb53757cfeebc289635ae034efac134fd3326efd840773712c95135ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545826, "uuid": "f03eec57-96cc-48bc-a932-e8dcaa477d55", "value": "T1E01112E39465442135B6C35B06BBF1802E4BC42B1602AB14B53F97338F4E202E361766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545826, "uuid": "abf50f63-c96e-4dae-83f6-1beaf4b36048", "value": "12:Ihw4AC3FFuTBFqljHFVQtTaNu/iffWy/0pEaYtCSfv3XYwAjdKtWqRJJ:IhLVk7qljHFg/MfWyuEBXf/IwadKJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783545826, "uuid": "0736ce1b-caa9-4a54-82e6-fbc208952e7b", "value": 895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783545826, "uuid": "ac8a2662-5b3f-4359-9ec5-3fdb105247d1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545826, "uuid": "3321ae1c-cada-4bf2-aae9-6fbfa4cd3fcc", "value": "53d660b7a7125aaa4aa764ddcf46fae02e8f538c798426b7adf87babf701d0b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e1de20-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493282, "uuid": "159cd61a-ce33-4da7-bb6a-e6fd5ac811ea", "comment": "Malware payload (ArkeiStealer)", "value": "e19531ebc37338b9c6764f5f5051b46e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493282, "uuid": "cbdc75b0-4a93-4058-acdb-1575ab2a9462", "comment": "Malware payload (ArkeiStealer)", "value": "550eda8ed1c8777c02d4144c3602e0e078a95afa5df66d7284d2a8441cdd0751", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493282, "uuid": "1c2ba505-22b4-4e47-9589-6bda6ed72a15", "comment": "Malware payload (ArkeiStealer)", "value": "07a786d89292206233abb7b3dd98090bc0ddc160", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493282, "uuid": "4511cf14-5275-4ecd-8e86-e96c16b6c599", "comment": "Malware payload (ArkeiStealer)", "value": "1a1f68f835effa6ebf1f41dfcc5edd9cc22c3022fe26e1c390ec700a477a8b108f4e35b701a6691b673fb5f16defe2c3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493282, "uuid": "065e8a29-610c-4f97-9f9f-5850f9cf8c7a", "value": "T122E58C47BCA049E9D4AEA2328AB752927B71BC080F3563C76E54B3382F727D11D79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493282, "uuid": "89e7c812-cdbc-4445-848d-36b0f15396a7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493282, "uuid": "d08b5624-162d-4e40-aacf-51fdabb05866", "value": "49152:7Yyk/SROZzf14J1FPlpU05A8OQ/tuL9FrMMK0P7gl:7Y3gJ1ZUA1OQVM9FoMr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493282, "uuid": "693650f1-80ac-4f5e-a9d1-212ee74f9c65", "value": 3091304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493282, "uuid": "423595eb-2ec0-4cad-b6c6-9e61ace2f163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493282, "uuid": "a70a350b-9cc2-4a14-9bb3-3cd651b9e179", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40273.10096.31195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1775b1f6-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472720, "uuid": "66f76008-9f38-448c-b3ce-dfb17ccb0284", "comment": "Malware payload (Mirai)", "value": "1c9f698a0e03a3c9cb97c0dc6d9d1371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472720, "uuid": "58caa2f7-0a90-4cd0-af0d-098f9873a6ee", "comment": "Malware payload (Mirai)", "value": "57a2703848d25574cc777185449251a59ecf6c0a753c510af8da61e26741e8a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472720, "uuid": "ac829231-8c56-45c8-b5bb-de47843a127f", "comment": "Malware payload (Mirai)", "value": "0d38f788b3ac7ab898476ad7665383f9c033ba0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472720, "uuid": "73ffe51f-a11e-4ba7-95be-e6cbde8804d7", "comment": "Malware payload (Mirai)", "value": "4e84cb63350b7aef12dffaf184f09ef2fbbb9e79917126a4f6b80abf2cb93972c5b7b65c224d2fac4488a079294b9d3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472720, "uuid": "8201a84e-541b-47a1-a894-f16c6ef47723", "value": "T1DE33F1695C25DB71FA530C71CF19CBC73A1BA7B500A479E3026C8638CBD8A6A5F85883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472720, "uuid": "77558a82-def8-4cda-aec4-c0f434f53748", "value": "1536:a7DfXSjDmI+ShaNHJG2obod5ZAv0RZVHL1:a7D6/mIlhaNRSq0sRZxL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472720, "uuid": "abf8844b-809d-4b59-a7db-553cb0c4c2cb", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472720, "uuid": "27647a91-f835-4272-96f3-3633ed2ba85c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472720, "uuid": "238e4ccc-1d01-4e0d-b8d4-3c21ce588bc3", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84015c86-7a93-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783490941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490941, "uuid": "c3201740-cd54-4df1-8ec3-cb753f4a9ca1", "comment": "Malware payload (Mirai)", "value": "9f6dcd3b3488262065a1c5b1703ab4c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490941, "uuid": "c73783bc-09e6-480a-8333-c9aa83ec9f55", "comment": "Malware payload (Mirai)", "value": "5871e9ed44d989827c88ef3308a1f808d0822d8c936dd3cc0b684a258e62b06d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490941, "uuid": "33f21f7c-6d5f-4a72-9377-42884f0ff748", "comment": "Malware payload (Mirai)", "value": "5b2082baeb8e05347fb6461fca12b7748fd1431e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490941, "uuid": "c1d42e47-9a39-4a2b-981e-0ba76ca62e82", "comment": "Malware payload (Mirai)", "value": "e1a7dd932dc06277a38c2d5604de2857ac6fd10b44b9fadaa73d1b4b13de627211d05bd7f687b946d967cd7c423593ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490941, "uuid": "df3ab55d-2ef8-4d35-a91c-25b1095d537f", "value": "T11F23F15255CD78F0DDF81238BEDE998F53060AD0D6C1732B27292BF9778861D2BA7A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490941, "uuid": "8475a177-17ff-44c2-a643-9490a00b84fc", "value": "768:sa4qwsMicR0iSKWLgPZEmWI/rMSUqJQb6PldfHny0HKAUGqX28dLTs3UozF:sqGR0/ELJUG0KXX5M26L+zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783490941, "uuid": "1704476b-be8b-4202-901f-74276b043f4e", "value": 49272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783490941, "uuid": "7dc75ce7-5cdd-478c-845a-db6c8ec2cf49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490941, "uuid": "1002370c-1175-4664-bb14-3d8fec660ae2", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d839ac46-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493230, "uuid": "cefac7f2-44dd-46e8-acdf-051f362fb691", "comment": "Malware payload (ArkeiStealer)", "value": "d3224b22c0d60d62c72e15a78892d61a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493230, "uuid": "157c31cb-aa7c-4e12-91a6-45ec81d80cda", "comment": "Malware payload (ArkeiStealer)", "value": "588a8359d3e29e8334d628214f12cc660f92c3c47c6ff734793d9d2af1bd418d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493230, "uuid": "2c82c4e2-cc8b-4c03-8dc9-2d8a0e6fda65", "comment": "Malware payload (ArkeiStealer)", "value": "354c78fe3084f7bdb45097991399dfb8188a17fa", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493230, "uuid": "bbf8d4db-6652-4e4c-950a-770cafad1830", "comment": "Malware payload (ArkeiStealer)", "value": "0007e28a7367814d5ad2cb869175dbd687b62268962560aad4b7b8140992256dfd7f190fc781f1a3a340d63f768f61a0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493230, "uuid": "3116a55a-e8af-4a84-83ca-6c34fc0ebf15", "value": "T1BFE58C0A7CD109E9C4ADA23289BB42827B71BC080F3623DB2E90B7792F72BD15D75755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493230, "uuid": "81fdfec2-a921-4213-951b-ce6c80437440", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493230, "uuid": "341921ba-581d-47f4-8860-87948f8de455", "value": "24576:ZwcCta692VQaN7UHfFs+XXUMBeOyHPQsyPeAkVDr7MS1CBE4z4FHtVpnKLZJBela:Zwccz90NQH9sar6dy4T4wpQKBP7gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493230, "uuid": "2826f36c-2558-4469-afa4-4252897c4d99", "value": 3085168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493230, "uuid": "0ceaf058-f971-4fa2-9839-4e8366712504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493230, "uuid": "219f4301-463d-48f6-b963-4a51421e7edf", "value": "SecuriteInfo.com.Trojan.PWS.Vidar.509.21351.563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb548449-7b01-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538279, "uuid": "6ba8b8cf-888e-4eff-ae77-517ac0e61251", "comment": "Malware payload (Mirai)", "value": "a8c20eca6813973c838cf8c8f8818b3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538279, "uuid": "cd65eb34-69cd-44ef-8844-770ee08dd7fa", "comment": "Malware payload (Mirai)", "value": "595d02ea8d59413eeed0c093b6b051a9f226da3d1d86bd0a03c956d58fa9c870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538279, "uuid": "a8b14dca-dd7c-4e07-8e16-9defd2339173", "comment": "Malware payload (Mirai)", "value": "f5c902fe421b5f339ef523c9a74f198d40f285ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538279, "uuid": "71f62712-5eb8-4069-833c-4df584b0d76b", "comment": "Malware payload (Mirai)", "value": "36fea08d462daf0f8dc6c89677d52ec0c88e044bea974ad68ea7c07f0805832bea65720ef1dcbca2a4627ee188c25002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538279, "uuid": "c919d5f5-8ff2-443a-ac72-435482123caf", "value": "T15A831951F8915A13C6D122B7FB9E428D332717ACD2FA32079D265F21338B86B0E77646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538279, "uuid": "46b9d136-dc5b-4ba8-ba55-37e81701182e", "value": "1536:MA8FtPl5YGdybWvoFvVjjmyReC7YX3WgSPKoGI6xJOaZvj:MA8FJl5YovkNmyReC1CZTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538279, "uuid": "43d2d853-66dd-489e-8728-dac7acf1bbb9", "value": 84828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538279, "uuid": "6ee59cb9-8071-49d7-b734-21f36bf74976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538279, "uuid": "844638d0-35e3-44ef-9452-1c68b147be95", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac81f21d-7ac9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783514202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514202, "uuid": "ce13c439-013c-4be0-b390-a597cfda75ed", "comment": "Malware payload (Mirai)", "value": "db9f88bc3a1abd77ee60f2d605335881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514202, "uuid": "cc9518bd-0dd9-4e98-bf03-d9bf05821691", "comment": "Malware payload (Mirai)", "value": "5a7506464b11446083ec57d1f56e66c488e73029bfc71e891bd23ff90bdae3ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514202, "uuid": "b3b807eb-6c8a-4f61-968b-a98cfe73001e", "comment": "Malware payload (Mirai)", "value": "a8d46a0c7468503bfb84ce56efebc5c5c343fa00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514202, "uuid": "80268497-2409-4ba4-9f8f-9ab3e4b9caf2", "comment": "Malware payload (Mirai)", "value": "e7eb855f2b34666837a024beeced4e432001a28021f946517c6a05cb0eee1caa6ad3fa94342fd6587972c7d8e21dcbe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514202, "uuid": "f2d41a67-1a52-4c45-94ea-87994540f522", "value": "T1AD93F781B8824A6AC6E02379E66E718E33A0B3F5D2CF3127DD615B12779518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514202, "uuid": "b1e5aab7-fd3e-4750-abcb-4f8939dfaea3", "value": "1536:9m0L9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthSDH8ku8oeIH:9rBq1BtD6wq5UIORIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514202, "uuid": "1ce1ac85-4ee4-4680-b124-a49460fe6516", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514202, "uuid": "bddc2088-6118-4b7b-8081-0c8b78a39847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514202, "uuid": "af104ad5-afd9-4a56-b6a7-f0382971e460", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37a663f-7ab1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1783503906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783503906, "uuid": "69337850-d0fd-4487-8b5c-76cf2198cb00", "comment": "Malware payload (STRRAT)", "value": "563fc1e7a09de5b32adaefd86487d9a1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783503906, "uuid": "4a32cf8f-7181-49aa-ad97-a78d406da2da", "comment": "Malware payload (STRRAT)", "value": "5bfe96a9e46a3ec8a49b5ea3cb026f9049d2656dc1ec5de4b379c00e62b65117", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783503906, "uuid": "2b8ded53-b87e-4d7c-8edc-cc9e614b1bf5", "comment": "Malware payload (STRRAT)", "value": "d3587e956388d93450eeda8c6ad710f10bd45ace", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783503906, "uuid": "812d6883-8880-4ff2-942b-9489fdea0f60", "comment": "Malware payload (STRRAT)", "value": "27334b66591c56732f232f621546a4435088c91ba3ea5fe753673a7d7caec6ab0e2577b87aa1acc61bf66128252b8396", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783503906, "uuid": "76a0b09b-6c80-4bd4-8214-50740fe60248", "value": "T1262423745152F3EE81AAD9B6C42B42E24B38C36D635A13D70597E7DA5C310B08EB8E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783503906, "uuid": "16db6018-9cad-4f90-a2d2-1538e95c87d1", "value": "6144:f4ouZb7sy1893Rhig6AqeHpzuI+dbpk/Ezt:1uZI9HJitpzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783503906, "uuid": "5b7e6134-b623-4c96-96dd-5720b5a59035", "value": 227042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783503906, "uuid": "e3d00d19-6a94-4e21-b2af-a576c905f952", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783503906, "uuid": "a99ca521-47e3-47a4-b12c-7666123f77e6", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407dff90-7b14-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783546233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546233, "uuid": "8fc05384-f8c3-4e12-b186-841c90ce6e8d", "comment": "Malware payload", "value": "46f5a25219097ed98229429b60c50d94", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546233, "uuid": "d5554375-7c17-4123-aa74-9ab10884da93", "comment": "Malware payload", "value": "5c064e50e090d1b54c46e7d1fcdfbcc668266936352f99da280f5e84d4b98581", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546233, "uuid": "1d731040-e2dd-4cf6-86ec-23b9f05d6624", "comment": "Malware payload", "value": "51d6d48872d4cb18a378cce7eee69986f38038e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546233, "uuid": "58663f32-35b0-4c64-8f76-6dc05746a7ce", "comment": "Malware payload", "value": "2be371db7815462d73de89055023f538e1e202219200b113b8263e877aa09cd959c8f7e27862fd30fccb58be723d72a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546233, "uuid": "60662638-957c-400f-b515-0c336d1b816f", "value": "T143F0ABFAE400407079A0C72E22EB32A4035E80673854AA3EF8AD5D726FCC007F3A0F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546233, "uuid": "49e5b6dd-9e27-4901-96a1-1cd52c471cbc", "value": "12:IcWHNlTesdGXfGKFFuTBL6qljHFVQtTaNu/wFQybQ:IVHNlClfGwkpljHFg/ryM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783546233, "uuid": "8d77e97e-ffee-4dc1-b15d-731688fafdb8", "value": 460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783546233, "uuid": "f06c8b35-0eef-4cc3-8254-4e489a57d9d1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546233, "uuid": "b0d1a408-dd33-4c72-a8a1-15a7f093b054", "value": "5c064e50e090d1b54c46e7d1fcdfbcc668266936352f99da280f5e84d4b98581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e2ab95-7af8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783534319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534319, "uuid": "27bb1756-7364-45ac-8836-742fa2857bbc", "comment": "Malware payload", "value": "430bf1cb07b68976020aaf0b40551b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534319, "uuid": "fef31da1-176c-49d4-8d1a-df375c9b18e8", "comment": "Malware payload", "value": "5cd69a8d537df27c9ffe4ea201bf72dc98b55f2e2466b82b79fa6cb8b957b396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534319, "uuid": "fdd20a90-4928-4683-ab60-82a9d38e0265", "comment": "Malware payload", "value": "531e379f7da550fe8abcad1e72a678bda35f4ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534319, "uuid": "4b911c34-5199-4dab-b4a8-76a698ac0cf0", "comment": "Malware payload", "value": "fefe43c8240d744454b51e3daa5a1b690bd0fc2fd95a5b8358ece4436f45d635b1262c8e3e2143744299d1055692b5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534319, "uuid": "d4595a83-265b-42ee-8879-5e88b2c7046a", "value": "T1D277336C6A921588F0D7643BFDB3983F924339912730458F9FE82D9639D31E0AD68763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534319, "uuid": "1f4503e2-1fb8-4d5d-9b2a-a4282415a2f8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534319, "uuid": "11af8c36-0574-45b8-b980-54d6a0cec5a9", "value": "786432:1Pas/xJMheCMyXiFvW8w9W+NjlZcKAj7dzvVgax5q2j3W4cqwyi1sL:1Pas/XMheC9yFvWjNNB1o7YEq27WfLDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783534319, "uuid": "d73a1862-44a8-4012-8496-7311ea98a5ee", "value": 32987578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783534319, "uuid": "39de65bb-310c-4243-8bea-7c81dc5e54b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534319, "uuid": "79c6e05e-4e77-44bd-9cc3-71955381b2b8", "value": "5cd69a8d537df27c9ffe4ea201bf72dc98b55f2e2466b82b79fa6cb8b957b396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcdaf24-7ad5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783519335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519335, "uuid": "fe66f4cd-4e19-4b28-a908-def4af7a228c", "comment": "Malware payload", "value": "ac6b4454596a66dae9c5773d2a172b3a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519335, "uuid": "d7cae501-bc11-443d-8ea7-38465f2d915c", "comment": "Malware payload", "value": "5d9c0c13f2bd848c359be2c97839c9f54cbf01a8e3ae9f29d8cf1dcd7789cae3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519335, "uuid": "a5c1fc47-9034-45e0-9085-6a9ffefcd671", "comment": "Malware payload", "value": "b984538f8cd0247b21b3b1be5aa1a48682a15e21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519335, "uuid": "023d49a4-64ed-4c63-8d10-75d8971dd8c7", "comment": "Malware payload", "value": "8908db684dbc0a2a76e8660b9960afb1312d79f44ca9fc943e41dbddb405e5addb7d4bb9466bc108a896307ec80115e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519335, "uuid": "2a1dbc93-7f58-4c7b-8388-96750bed0872", "value": "T1E9336D6516857C14AE99C8365C7F2F0CBCAD43E6314491EE7FCA3CF28C4AA9CA21871C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519335, "uuid": "0ad42ead-fe54-47a5-ab7b-581e9f982b27", "value": "768:Wr9NyXsZztCD+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:gHusZOcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783519335, "uuid": "ad7764da-ef73-4bb9-8f16-b5a281e09aca", "value": 50366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783519335, "uuid": "cf7af463-f436-4413-823a-6bcff1bdff99", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519335, "uuid": "1140ae5d-84cf-4ead-851b-1d1d134de23f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1cfbd6-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537208, "uuid": "912da220-212c-46a8-91a4-20b51a65483a", "comment": "Malware payload (Mirai)", "value": "dcca6a53b0af3bd9ac6a4a0c522501a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537208, "uuid": "07109b7b-a974-4f35-9172-76b6922b2a71", "comment": "Malware payload (Mirai)", "value": "5e6ab3489eb358e76a853602e8d9aa4f928925cb2a37e007d03c1b4bccfbaeb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537208, "uuid": "0f8f2ff0-89e6-4aa3-a401-de2a20969657", "comment": "Malware payload (Mirai)", "value": "bef935e48793a6b404bdbe7ab5ad70858c708156", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537208, "uuid": "06aafe5c-4001-483c-b959-0a6715ce72c4", "comment": "Malware payload (Mirai)", "value": "991774ff458fd1a8ec9a7326828c3cd50e6d1c9c49efb9e73b5e197abc2424f7544c572a98dacf1fdeec54cc31418fdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537208, "uuid": "f0af987d-e23c-4b66-9b15-94f700d2746a", "value": "T1DCB2E18431158CA7C0F4EABF321F41CEED11DB646BCE4356AAE2C8227ED1574CA18D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537208, "uuid": "494c32d7-bce1-41e4-a9d7-bb6c20edc1ba", "value": "384:MUSMCkXWyFb9DNsfRQZue8jnBbwnv4Xrv9ONyMOmYiA4duLI97GOz5BcdiCNSTvv:IMrmyaQcLSWrv9ONyMBY94dsIJPgw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537208, "uuid": "de4bcf44-27a3-4c44-895e-c60983007266", "value": 23496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537208, "uuid": "d9f0c232-9d1f-45e0-8d46-c7ad6c90915d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537208, "uuid": "e23c5ec0-d1f5-49a6-8a3c-116cd1f190cd", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea9dc23-7afe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783536889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536889, "uuid": "4206d51a-f1ba-4c70-b6c4-26d221c4443b", "comment": "Malware payload (Mirai)", "value": "3af8731e9829f0640b7e88879948eb91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536889, "uuid": "e5e26e0e-06c9-4b80-a769-7cceb0a95135", "comment": "Malware payload (Mirai)", "value": "5e92efef58c946c74179eabcb0b4b91a767fa6367c5344fe3bdf4a985d38bd22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536889, "uuid": "be2b8728-36f5-44ba-ae56-3e3f3f293055", "comment": "Malware payload (Mirai)", "value": "e64804def40f5be1c13403638a7ac28130383f9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536889, "uuid": "26141b36-b030-439a-8a35-38fe7d31493e", "comment": "Malware payload (Mirai)", "value": "26241f8fa4d8ad4c6a90fb4b12ef1374fab813f64139eca5a27ade82f39749a9fc0912e9d6ca6b1860528a706e90ec43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536889, "uuid": "afe07f7f-d488-4f31-8883-32f387e70f12", "value": "T1E1A2CF54F2684B64EE7F1DB599B4F6D13F700F4AB163E88235C2FB13540B822AA09DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536889, "uuid": "65b33117-130c-44de-b586-c25011de9bb6", "value": "384:wTSjzVGBHHxN9Na5VRmQfh2Shh7NZTtLQxQjS2rbKY0XOAmO0rKdFHY4Slz6M4uW:wyzVMHzbimQfFvKSjtrbKvfmO0Od5Y4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783536889, "uuid": "f29305e3-9a2e-45f8-bd26-8362f9cdc360", "value": 22232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783536889, "uuid": "492a5230-9a38-4da6-a12b-4cc96e546d31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536889, "uuid": "f612f6dc-13cf-404d-abb8-d83f9e41ddee", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2175a0f2-7a6a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473167, "uuid": "0447c935-5ad0-4d2a-81e1-38154dfede2b", "comment": "Malware payload (Mirai)", "value": "0f0a327908e91cb8c292a0d117af07e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473167, "uuid": "8a446dde-9ad5-4f34-abce-7877e7ae7885", "comment": "Malware payload (Mirai)", "value": "5f6fd4e77c577137130fe0777ff434fac5dfb03908a6e094fc3fb33cc39fb189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473167, "uuid": "eef0b446-b7c4-4d99-a4d9-bccc386bdec1", "comment": "Malware payload (Mirai)", "value": "a526a7717df077b5e56fd261964594453b054933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473167, "uuid": "6ed5618a-0442-4fa9-a1ef-dd676e62ce5c", "comment": "Malware payload (Mirai)", "value": "885a6856f4a752b001a23ea6fdf05ba937ef9ca75b0f1d3a9ab3ef3962e61c6372a995b0fcc6c011bf26bc92a248dddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473167, "uuid": "03104378-683b-401d-aba3-fcb6e29c48db", "value": "T124C32BC0F98B81F6C40B88305166F73FDB7198A95123DA9DEF999F72DA73582912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473167, "uuid": "ac3938ab-ed12-4224-8f46-7b6e7682f858", "value": "3072:6FjlzYNVoZXRgn4c30tItERjnDBBMesWrhK8H1:mYNVoZhkD3OItYzDjw8H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473167, "uuid": "832c4789-abb2-4f31-8f61-4864b2ebdaa2", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473167, "uuid": "f69738e2-9672-4d95-9169-1f1785c16ca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473167, "uuid": "e1183ce9-3c52-4886-a9ac-8b89e61923ce", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac50597-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493261, "uuid": "11d36d78-4be7-43aa-91d3-383ef2ae278e", "comment": "Malware payload (ArkeiStealer)", "value": "eeb577ef6f8df5b9db31fcec262596cf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493261, "uuid": "75eeb301-cf7e-452a-bce8-635f4845cca7", "comment": "Malware payload (ArkeiStealer)", "value": "6097d600120da31c7cfcaf07aff76c07a75a5c942d9c39489c1283e0c5604846", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493261, "uuid": "25fd83c2-9ffa-40f6-9e75-e6bf9f9d7542", "comment": "Malware payload (ArkeiStealer)", "value": "e5b6d8bdd54e98ba4248c34cb5162d2a4cddea12", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493261, "uuid": "dba47bf6-88ad-4213-99f7-95c3b78af33e", "comment": "Malware payload (ArkeiStealer)", "value": "0af4248835c56085133cdfc9ab580063c85f90a7dc17b3297576391deba1c42c5c6c1dd52650129d8b292db98f4cfec5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493261, "uuid": "ede32f27-1e4b-46d4-82a2-39e7b62149a6", "value": "T1D5D58C0B6C9008E9C4AA977289B651967B74FC194F7233C72E90B7782F72BD08D75B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493261, "uuid": "64f10294-cc2b-41bb-8d17-343933df7840", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493261, "uuid": "e4ddd7c9-ab32-473d-a503-db0ebc29262c", "value": "49152:sx9jd0B1r5X1xv6oFIeUr/4y0uJQzCXKg/:s7SH6BL4y0slKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493261, "uuid": "08cde3c8-b5b3-4af9-93e6-282bb1f77b7d", "value": 2991448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493261, "uuid": "580532e0-65af-4b4b-bc5c-ee1ad61005ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493261, "uuid": "7ab98915-09f8-4941-a226-c5667d502848", "value": "SecuriteInfo.com.Win64.Evo-gen.86445473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebf5762-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517132, "uuid": "4784b22e-999d-4265-bb83-170d05316250", "comment": "Malware payload (ConnectWise)", "value": "7c0f9f1375d685ec9a30c2e1a5cf7817", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517132, "uuid": "ac655ef8-8252-4190-85a6-212311614b46", "comment": "Malware payload (ConnectWise)", "value": "60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517132, "uuid": "f530d9fc-ff30-4042-b57a-95340fc22231", "comment": "Malware payload (ConnectWise)", "value": "4dd9e00b51b94a5c9dda104f9cc9d5887cfa6819", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517132, "uuid": "7be2e1ac-e613-4cc2-8ff0-d4c3366337c7", "comment": "Malware payload (ConnectWise)", "value": "9d9a7a0d9db3e3c8035a24dd2d3852eaa4b5c7acd666a0272acd8d1e072a9d09c43f5e3547a9d864d408b9c02bde1c48", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517132, "uuid": "27627cb4-e135-405b-8b0b-e4c9f64f3f9a", "value": "T17E46E003B3D599B7D07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517132, "uuid": "9496ed59-b0a9-4147-84a6-9118bcc40e3e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517132, "uuid": "604dac53-5956-41a4-8a4e-17e13b80460c", "value": "98304:ozIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlp:ohfefPtHxcp9ym3nltDUJVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517132, "uuid": "f842bb6b-a3a9-47b1-8f9e-ab2237095ae3", "value": 5689656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517132, "uuid": "51cbcb19-1376-482d-b731-864187a35c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517132, "uuid": "079af819-0db4-4c49-8e0f-5fc0c6f875eb", "value": "SystemCheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6858df-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474094, "uuid": "f0e390b3-dc0d-47d8-b77f-03d42af37dea", "comment": "Malware payload (Mirai)", "value": "3fa53a84be3a6d89f430b34222117979", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474094, "uuid": "cc04f857-1ea1-4b1e-9272-e8053b3cfaec", "comment": "Malware payload (Mirai)", "value": "6196d48e1cb751908020b6f3a04c69855ddb4b7eb4c5003f22185ff5f52a156d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474094, "uuid": "8deb5792-1a51-4033-9194-e4f264d3d471", "comment": "Malware payload (Mirai)", "value": "71b4cb32c465381a1be8badf722e5b60c56c0d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474094, "uuid": "2d0543be-5e41-451c-930a-37b343f70349", "comment": "Malware payload (Mirai)", "value": "07a0e0e6815b6d0b6f1ded8b59f1e0f819121742bf7c6e9366468e5fdce8d4a95605f78100b66595913f3a7ddbb56da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474094, "uuid": "b12d06bd-1798-44fd-b652-809cf445c1f6", "value": "T1C6442919BD419F02C5D126FAFBAE8299331B7BB8D3EE7112E9105F60338A58F0F66151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474094, "uuid": "db2adfdc-e7e2-4497-bf3b-d2896e703a20", "value": "6144:uQ/Lzg2dHcjSN0spipPqZclV7sgAVfZ/nbh30abIqpU4PAZdtiI4ZYUE9e:zA2JbpipPqSDI3x/nbhEab5U4PAZTEZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474094, "uuid": "ba087450-9955-4660-898c-b2ab5b69f4a3", "value": 265836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474094, "uuid": "45ea6722-e6c3-46f0-ad0c-14a3ec4ec315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474094, "uuid": "67f5a1e6-5556-4cda-a7f8-90348b070aff", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a809fb-7b00-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537657, "uuid": "0a5febef-66ea-4e93-94af-a2394d4c0c5d", "comment": "Malware payload (Mirai)", "value": "fc67be64b3095af91b6476bd3ba24da4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537657, "uuid": "8ebfeb49-c75f-4c2a-977f-5c17a20a302e", "comment": "Malware payload (Mirai)", "value": "623fc73d98e3105411b49ae20573da2991faa73f5586c0dd0255f48d85d596ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537657, "uuid": "b65b61db-ada4-4980-814a-56edc8c37665", "comment": "Malware payload (Mirai)", "value": "aa5c40755075b48f197d4a723d8ee4a70797efc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537657, "uuid": "b761a45f-6dd5-4e81-abf1-507be0a8a06c", "comment": "Malware payload (Mirai)", "value": "a20e49966f26c1942aec1438d607df478aba3501140f62f6e0ad33216dfc0807a83109cbf1e8de260f1aabc09b81729b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537657, "uuid": "285a57b6-e77d-446b-85c9-bf1232dc799c", "value": "T188431881B8819A13C5D4137AF5AE458D3B3563E8E2CF7217CE224F203AC692F0C6BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537657, "uuid": "7b2bd9f2-b0dc-4b53-996d-fe260353638a", "value": "768:i4X0p1BBqnFxN2NusRaysCYzgZQ6nFdQX+SOJbqR9tfS/O7UHtCE62/DAWUWYb6R:qp1BFgsR8CYz0rdQOGnfhDLy/sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537657, "uuid": "bec70c37-6a9d-4c7a-a4dc-e4d618b6e4e9", "value": 58680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537657, "uuid": "15375776-951e-465a-9f3c-345cc1ba9802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537657, "uuid": "947b6a50-1aba-4afc-81ed-dcd440c08c43", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7b0232-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493237, "uuid": "a8dd75a3-240e-4304-84e8-056b6aae593b", "comment": "Malware payload (ArkeiStealer)", "value": "17910a5565c9fa8b5c727ba9ceb95e82", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493237, "uuid": "8f7eeb65-212a-4146-838d-db6b1f411caa", "comment": "Malware payload (ArkeiStealer)", "value": "625f0ea72da6eb0ddca4ae4d3e680dc5df30faebf648f82e93006165bd02b981", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493237, "uuid": "531b32e4-1594-4fec-80e5-ecd5286206db", "comment": "Malware payload (ArkeiStealer)", "value": "26c769948867b0a0b7bc13dc2162a61d71afb45e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493237, "uuid": "7e636216-9ffc-441c-ab3e-ffa74b66a810", "comment": "Malware payload (ArkeiStealer)", "value": "81712a8e123917da3831538951c103b121af2d18b71756db0c441bec25cfbc1b189404a26ec18b96c72bf9cdbf28b06a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493237, "uuid": "4b467e25-1a05-4534-bdd7-1b0b34c0b131", "value": "T1B0D58C0B7CE148E9D8AA663189B65286BB35BC450B3233D72E90733C2F767D19D39784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493237, "uuid": "470bcf64-f757-4e9f-bd18-db1ce646c4c0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493237, "uuid": "992aed89-5a04-42a5-b333-7e1f0bbe4cf9", "value": "49152:MJA2kPj05nwztL5MTn6pMTnFUWZo2FtXdWoyUJIqQUQ+wbCt4n8Pl+:MJTYZL5hpMTFU43WUCzCtA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493237, "uuid": "7bf0d4a6-9f37-43c8-a686-7a24382bf90f", "value": 2999152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493237, "uuid": "8dae4bdb-45d6-4dfb-b116-55e3032b05a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493237, "uuid": "25bd77ed-6326-496a-9ff4-eeaeca8f5ec4", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40270.16816.24378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1463884-7aca-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783514613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514613, "uuid": "3180209e-8923-413d-ae5e-f6364ac6d07b", "comment": "Malware payload", "value": "b6fe60cc43dc59adce9f428f5ad911df", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514613, "uuid": "a6673db0-ef3a-4e1e-937b-047eb8adb0b4", "comment": "Malware payload", "value": "62dd5f9a6c86beccd6ac978fa827a8fa03ce9f655c030e6ebb142b9c540afc28", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514613, "uuid": "a00c2d4e-f510-40ce-b920-9c47704feb40", "comment": "Malware payload", "value": "cf5ceef44a5ca6a34c61c5198ba84a32e1e751e3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514613, "uuid": "d00f3205-8c50-486c-ba88-fcefe4a55550", "comment": "Malware payload", "value": "e7e828074459a217f5297e6ff5cfaf1862bf944d8c0bbe2ab1012be4c60b9af301551435fc63ddcf1a2b54fe866f2944", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514613, "uuid": "e959526c-9e0c-4ebd-b401-c796e4533dd5", "value": "T155E533296E8C3AFE174CA558126EBF0C5A730B6540D8F24796A718C70EBBF51825B43F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514613, "uuid": "51aa9f1c-9052-414f-9dfc-35b4c575d72d", "value": "49152:ABlnRkj0+m1xzhvtb2T1D0tXnPrw7i71N4KLhU5bP3w8sUoo:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514613, "uuid": "2199ccd0-2129-4823-b1e1-acb333c91dbc", "value": 3162155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514613, "uuid": "31cd33b6-b904-4d77-b6e4-f33493d62ed3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514613, "uuid": "f6811ef0-3c6f-4689-a4ed-1dd996f407e9", "value": "stub.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592d015-7ab2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783504124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504124, "uuid": "3e4f3247-e4d7-4b93-b7cb-04f57f1c10ce", "comment": "Malware payload (PhantomStealer)", "value": "d1a837e4eb4c5316455ce9dfea4639e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504124, "uuid": "74b7904f-54a7-4bd5-aecf-5211f748a150", "comment": "Malware payload (PhantomStealer)", "value": "636f594cabcfc9a621b543c620ef6126b8347206467df637aa0cd3077d0865e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504124, "uuid": "e05f493f-16af-4f6f-8737-570c2711bf69", "comment": "Malware payload (PhantomStealer)", "value": "24977ba64553272e27cc0b5ff1be7fc00f92e0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504124, "uuid": "73c5f45a-8201-4b23-b290-9ad24178b892", "comment": "Malware payload (PhantomStealer)", "value": "d745b536115283cb268793f237589d86bbc15bb216aa27338d92066c81154e3f865bfd60f9db752f0b92216e68093163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504124, "uuid": "3c9ea409-a383-40e7-828f-daadf3f24e01", "value": "T1706523D0584ECD23E4EB5B352160EB7BAAB18D1CE109E15789FC9ED3BC3DA098C1459B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504124, "uuid": "cb9cd8c3-7833-4777-b621-7a98f7baf517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504124, "uuid": "54eecc01-9f19-4cff-b9d9-85cecbd39974", "value": "24576:SU0Kglimt/KoNYcg5jl1JF9p7mjYNseW8LdJaEKXgCULWza7KOkHqdm:SL0M/DsxvzOYNseW8LapXtnKKOkHcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783504124, "uuid": "9d2015f1-a047-479a-95d3-fa1f68e4e811", "value": 1524224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783504124, "uuid": "400d1fe8-5313-42e9-833d-8ca9deea7328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504124, "uuid": "fe94658b-0c3d-41d5-9668-68312faaf5f0", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912416e4-7a68-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783472495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472495, "uuid": "857d8a0e-46f7-434b-8878-96080813379e", "comment": "Malware payload (CoinMiner)", "value": "05ae97e3bc2aae70a800b719a2356fc7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472495, "uuid": "b9c8024d-0b44-40b7-98c5-d879c39dd95e", "comment": "Malware payload (CoinMiner)", "value": "65ce16346db5e4d0abb76776b550325ff32b01bfe69d3b0eda52bb9e5e119a0d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472495, "uuid": "21f506fd-2c3b-47e3-9122-75b6df6266cf", "comment": "Malware payload (CoinMiner)", "value": "1e113600a1aece7dd7c165b148329e9381c6bdec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472495, "uuid": "13123b3a-47dd-42c4-a983-d517b1482d3e", "comment": "Malware payload (CoinMiner)", "value": "0b94b753776a90aa6e7b7f613289b7f4c1e45116e737544214f9fdbf923fa7d08ca11f5613e046df260efd032aed7787", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472495, "uuid": "cc1e37f8-c632-44be-9ccc-08086661e987", "value": "T1CB83122B6EE80B5BEF406191521D73C754532404B00A77DAB64BCE73E8FE24A62EBC74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472495, "uuid": "559efa5a-fa45-41d0-93bb-7f998553a21a", "value": "1536:cQ3TPtuYdUxWKgEo80wUxnbhfXrW8CJyfr38+rnWAJUvNVmMWV1W:13UR7o/wAnF/rxvj9nWAJUvNVms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472495, "uuid": "a4a068a6-8bf0-4b87-be1d-dffc72b825b1", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472495, "uuid": "f955a78f-1747-49ec-a28c-02b20143ad79", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472495, "uuid": "416abfe5-1143-49ac-8e0c-086258b1a550", "value": "65ce16346db5e4d0abb76776b550325ff32b01bfe69d3b0eda52bb9e5e119a0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790c8012-7b03-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783539027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539027, "uuid": "f2836b61-74fa-4422-a567-ebbf2030c604", "comment": "Malware payload (Mirai)", "value": "a7a38b0636cc5ede4c8f19152e8b248c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539027, "uuid": "5dd80cfc-eca2-4b97-88e8-f29b48324a5a", "comment": "Malware payload (Mirai)", "value": "697b6a3dca9d4a2caa3cb20f1c5267232e1b66746470e903cb29041b5290fd0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539027, "uuid": "7cc991dd-121d-4b42-a653-c45a7f0dd12b", "comment": "Malware payload (Mirai)", "value": "47fb58a313be95e60dd90ae5ecf13dc7adf9b3ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539027, "uuid": "dbecaa16-b8b8-487c-bb47-323795273bf1", "comment": "Malware payload (Mirai)", "value": "03a5b9371fd3fdfebb66b5b8ca4c4abdd049b1e60fa0780bc68c70ca44be74f31e593c6005a33f890fd3c07a88a93bb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539027, "uuid": "85ad9cc0-f8e4-4370-9ad2-8decfbd68e36", "value": "T1F782CF51615E9E75CA600934AFAC9282436606F0F6FF7733381425A8FFCA4D661E72CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539027, "uuid": "c74d7f98-1c13-4ca6-9f2d-c5919271fd7a", "value": "384:6roZ+2SnxYNm543smxkxDMdVVwIIhymdGUop5htT:6reAONmesqaDUV9Is3UozLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783539027, "uuid": "017be409-2cbc-4c2a-91ec-9648a9770285", "value": 18572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783539027, "uuid": "be203d76-ad70-480b-ad55-cfdd84a057c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539027, "uuid": "663aa053-bd53-4b22-b180-74a0e80eddad", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e56c58-7a7b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783480825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480825, "uuid": "10e36f7e-9fc4-4af8-8191-f3178c5007c3", "comment": "Malware payload (njrat)", "value": "2bfbeaa25be3ec5055a3a53473bebc99", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480825, "uuid": "20ae3527-8f64-4254-b9d7-715b289143f4", "comment": "Malware payload (njrat)", "value": "69cd34ef2d9b26fad86387d6ef3556a7a7bdd13bf7e45f810fd7c2bbff30974b", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480825, "uuid": "4c88a8a7-d377-4675-81f9-831e418708e3", "comment": "Malware payload (njrat)", "value": "e12fe772e8c8f715e64c34addae2f930c2987ad5", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783480825, "uuid": "f87e1d17-543d-49bf-aa5f-1eb36f5fa788", "comment": "Malware payload (njrat)", "value": "6b80e536ddc5e0aced3d1c848fbda325e5d74f1564e4d4f3d80a9c686835943e6afd0784e6103a4bd14bf79744647f0d", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480825, "uuid": "ec742883-2cfa-4df1-895c-07c9123ef776", "value": "T18F232B4973D59521C5FD9E385565A20207BAB20BAC1FFB0D0CDADCE91BB37D10D10AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480825, "uuid": "4b5b637d-19ad-4690-b9f7-c821b33fe25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480825, "uuid": "954e7ff5-fda0-44e8-93d7-6cecbac09ce1", "value": "768:czXpEHBoMBHbzS/fPX3SpkPEA590TRXZ66QDY/X9u0hcbKyU:65EHBoMBHbzSPSpkPETKY/Xg8cbKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783480825, "uuid": "4bbfdd49-a9e5-4962-8a1a-b76bbad9011e", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783480825, "uuid": "bd1b22d6-8a9f-421a-9cce-23dece3821c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783480825, "uuid": "14e0ee62-0384-4e28-80b2-b576e80497fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122e5c44-7abe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783509219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783509219, "uuid": "12b6849f-e8da-4c7c-8f32-9ab078c7b156", "comment": "Malware payload (Gh0stRAT)", "value": "46d8e1c90ca1b360ace293ddc15d0d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783509219, "uuid": "dfe29297-e312-4ef2-814e-23f32787f39f", "comment": "Malware payload (Gh0stRAT)", "value": "69e2433df06b829e98e5a6c8f552b9371795fb65df62fa4cfb7362970d1ce744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783509219, "uuid": "e2a638b4-445b-491c-84d2-79dc50a0f5c5", "comment": "Malware payload (Gh0stRAT)", "value": "6e7bee4d8d67043c9b266129a0240e2d8821904e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783509219, "uuid": "b371c3ee-df14-431a-bbe5-ba0f74efb815", "comment": "Malware payload (Gh0stRAT)", "value": "c040160441cfbefb7dc7cadf7d25c38613e3c03ff6c71a3e370fd033253b6609ce932c3617e88df875ea88420f3a757a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783509219, "uuid": "31b8b90a-4f7b-45ea-bd83-260e1d67b609", "value": "T19F461253A18F563FF47E8AF64B76D15A453B3E22D8024C66A2E4385ECE650D12D3FE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783509219, "uuid": "fc57df92-9f88-42cb-891a-981e21eb9d8e", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783509219, "uuid": "dc6571a6-f7ea-4165-9cc2-eef649cb3cff", "value": "98304:Q5fgQ+yhVX5fxrfyYNKcLGV2X35lozL9uS69Na1VviQBD3UZeK1Y/dSdTEaIJzN:ob+y7nfyYNKVV2X35lG4LNa1TDkkK1YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783509219, "uuid": "35811f3c-370e-41e3-bd69-a9b0e0e3fe79", "value": 5501034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783509219, "uuid": "f48913fd-dd8c-4c76-b6bc-9a057230b36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783509219, "uuid": "4ba2958a-a7f1-48da-9bd2-98e5ef168fdd", "value": "QuarkPC_V6.9.2.881-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b86920-7b12-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783545685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545685, "uuid": "b8d57da1-46e5-4300-9d63-17b836b5f955", "comment": "Malware payload (ArkeiStealer)", "value": "4aa9d4eb5147a927c46f938246100f28", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545685, "uuid": "e96d6941-b92d-4ce2-b1df-11e1e4e171ed", "comment": "Malware payload (ArkeiStealer)", "value": "6a2b4d68e0b5367645ec7d108b1146be4fba1f478e75d7d91b52b8f0b636d7d2", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545685, "uuid": "b8634e7a-a628-490c-aefc-a046e20891f1", "comment": "Malware payload (ArkeiStealer)", "value": "f19495dd4988fa931da140388cce2355c8bdab1a", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545685, "uuid": "9a2df0b1-e1b1-4dd3-8825-94a1ed2c2791", "comment": "Malware payload (ArkeiStealer)", "value": "8e0af2a5d6e216e5a6f9d4aeac9cf7e4e1cb3c7ccd4bac428f0af956b09192ba348c1fb704a6c1f73ff7b5731e6c9db5", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545685, "uuid": "9f691dc9-a689-4dea-a9dc-bcf4c6c59ff1", "value": "T1336533049FA2ACAECCAC503CA01E1D4295B1BE578594FA5F43F0ECFA2B9DF02151765E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545685, "uuid": "bd47c0ed-aec7-4266-8288-46dddc55054b", "value": "66f1d669875f10b3526b656a280f3f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545685, "uuid": "aad58e41-6b85-498e-854a-08b41e30ce50", "value": "24576:AWOuBAVB5YB8ZhxvxXa2ZNfiWf+RagbTQWVdVkoUSX2dwLR9oyZV:AsGfvHXXXWVd0G26o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783545685, "uuid": "440baf94-e041-4e2a-b7d6-562e60318ca2", "value": 1480976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783545685, "uuid": "ed85df03-48ab-4eb4-bfe9-c87a6fd8cbc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545685, "uuid": "82cac8de-dbec-4027-af4a-a5b1aed68633", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18eb197-7a72-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783476925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476925, "uuid": "27393b44-7427-4b64-bf02-3b6f24d69230", "comment": "Malware payload (WannaCry)", "value": "2f77eef5f24bf43c423e6336601130cb", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476925, "uuid": "0f675c2e-e0c2-40d4-9056-a812e60965cc", "comment": "Malware payload (WannaCry)", "value": "6a83689b2dfdaed0f04d621d34b066aca3238d224575f961dc2448b8bfdd0658", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476925, "uuid": "37597f64-3343-4a46-b5d1-b729278ceb6a", "comment": "Malware payload (WannaCry)", "value": "e3e268a96b118551d4b16634b3aa6dbc10561783", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476925, "uuid": "e516a5e5-016a-48a3-8ed4-06c6b04631e8", "comment": "Malware payload (WannaCry)", "value": "6e407b0e2bb0525a1d255cea15b4f5af10d48c411d439ce5839aad178e279f45b56c5fe0a665424f5570f9dbe5632a7c", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476925, "uuid": "42aa2744-2a16-4594-953f-3345cf9cc633", "value": "T19936125A32AC80FCC11B5274A4B34D26E7B37C5A227D970F8B9487660E13790BE78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476925, "uuid": "13b89fb6-89d1-47b0-8df1-a725a02ace1b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476925, "uuid": "ac35630d-dc6e-43d6-9125-ebdb9aa79a4a", "value": "12288:jbLgmwbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUY:jbLg1bLgdeQhfdmMSirYbcMNgef0QeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476925, "uuid": "0eb7a992-5cd6-40d7-9274-8dd6e714ad20", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476925, "uuid": "bfb3288d-a061-4459-9d9a-5ca93e40b452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476925, "uuid": "caefafb1-7c3e-456e-83d3-1e1bf7b8dafd", "value": "6a83689b2dfdaed0f04d621d34b066aca3238d224575f961dc2448b8bfdd0658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646ba9c8-7a62-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783469843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469843, "uuid": "ca442f54-85bb-4a21-bf1a-d9d9597a751a", "comment": "Malware payload (Mirai)", "value": "e371fb7094454c787bacbb278675b101", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469843, "uuid": "bd1b0671-f693-478f-99e9-6d4d05c4fedb", "comment": "Malware payload (Mirai)", "value": "6a89179df5a928a0dabbc9a792f4f39729a343f8c13c10487cdf9271d44d8383", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469843, "uuid": "0c90faab-49a3-4aa2-802f-65fc51dcc340", "comment": "Malware payload (Mirai)", "value": "aca0d3b30e98167bcb66fcbe0fe945f6788feadb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469843, "uuid": "e9b6c8d5-91c5-4afe-ac26-47f9b04c01b9", "comment": "Malware payload (Mirai)", "value": "8f2b7df24563c9a250a1019c4afc246c4862f8d117e3a078451fede355ad208d02fe0beea9bde448ec90fe09fd788605", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469843, "uuid": "5f5ebcf8-1e18-4606-be2f-d40ea262b7df", "value": "T1C5457C57B2F364FEC053C43087DBD6A2A935B42542326E7F65C4CA302FA6E641B1DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469843, "uuid": "0c47b3ba-9061-4e9e-b200-7a592307f0f7", "value": "24576:+dETE4kzUyXNyRqXEU8YgHwp2GlaaTuOcpMgv8DHS:+dCE4kzUvqDgq2waaicgv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783469843, "uuid": "d9634680-5a09-4442-9503-404793a6585b", "value": 1214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783469843, "uuid": "67d014af-08fa-4e67-a4db-834cac7e0774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469843, "uuid": "b552f641-b732-4699-ae36-5201feb0977d", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e65e186-7b18-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1783548055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548055, "uuid": "2f66970c-d244-4491-9588-6c82891d71d4", "comment": "Malware payload (Amadey)", "value": "ede78ad472b065ed371e08eba8d8f809", "object_relation": "md5", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548055, "uuid": "71f5838f-ac96-418d-af06-b4e3f1a8bc9e", "comment": "Malware payload (Amadey)", "value": "6b5bd7f56416955111cb628f19133dcbaeddd2e3d4c063bb709466cd5eeefd95", "object_relation": "sha256", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548055, "uuid": "7deeacc6-11c6-4f45-a14a-90bb1e915623", "comment": "Malware payload (Amadey)", "value": "9f3f14bfc5b64e8891a72a1bc097bfae4fafbc34", "object_relation": "sha1", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548055, "uuid": "82bfd6de-3ed1-4613-8ca8-7b051235dea6", "comment": "Malware payload (Amadey)", "value": "6d8607a16089a7217ba82e3d793749a6e7b65ef37e767715b6a7f0c4ccdeee6339867105a0538930b69bc897816e5284", "object_relation": "sha3-384", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548055, "uuid": "cd71de2e-ff5e-46ee-b6ab-3aa55d4a82b2", "value": "T108557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548055, "uuid": "0ba7f6b5-dd83-4e68-9c20-91595db45281", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548055, "uuid": "a0e9df8a-137f-4dc8-b059-72d8ff966302", "value": "24576:orR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRw/OnW:okHmiyCkhh2Bamituw+UGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783548055, "uuid": "52029b80-1e76-4b88-b482-3c9b467bc736", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783548055, "uuid": "819ba3af-99f0-4d9e-afaa-b5048401e461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548055, "uuid": "a5c6c576-5cbc-4652-8795-66b53e6f2b83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99d582e-7ae9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783528049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528049, "uuid": "eb48d370-5a1e-44d6-ace9-f1fb4c174d6e", "comment": "Malware payload", "value": "f57bd7daf3edab12b1189e4b18f43e81", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528049, "uuid": "8e55c83c-b44c-4805-bc5e-ea8844ad74dd", "comment": "Malware payload", "value": "6b8d7f6cc333d2e89b45821a83f7d2029e8a6cdcb0c92ec1e577dd2158cfa0e9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528049, "uuid": "a706e68f-1cf6-4cc2-89ff-32ff451447fb", "comment": "Malware payload", "value": "5344e3cdf87864124d6e52b21b24f5e041116490", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528049, "uuid": "fd415416-88e7-4dca-9b2f-ef8c90c98598", "comment": "Malware payload", "value": "f5934369382381d9712c35ef86ba4f1c511c524b2499aacb021d43cbc0982c05311083c5f1d8737e58e2526f983b61cf", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528049, "uuid": "342a245f-56f5-4b31-aadc-59574cffbca8", "value": "T19EF00ED7070B80494C50013D0E6A40AFE2D79E8645BFF6DEF0202114AF6A8C8CBC27CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528049, "uuid": "0fd7fffb-36b5-47b7-bb1c-5f8bcf4ea6db", "value": "12:wxkCBCRzLUL3LOr2MWhMFpRy2zzshZaJr20VfWYhvT:9RoOuupMeofCDlWYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783528049, "uuid": "da814351-2a90-438c-a87d-b23d8ecd01c0", "value": 501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783528049, "uuid": "05211f09-e539-4b6c-bf2f-9f4660c41910", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528049, "uuid": "6ebb50e2-9982-4d44-9b9a-3c68cf0d52c8", "value": "Intel(R)_Loader_Host_Interface.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad42381b-7acb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783515062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515062, "uuid": "4e36e704-ce7a-4c28-bdb5-0081c8067c5e", "comment": "Malware payload (RemcosRAT)", "value": "5db95364de6cb9fcbd06ab524a8d9875", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515062, "uuid": "04a795b9-1c09-47e5-9fc8-e2069e0b5756", "comment": "Malware payload (RemcosRAT)", "value": "6b8f446262c63e582ab36f6c11345fb69dd2186cb2814da9a74d5feddcbcac27", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515062, "uuid": "fe3075b1-2371-47a1-bafd-977fa53b6aee", "comment": "Malware payload (RemcosRAT)", "value": "e88e94f4fa9b1e5dcff2e7788cde952970791586", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515062, "uuid": "58e82aeb-92a3-499b-aeb2-9edfb5c90781", "comment": "Malware payload (RemcosRAT)", "value": "a32bd213f134cf0e5256d010cb78fa19e2485939ff176160476d64073d6f780cd7f086e3e98dc2436c5a2cd29bf1bea6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515062, "uuid": "7fe4be11-a107-4508-8d03-e1db302e5064", "value": "T1B692D0ADF0CE08C6C9915CF33C134AD6E124511958283EFEAF5B4065CEEA6B22DD266C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515062, "uuid": "f83460b0-c2e6-4ee1-9411-b02d9e40ef4d", "value": "384:cwl8EyGAo0uEAx7PE9cuZxNcRVjSPCGb1s+FbfbekM3Ek/6BB5:cFc0uEANzuhAL02+FbTSEk/6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515062, "uuid": "91129e9e-37ea-43fe-8306-4edb1bec4e56", "value": 20093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515062, "uuid": "48bc5819-d436-4da9-8144-5c0426f19087", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515062, "uuid": "539c86d3-c3a9-416f-b697-e09f68c0b9e9", "value": "QT2026-03-0300 Pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d1c7fc-7b1d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783550138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783550138, "uuid": "97161f1e-db0b-4013-b511-a8382715733e", "comment": "Malware payload (Vidar)", "value": "6cf860452c9b5cf8172c5217812cd626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783550138, "uuid": "8d6b9557-ca68-4817-bec0-5e6b1d1f41fb", "comment": "Malware payload (Vidar)", "value": "6bbb7c702460cca08c4c809ec44cf27675f2ba016915f69ba740ed64dc73f288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783550138, "uuid": "488173ed-e439-4d0b-97d1-212d6ddcda26", "comment": "Malware payload (Vidar)", "value": "4613228f0f901a7e6172bbc39e645ba96c8bdb5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783550138, "uuid": "fcdb7591-c376-4b49-ae47-af443a6e5325", "comment": "Malware payload (Vidar)", "value": "524189ee8a200a1ff422ff8dce064bb1b6d52c05cc9342255f57f3f099410540d5c7de76e3da6b071500d1ec36fb22fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783550138, "uuid": "8a345b1d-1471-413e-9325-efa7d86a9fe6", "value": "T185D58E0BBCE049E5D8AA533649B652923B35FC154F3123C72E90B7382F76AE09C79794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783550138, "uuid": "92b0a23f-0fcd-4c1d-9503-30b643f38215", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783550138, "uuid": "72d96e0e-774c-4dcf-81c3-70c05204dc4c", "value": "49152:X9dMcKPF0NCvc7A4n2NNBQnKtNCud0aQE5QpWdafF509QfElz7f:X97d9+sKt5dm+YWE9509QYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783550138, "uuid": "dfa4d792-8245-4137-aaee-c743b9db9a8a", "value": 2957176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783550138, "uuid": "4b8acab7-38f3-4820-ae80-81a96702c4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783550138, "uuid": "9e3ed9f4-29f4-47ef-9be2-91cd27d44646", "value": "SecuriteInfo.com.Win64.Evo-gen.64556947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632eae8e-7a62-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783469841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469841, "uuid": "b16917de-92e1-4380-839f-54e9f0ae7ad2", "comment": "Malware payload", "value": "61e068c8d08bc57e9f76efd0089111a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469841, "uuid": "d4f2ae72-09a6-4c21-9d47-4132eecfd8f8", "comment": "Malware payload", "value": "6c1aaef872faae9ec1c56d5230d2f9c17e4bee0d95545e2541f8f68ba1d5b9eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469841, "uuid": "d2a490f4-b909-4ece-81dc-be4b82156ec9", "comment": "Malware payload", "value": "205f766f6a9cd5e90e6c39f72ede772441aa5178", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469841, "uuid": "bb0128cb-edda-477c-a42f-62d33edc7403", "comment": "Malware payload", "value": "7e021256b3fdb8764d48d3449340315d43761ce82678a26ef3a0e1574708d02c821b12a502645d34650c0a1f71b0d038", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469841, "uuid": "57271d43-a5d0-4dc3-83fd-3510915298ba", "value": "T1BEA244423940BAF03D4E8478566F90017612644F5E203C3D74DEA9246FA97ADB2FEBE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469841, "uuid": "30a22587-8e28-4d7d-a33f-feea24997217", "value": "192:JFu6cgIGhJAVZmfYM+HT0phWZBNhbIyuyzyeU4ZcZfv/YJS0q6NUeTn7kBVsJZrO:qJi+pYvf4JBq6OBeJJYLvSyLc6scp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783469841, "uuid": "c79dccd9-524d-426b-add8-ee5310756cfa", "value": 23050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783469841, "uuid": "f39376d1-6661-4708-a0d8-098b5d0a6028", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469841, "uuid": "d782adc0-2cda-4a04-937b-a6b3ddd77004", "value": "bot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84df0c4c-7a76-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783478487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783478487, "uuid": "22dd93be-00d5-4d67-9d6c-b66edd3d681e", "comment": "Malware payload (CoinMiner)", "value": "490bcc9e85b3600ea2cea36151acf8d6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783478487, "uuid": "627266b0-ee6c-408b-8da4-56a5d2d451b0", "comment": "Malware payload (CoinMiner)", "value": "6c303e19f1337a7eacef23bdd882d97329bebc7aff0d42f0726d2c876e3cdea5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783478487, "uuid": "0e54659f-c4b5-4ac9-bf52-471416035f1a", "comment": "Malware payload (CoinMiner)", "value": "763f4398c2527fcb954ad8b794a4ae54ecacd0ab", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783478487, "uuid": "efbd6bef-7ee3-47ea-aebf-115c159782ca", "comment": "Malware payload (CoinMiner)", "value": "6cf27e98bb45ce56555bc587e10cdecde05ad5753aaa4028dc0401f600cdd83e62bf046922f92194a27f3cdfc3a5cf6c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783478487, "uuid": "6a2368af-39d3-405a-a2df-49180f0031c4", "value": "T1F63209197E494331D3A089F85479838BA53D5633E7C3E3EBF373965E4A962448840EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783478487, "uuid": "20c577d2-45d6-4e25-8fcb-66533f74722f", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783478487, "uuid": "f34c9d96-65ba-4e8a-9e6d-0169aeba21db", "value": "192:3nomWEzBa/Vx+eTRHj5PFJxTEZmFhSac:3no+w9w2lPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783478487, "uuid": "3c61573c-4f1d-4c5f-a276-183d19e9f1b4", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783478487, "uuid": "5b0d1e81-a9df-41c1-a800-607339c26fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783478487, "uuid": "519f1e53-422b-4b14-b413-3f0ff0946e62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c47378-7b09-11f1-ac1e-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1783541707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541707, "uuid": "0306e0f9-aa11-4562-8add-805d7a670e52", "comment": "Malware payload (STRRAT)", "value": "d9fc4b448a812c43a1a2ad130b6dc5bd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541707, "uuid": "f6420b6b-1b96-4820-a40f-c5fbed3aeabe", "comment": "Malware payload (STRRAT)", "value": "6c9fd8ac684dcac825cdff69e6290cb2bbb0cb51cab82dccbe22aec52837120f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541707, "uuid": "2e8e5e7a-c7c7-4cb7-b5fe-1c0a2912840c", "comment": "Malware payload (STRRAT)", "value": "f33050fd6d88a58b1d215edc23fd9a49c7cd75f5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541707, "uuid": "a77ec899-e1ae-4243-a62e-39816e43a760", "comment": "Malware payload (STRRAT)", "value": "08f36af29d07d156a7f7dc1f172bc4e81116ef3ae811053e8b839db1ec6cfeb8b3c3d1cb694a10f39374129d1aa27fbc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783541707, "uuid": "80c3b4e2-8f7c-4430-a6eb-f7899a5b03b8", "value": "T1162423EB7A10902EE6476DF83D978FE3CF78D87E54206A6B4F4C3D990494835A34D226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783541707, "uuid": "bd3140b5-3a3f-4378-8c9a-f353246d8c27", "value": "6144:RJ1UJAIVZURLX/28zJLLbMNuEUbbfz5fg23KpYb:RJTIsX/28tUQvbFf9WYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783541707, "uuid": "27ba9d1d-0130-4163-992e-7b09afc6c5a1", "value": 227102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783541707, "uuid": "8bbdc5dc-2735-4b21-ae7f-c81aa19ca8fc", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783541707, "uuid": "ddd0e77a-1066-4d0a-9f61-dccace29cfa2", "value": "WT-260631RFQKINGTOOLCO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e429591d-7ada-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783521597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521597, "uuid": "8367cbce-cdd9-4c88-94a9-12066d4a490c", "comment": "Malware payload (Mirai)", "value": "f4d901c9388ed09c047af9f1c4b8562f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521597, "uuid": "79a2faf9-45dc-494c-b100-020cb61adc4f", "comment": "Malware payload (Mirai)", "value": "6d462a26472f5bc3d7986a04fcd8ef3c46e5f1c25eb62e87dfed74c9e7701e66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521597, "uuid": "c08d85de-4565-4840-b5ef-a331a396f4e7", "comment": "Malware payload (Mirai)", "value": "4680a897a8574ab71a1ea481d7542c9a8a30b8b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521597, "uuid": "06e0a926-4f19-4c08-bc0b-1fcbb77399f3", "comment": "Malware payload (Mirai)", "value": "0bbe6206b75eeba9c6877cb89bcd4b3be9694682e8d216fe5006b57517a49d3cfc661ccad9e8a21be172c799be7da287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521597, "uuid": "f74240d9-013f-4bc3-aa89-4c3233244959", "value": "T1EC730239D4337CB65840796759150BC0268F24BDE0E6A86F86A44124AD6CDCDAF7FEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521597, "uuid": "77f3b812-1264-43e9-a70e-7657d7e37ac0", "value": "1536:0f63v+lqi/A3n9OHtOuu1m/LO2FosZr5PKTi91WIsLcrAf4YfCOYCie:00vW/cQFB/Lf1BlKTi9YlLc84pCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783521597, "uuid": "14a9a484-ec36-4e62-9d16-1acae009f3bf", "value": 74900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783521597, "uuid": "0d18d1e1-46ac-4b4c-8427-2c6d695143f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521597, "uuid": "3d99044a-1c5e-4a69-b31e-ad17a0ac9860", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd68d7d4-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493212, "uuid": "df2d86e9-f271-48c6-a2a3-832995056d58", "comment": "Malware payload (ArkeiStealer)", "value": "cdff033a0af7dbeb9a3fdcb368da15dc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493212, "uuid": "5baa77b7-13ca-4406-ac2d-9d1b46d88769", "comment": "Malware payload (ArkeiStealer)", "value": "6ebee939adf95f55cb6a44b9bb82d0e8c2e3ce41b3427a615d9b3cfe3cc0577c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493212, "uuid": "1194641d-61b8-4475-8932-e78b55496fe5", "comment": "Malware payload (ArkeiStealer)", "value": "69eb51df860e93f3fa5dae7858b29a2ce4098267", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493212, "uuid": "e184e718-bd5b-4514-9f88-50c76ed429af", "comment": "Malware payload (ArkeiStealer)", "value": "202ed2f57f898d64dd94e4e7ebd31d350c16d9c1de2bd20c1f37ca780d512c3499dd4e2243495c30d2d423b971d944e8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493212, "uuid": "39db4c37-5d6e-455f-993e-ffe40a7720fd", "value": "T143D59D0B7CD008F9D49A973A89B791467B31BC094F3163DB2E90B6382F36AE19D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493212, "uuid": "0242cb6b-e838-4776-b661-3733b1f28818", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493212, "uuid": "565b0048-a4ba-4d89-874e-c69d62af9c77", "value": "49152:lf0c29mqN2KSpxmGMOO1zOSUVuWMP8u1Dq7y4nG:lfm3SzVKz4wDq2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493212, "uuid": "547048d8-efee-4e5a-bdbb-12daaa3a2e7c", "value": 2938728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493212, "uuid": "5c1b8034-96da-467f-aa99-821b18023362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493212, "uuid": "33f58002-b976-41e3-80c1-1b9ed73ee669", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40320.18568.14352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e432e25b-7ade-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783523315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783523315, "uuid": "7abcb503-eb5e-43b9-8d98-211d93578ada", "comment": "Malware payload", "value": "f191d28e0fd16947e9d4ac4ad86c4c6f", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783523315, "uuid": "31ea07a0-b22a-455e-87b8-43fb8e30fbd6", "comment": "Malware payload", "value": "6f5f6a03106eebc6da2a0c89d2bf3468445ab305f9a91f8bc4a44652eba3dae1", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783523315, "uuid": "0485eafa-d391-447a-a67b-4e9abcfe08ef", "comment": "Malware payload", "value": "470fdecb0efabbff7223285e7a1cf3c1098e2c0f", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783523315, "uuid": "66b5a98b-9a4b-428c-9a7f-ade211c0372f", "comment": "Malware payload", "value": "557ebc73c3dd1d0ef8a1abfa8d4a707cd6376294fd0d217e71c6375be62b1870bf7cde6823016d6833ac17e7822caedf", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783523315, "uuid": "5836bb0d-5d0f-48a0-afb7-0e39883fdac6", "value": "T12E6633EB883C4D064A691BBD14D81BF08764FACB1ADD711A9C73F97372C9801797B922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783523315, "uuid": "f6c115e9-a160-4649-9e71-0cf9538f9084", "value": "98304:2th0Y3o2lKBhIIMWcBpntC5mgUOy29LyLGimUxdUOD6hYWa+ttLbDjPehZBVnEXh:2fD5KjIrptC5nALsUxd7+YNiLbx5xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783523315, "uuid": "5b98677c-d0de-4715-8245-07f675a5a7a2", "value": 6975113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783523315, "uuid": "334fc0cb-3540-4be4-ac0c-a0d2befe3011", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783523315, "uuid": "d109bb24-856b-489a-8bc1-b811b5bbb3af", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4eea9f-7b17-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783547545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547545, "uuid": "c2c1ba33-857a-4a27-9f92-8eb105d97705", "comment": "Malware payload", "value": "b527467c5ecead21b1018905e2fb90df", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547545, "uuid": "74f57155-4bab-4210-9f34-66c2970b2c97", "comment": "Malware payload", "value": "6f725207df4c65fe9da51300a6c36174d06a3d829487d1c8fdb8c3a32f1d92aa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547545, "uuid": "666ed312-6c70-451c-97b5-38b452d2624d", "comment": "Malware payload", "value": "c9c86aa50f3d0ab44d3faac035143e0fddcf7d38", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783547545, "uuid": "804f2cf0-7d24-413f-b032-07e58405f614", "comment": "Malware payload", "value": "40c1f02403a30d5d47c5113e668663aa52c56dbb0b4c9fd9f898315c50ac31d1b76082cbe631d0dd7bb6562e41485260", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547545, "uuid": "7b0feead-33c8-4a47-bbec-6faa4e2c7d13", "value": "T13CE63350A6F102FEF4A3917CEEA19590F29974621BB6CACF479483621E532F04D3E71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547545, "uuid": "dbc6168e-d800-4df7-b298-2874ea17c262", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547545, "uuid": "49e73711-7658-4de1-be89-64f7ef7638ef", "value": "393216:XWB4F5ulsoTB7dVSimxbXMCHWUjXQcuI3/PGTAI:GGlopdVSjxbXMb8XFH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783547545, "uuid": "7d6f0a17-f4aa-4e37-ac41-1cf8aed3d58b", "value": 14285402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783547545, "uuid": "9fe50f5b-7ec3-48c1-96fa-04a716df9379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783547545, "uuid": "cbb5cfdb-5ecf-47a8-b470-7d7f6987bb81", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3186a4f7-7a67-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783471905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471905, "uuid": "d7f03bcf-22e0-4344-b1e2-b6c17c931d37", "comment": "Malware payload (Mirai)", "value": "46c707a015550bc6013ae190d5e43f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471905, "uuid": "ed21762a-515f-4842-bf70-28413a80c4d2", "comment": "Malware payload (Mirai)", "value": "720e20680e13735954dc42eb2aa09cba84c7b0aaff69d594fd4c01fd7323de44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471905, "uuid": "deb8489c-9789-454b-aa4f-0c0e23b50ff0", "comment": "Malware payload (Mirai)", "value": "89f59dd9c740b6717e42ee2b3ecfd8fbbe2ec9c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471905, "uuid": "8c1e9707-83b4-4448-be6e-402c5796e06b", "comment": "Malware payload (Mirai)", "value": "3dbf7fe4f98c9909b19dfe29ebbfcb2d99c180bc973d5ef9ffd8eae30c446a98d6ad8260760dc6909983bd494bb42084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471905, "uuid": "37b00669-b301-4c4c-af34-7142b05e6d20", "value": "T1D5245C46EA814E23C4D7177AB6AF114A333297A4D3DB730689286FB43B8679F0D63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471905, "uuid": "35a04a2f-da79-45d7-b7e2-4579db99b9e8", "value": "6144:GUiB0UfyVEaak87zNos2thrCGFTHuGLavM/912s:GUiyUqVEaak87zNos2Drnolk/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783471905, "uuid": "82f31653-de72-4727-9139-246b709b4d97", "value": 210526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783471905, "uuid": "d71faed4-eba5-4589-885d-2722094483fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471905, "uuid": "32f6eade-2cd0-4a86-a0d8-a8c2a4e530c5", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b002e7-7aca-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783514350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514350, "uuid": "8a281e57-9572-4c20-a630-fd1f92f75a56", "comment": "Malware payload (AgentTesla)", "value": "0f7ceb1663c54fba20a3c6c96e77c7fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514350, "uuid": "31329de8-a360-4a48-a547-6791d34b45d9", "comment": "Malware payload (AgentTesla)", "value": "72c9c64fdc28ab69dde17320a4e179d5225fb51557a1a10cca89282e0725e320", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514350, "uuid": "8ff29784-a192-4156-adc6-530d7e9d6e8f", "comment": "Malware payload (AgentTesla)", "value": "22482d9c908919956bdcf8094cea0595966808d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514350, "uuid": "3c52d2ff-29dc-470a-9e31-d6d59334806b", "comment": "Malware payload (AgentTesla)", "value": "53063773cd3e3fb1c632967a77e5fabfd41925ba87b216ffbde22c14fc49e26189a9715d127be33b3854dd6d7db00389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514350, "uuid": "1814569d-7a6d-4099-bf5e-a319fed004a9", "value": "T199A2E19AE133F1498DC67AB114122887F583B37E57A87CE6919633BF6CF28219B140B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514350, "uuid": "3e6b0db4-7ab1-4d5a-8a77-a65b1b8a97f7", "value": "384:G/fPCMGYEUPiL1r6ikS+Fom2YGVmXXMrWXAFaBj43+iLgX/bB4J1B5/ws7i6oDGj:G1GYEUqBsSUoB1V4MCXAj3NLE/+bBOsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514350, "uuid": "7c211396-a95a-4815-9637-d4ff3343b7e9", "value": 22922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514350, "uuid": "2c59733f-60a4-4ae3-87c8-9ed1c67db888", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514350, "uuid": "4cf92a6c-8e77-4b59-a542-b72fa5a28807", "value": "JUAL PO CV.SEMARANG INDAH.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e41aeb-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474147, "uuid": "2d91cf1d-860a-4763-b65a-5e7d7509eaf6", "comment": "Malware payload (Mirai)", "value": "221723bfbea08427586cd769c43065ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474147, "uuid": "0a0b380b-7f84-4ff3-bb3d-0a346b1bbdbc", "comment": "Malware payload (Mirai)", "value": "7351070d88ba2bddfc44f0aba506065fba845d18804d716a7a5c64cecd74e3cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474147, "uuid": "ffb91dca-4206-4ff9-908c-f1785d1753f9", "comment": "Malware payload (Mirai)", "value": "9ddc53e8adb91594d1f1a944137ef7d29b9397e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474147, "uuid": "1993284f-e885-45d8-8f20-6983ae0ab706", "comment": "Malware payload (Mirai)", "value": "8ebdb8935053c92f5145e5c1b40ee3913e20e9eeaecfe8f64b929ac2e69fe30ea859a55e0687fe9812660c35be9b58fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474147, "uuid": "76d20507-01d2-412f-ad42-58e97000fc32", "value": "T19433E807B94281FDC05AC174066FBA3ED926B5FE1338F1E67BD4B6322C95E215E19C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474147, "uuid": "226e6d50-0d5a-4260-b096-16342a5066d4", "value": "1536:+I9ZDyBGhPbbNBA1Exvpy5v0PYWmC2O6AOwV:z9ZeBGhPbZK1qBIv0PYfOiwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474147, "uuid": "6ecafc03-b6e4-45bd-ac16-d705fe6742e6", "value": 51008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474147, "uuid": "11e14d55-1343-4994-9cc5-9c2f6f3d413b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474147, "uuid": "c45b2d28-84bf-4fde-af52-3fed76d4cd43", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb39b937-7a71-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783476458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476458, "uuid": "9d56dcf7-05d6-4df9-9d1c-2bdd243deb68", "comment": "Malware payload (Mirai)", "value": "e0821c6c6fc42697e6ab4d1081c7e14c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476458, "uuid": "8c357549-18b5-409f-b65b-a67ef62dea10", "comment": "Malware payload (Mirai)", "value": "7433b8c9472586d713797a725388c7cad5c070311051a2355ce1f880d41f94f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476458, "uuid": "aaa14789-b83a-4e94-8136-28b9eee5d32c", "comment": "Malware payload (Mirai)", "value": "73b5b842092c01a4310958ff1d19d3f944145c2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476458, "uuid": "d5c92559-ea65-4d57-aad2-da3d64377a11", "comment": "Malware payload (Mirai)", "value": "1d570cd4bf110f615165b7ce65b81f45d46330f3438881b93fb92b865d66ca85792511596731c4bf14eac87769c6fc69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476458, "uuid": "bd00e3f4-5d41-4a04-a7a9-2640ebed2361", "value": "T1E8E2E19224D41D70CB71C431EFB492C7B6C22B3D8187A19B67898FF466FE9D809B8947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476458, "uuid": "b7795138-43f7-49e4-9750-eb7b25782d22", "value": "768:SZ+6GyLuOzsD5AwQhe4ljYaDTTqu79rXEJys3UozLe:SKawDq3he4ljYaHTqu79r+vzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476458, "uuid": "03bf1403-df37-4174-8d7e-ae97eddd812a", "value": 32900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476458, "uuid": "ef4d238d-8e42-4424-b3f0-e56ecf1904dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476458, "uuid": "c12cacbd-840d-4319-99af-00cf67e9e38c", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c439d56-7adb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783521718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521718, "uuid": "775f8d22-6ec7-4ab7-bfb2-2edc8dbbbb1b", "comment": "Malware payload (Mirai)", "value": "29a27a66f193d93f388d357a231ec6d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521718, "uuid": "d6b7bf34-92fd-4e4d-b83e-f78e397bd3f2", "comment": "Malware payload (Mirai)", "value": "7508551b726414a0c95260dc99de283846265f049a945004e1fe12384b62b962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521718, "uuid": "ba299209-854c-4a69-ab41-63f2768fe480", "comment": "Malware payload (Mirai)", "value": "6607599f220da64578fc3f3bbfe40e2a4cece5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521718, "uuid": "bce19b38-9086-44f3-970f-dc75ed62172e", "comment": "Malware payload (Mirai)", "value": "ea8832960318726f4c46363586a110ada2868aa94dcf5027b0c4b2b38e80d52af1f25869eb995ccc6ffba477bb01f420", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521718, "uuid": "bd9fe358-ddaf-4d80-ad09-91f6ed7016b5", "value": "T1D623F1D6417FEA3EC452E973444F4660EE3E9D0E2854C35B7EF822AC4FA7E4A5821E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521718, "uuid": "154697ad-915c-4e63-8a46-ca45071566cd", "value": "768:Z+an3RY7qKS4o2SeAgPBOAcLorb6T8/s/hOMBtE47fJmfHq2Bwyz21Dlix0Y+:53+7k4oZCAonl/aTE47BmA0aYx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783521718, "uuid": "fd463ab0-b2a8-4dc4-9478-fc0d6e6dbce7", "value": 49500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783521718, "uuid": "b3a850e0-f6ff-4769-8a92-84ca3e0e03aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521718, "uuid": "9c540a7c-6d50-46a9-932d-c6a988fd5d28", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849eab9d-7af8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783534322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534322, "uuid": "2674309e-2c5a-484c-ab51-c45f64063a25", "comment": "Malware payload", "value": "6395c85f575cce26c5e6edb185e93571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534322, "uuid": "67c1d70e-b189-4fe6-9cf4-99838b8e2162", "comment": "Malware payload", "value": "75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534322, "uuid": "48802015-995b-4032-aabd-0219d6d724a2", "comment": "Malware payload", "value": "d38d9e33b7f02d148d5a10b82c66e340771227cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534322, "uuid": "f2124027-a08a-436c-90c8-028be00cbcce", "comment": "Malware payload", "value": "ca9ea79f8f0a1fe47b0c3f80c9573e32dda1b364a62e82e44c39a50d39355af8374248ed38b3274bf71e7ae62f8e49b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534322, "uuid": "a6a73287-89b1-4762-9953-c2d6905db288", "value": "T1E977336C6A921588F0D7583BFDB3983F924338912B30458F9FE82D5639D31E1AD68763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534322, "uuid": "d8cf526c-5917-427c-a857-dc5a50acd4db", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534322, "uuid": "14687fe6-b847-4294-b58d-0d0874dad80e", "value": "786432:rPas/xJMheCMyXiFvW8w0u8W+NjlZcKAj7dzvVgax5q2j3W4cqwyi1sL:rPas/XMheC9yFvWOFNNB1o7YEq27WfLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783534322, "uuid": "40d7316e-6d02-4961-810a-8bf401f6c23f", "value": 32987525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783534322, "uuid": "da50d483-9bb0-4e4f-92cb-19a2f279c713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534322, "uuid": "2c366d0d-eef1-4897-a907-c40d9b5cd957", "value": "75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bdccef-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493223, "uuid": "8b764cc8-e901-4ac7-a463-b9056005df0a", "comment": "Malware payload (ArkeiStealer)", "value": "e7889be6d0e70b709b589eac13de9a34", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493223, "uuid": "79ae7fcf-1446-44f9-8d08-dcfc26752be3", "comment": "Malware payload (ArkeiStealer)", "value": "770abdea2a1560325636bb70cfd5c736e98c7d7ab4478fed43bebb87745898c4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493223, "uuid": "04fea275-4212-469e-9fcd-ca75f556e1bb", "comment": "Malware payload (ArkeiStealer)", "value": "9e5e39b59145405c2d5cee0883d66ec809e46a5b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493223, "uuid": "a233d9e7-8286-4d24-8bd4-b50e04475b33", "comment": "Malware payload (ArkeiStealer)", "value": "5b68d26cecd7edd3c7268c7cc7305456f2911ffe74548baf76200a986625f73b07b9ad91d310bf83113865609aa53d96", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493223, "uuid": "45e1f235-184d-4439-a9c2-8b995042890e", "value": "T1C4D58C076CE149E9D8A993328DB656967B71FC088F3263D72E8076782F727D08C35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493223, "uuid": "f20e7910-1039-4b43-8eb2-2c4234ca4d4c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493223, "uuid": "346ce925-3950-4219-9757-de90de2e264b", "value": "49152:Sbq6lnqxplDVnPTywbjaLruyzjkpfTOSG4P:SbJ2GcjCqyzjkplGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493223, "uuid": "2f457cdc-8c7c-40d7-b779-08fb7eb5e276", "value": 2977120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493223, "uuid": "7c8ccd33-8570-40d2-9296-4913b1126834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493223, "uuid": "e348c3c3-28ae-49af-8636-b1bd31a9e1be", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40321.32325.14584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369d5a57-7ac9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783514004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514004, "uuid": "ffe301f0-bef4-4eb7-a46e-7076dd64b32a", "comment": "Malware payload", "value": "010301d23beacee631006245ed09a2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514004, "uuid": "16459389-93db-4e7a-b0e0-431eae360b82", "comment": "Malware payload", "value": "794331fd4fd48600ebee0c579517f3a7122a87a2bf8e2da18dfc8d5d57c0da93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514004, "uuid": "49a0cfa4-df0a-4fd7-bab6-9fb4e3392ba2", "comment": "Malware payload", "value": "20f86e41741071d7257e945683c3f621fb14990f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514004, "uuid": "47d53fb4-4236-45e7-b8b3-812566a63ea2", "comment": "Malware payload", "value": "bb34e3f4a011c70467e5e3bd8226959950ba6bf087a2ad31b8761d0b67a72a64a8f9a1cfe70c552b01fd964896a02975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514004, "uuid": "4eeed9a9-7ec9-444f-89d2-33c0640c446b", "value": "T177876C2ABED578725BFED3939BD3CCBD8517500012633C9F298A17D88409BA8AF6315D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514004, "uuid": "21a689de-a833-41b3-83ed-655a78b931ad", "value": "d8187f161192b90088c3f9928cf2e9d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514004, "uuid": "7bdaf220-d567-485e-be31-ffbcafbedd91", "value": "49152:WDSD9r5Q3uUFve9H91ZemnWAIQUMzj8iNobZhT7caEw1r/:WDSD9d0uUF29duyehMaNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514004, "uuid": "89ef6751-b3a9-405b-abd9-df63884436e4", "value": 36052144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514004, "uuid": "ffa415f5-e814-4ec7-a67c-da70494db985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514004, "uuid": "f3c636b3-d749-4f8e-b23d-a96bb28d76cf", "value": "30-day European travel plan.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bccd07-7aee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783530112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530112, "uuid": "3e601ece-55e5-46cb-b269-e6d8cd358fae", "comment": "Malware payload (ArkeiStealer)", "value": "ee5b91b520847c7cc31876381aec321a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530112, "uuid": "05373e39-0450-4a1c-8d4e-2472e3edcee0", "comment": "Malware payload (ArkeiStealer)", "value": "7966d3e5e91e05b56dc716f2ec1f0e4cc854b421c1810abbf27941a8fabc3723", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530112, "uuid": "6f70b5b8-fba5-44ef-9594-c56c2dc03b82", "comment": "Malware payload (ArkeiStealer)", "value": "d77ef0f8538fa8615a29312d2174d16b1f28aeb8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783530112, "uuid": "e1380d06-95f6-45a7-92bc-f5f8600164b5", "comment": "Malware payload (ArkeiStealer)", "value": "aa7bc0006e506837f312baa88f96cd5e5965c8caad47feae22b58818f8294b931d26a6314ba1b1797a39482a8726ed53", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530112, "uuid": "3efe93a0-eb8b-4f40-b6dc-0c083b4f553d", "value": "T171D58E47BCD108EAD869533648B692927F74BC094B7223C72E90B6783F72BD09C7A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530112, "uuid": "ca21f4aa-5883-4f44-8fb4-29c9ddb8ce00", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530112, "uuid": "b92b2771-169e-4ca1-8a08-f0f1d5ccd414", "value": "24576:cE8wqCcGL6gVXWPHkzLfb0hLDfgLM4LljuhKwQfGPwHM4kIAdDS/N9rCtxzBeleC:cRwFcGLZVsHULjq1hKeTxde/N94zDuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783530112, "uuid": "90df4d22-a841-4d7a-9d3d-825bdf08c5c8", "value": 2956656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783530112, "uuid": "ee996cb5-352b-4503-9099-4adddbdda356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783530112, "uuid": "518273ce-2d17-426e-bfbd-b258113a10fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3da9167-7ae1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783524630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524630, "uuid": "2aa5b1fe-0360-4405-9713-c88be1c9cdc3", "comment": "Malware payload (Phorpiex)", "value": "e348ad1f1ecf437a64f424b6822970ed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524630, "uuid": "a70c01e6-b770-49cd-80c8-3c0d1c5e7807", "comment": "Malware payload (Phorpiex)", "value": "799be7a2d325faf175f7c4bb2af2129e29a5ef46aaf7d5f46ff2ee89c2647ed7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524630, "uuid": "c820595e-f62c-49de-a06d-ca1adc01d278", "comment": "Malware payload (Phorpiex)", "value": "9a45e99e3f02b437fcce44159be70cfd749bd408", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524630, "uuid": "c3ec8958-342f-429d-a121-ebac64682da3", "comment": "Malware payload (Phorpiex)", "value": "5e44abd66a145e1bdea0d567974dff8cd6166bd94d5aa2ace9d4875bf2d368cdc97908748213f4718ea8b72d871f668d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524630, "uuid": "820deaaa-ebef-47ae-a296-b77681587f94", "value": "T115825B0FB9424726C0E110B49676873BDA786872338854DBFB944AED0B686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524630, "uuid": "98babe13-2dce-49a8-8248-450c8805795e", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524630, "uuid": "9c626c6b-30ec-4d7d-9f85-83e5ed2b20a1", "value": "192:QaISCngTBvqQ1jV6lXwIXZ5qF4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdEFWEo/G+:YIqQlV6lOF40uu9JgFtfUhav8U9cOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524630, "uuid": "274606e7-0797-4d9b-b3da-487afd8772dc", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524630, "uuid": "9d7fa3c8-a8aa-4004-a534-d6774a3d9c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524630, "uuid": "3bcfe0e9-6ce4-4ef3-9c9d-dd00874f04a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb77bb5-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493263, "uuid": "9caede0a-276b-4c7b-a17e-c7a9bad372a1", "comment": "Malware payload (Vidar)", "value": "774a0789d874ef3dbc84e5840bd72e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493263, "uuid": "6a55adaf-2efb-4c0d-95e2-ba30c9078a66", "comment": "Malware payload (Vidar)", "value": "7a725b6b4151e23675f5cfc9d8077f83f3a7d837f2615ee6646461f0d21b7cf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493263, "uuid": "1e077a86-580b-402f-b1b9-2db1b058d75e", "comment": "Malware payload (Vidar)", "value": "70eb0518d5588f82f9f7dadb91f8104b82a44fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493263, "uuid": "bba5a199-a61d-4b8b-a267-a60b8dac1a08", "comment": "Malware payload (Vidar)", "value": "0ab811199647d2bec49954bb480340ef26d92d1f22869be59552d362ad999da086231d799904d1bc1aa1e19e2c510507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493263, "uuid": "e7bbdba0-1019-4d99-9b9c-441be5a531a7", "value": "T184D59D477CD009E9C496A23289B742963B35BC590F3223D72E90B7782FB67E09E75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493263, "uuid": "98a83256-cfa9-4b5a-bd26-9ba144a86dca", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493263, "uuid": "7f89f35e-0f03-4d0b-917f-fd5bdee0ea94", "value": "49152:mSqdqh1MkTB6N4NZuXoVOLgHPgoWje+W9kWy/E+agtGh:mSq80mIxQIoWK9kWoE+aOGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493263, "uuid": "995484b1-36e9-4c5b-a9be-168defc1c42e", "value": 3017080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493263, "uuid": "edbc2b26-1da0-4a3d-99fc-92e2431b0a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493263, "uuid": "a409dd89-68ab-4ae0-a050-0cdc65ee7d0e", "value": "SecuriteInfo.com.Win64.Evo-gen.57454152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a9d0ad-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783537387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537387, "uuid": "463c3f9c-0424-4985-add5-1edc9fa45d0e", "comment": "Malware payload", "value": "e835097cb569c3a1e55c52088a8e17b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537387, "uuid": "a0dd1685-6d0b-40d3-9de4-23053070ef2d", "comment": "Malware payload", "value": "7b118c32e261265adfa19e811de28f0c8be1593762c98bf8a74626c7345d2817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537387, "uuid": "89000400-a9d4-42b8-b938-2316ec785139", "comment": "Malware payload", "value": "2db4aeb65c105f8b88378f1617f46a2f51f3900a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537387, "uuid": "46551435-fb7f-42e8-9b23-78c1718da6cc", "comment": "Malware payload", "value": "38e65271cedcb76a49341382691a10b6cb4c2e20052b13c2d256fa59d90baeb6e70e6e5352000c1cf1a6c2bb517f5f89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537387, "uuid": "d915dd5a-2b7c-4de0-87f4-1e20e4099195", "value": "T1A2833A95BC81AA16C6C52777FA5E42CD372A6398E3EE3213CE255F2037CB41B0E67541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537387, "uuid": "a7258322-b344-49fb-a933-f7815bd29056", "value": "1536:XF2TPF0ucF7Idwsn0wybuyj77wADut6sGc/+:V2xfTw+E77W6Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537387, "uuid": "fdd2f426-7f14-4556-81b2-9a0d69d71a92", "value": 85024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537387, "uuid": "8c193f54-b37b-4311-8842-c41fae420767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537387, "uuid": "92601f8b-4e2f-4951-be82-eb408a1229e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8233e967-7b06-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783540330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540330, "uuid": "20136323-ec59-4503-a26b-238590f4a133", "comment": "Malware payload", "value": "93c87bc9c7e9f13e54aa820047ec0f46", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540330, "uuid": "efe8f575-e629-4147-9fa0-f3d518defc04", "comment": "Malware payload", "value": "7cfeb141c17660f3e1b1480c1ed4e24420424f69bf79634e69abcca725222d9e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540330, "uuid": "923fc7eb-b748-49d8-a05b-dd75c6576157", "comment": "Malware payload", "value": "00a2cbaefe4e0a9eb80a62c33adbc72ceb14c98d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540330, "uuid": "08f160d1-43ce-40ab-a907-72ee04d8a909", "comment": "Malware payload", "value": "6b229f6a5c444d464cbb52b7f6d0b9d08a86dc08a7af92e0d3c5faf3c3bd1c82c465d3fd3c217a7d53ea8d95bae5b56f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540330, "uuid": "010ebca4-ae18-4a03-991d-2b192d322e86", "value": "T11AE6339897D016DECDB3903DE8D21492F5B8F4720B72C28F57688772AD1B1E295383A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540330, "uuid": "750f61b6-6603-4e9e-9fcd-dd335336eff1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540330, "uuid": "f443ea7d-b25d-426f-9736-cf1a8fadb10d", "value": "393216:ncfQJJxUz4rfAMY3qXMCHWUjXPcuI3/PGTAI:n5YMY3qXMb8XEH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783540330, "uuid": "0674564a-c272-453d-bb4c-26659d362ca2", "value": 14329311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783540330, "uuid": "57d58fb3-ef71-481a-9ed9-68e8aa61e251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540330, "uuid": "fa30eca2-2910-4a33-9665-9f2f5a0844c6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc2b5e7-7a60-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783468896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783468896, "uuid": "06c29892-1415-4f2b-b88a-cd8e5abfc1c2", "comment": "Malware payload (Mirai)", "value": "5d6a68bbe5aa2cc3fc42c2cd6ca4ec2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783468896, "uuid": "39e30879-ed39-44f7-ba02-dd663862d2cd", "comment": "Malware payload (Mirai)", "value": "7dcc39a70a58be7899ca6d3fbcbd7aeba3e6665bc38a7a0125e9fda5d84dee0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783468896, "uuid": "ae4a0eb4-05c0-43d0-9219-ba8852f6ed8b", "comment": "Malware payload (Mirai)", "value": "0325ed308e42589be8285a14da1a5deb6738a66a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783468896, "uuid": "06c4bf27-bfa1-42d1-9ea4-cfcabb8147a4", "comment": "Malware payload (Mirai)", "value": "dd334e0dc1fcd2170c12543db75696ee605ae307a1d646f4dd85562a0a6d60f00b72869c2b01b91abdcaa682f1717b93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783468896, "uuid": "d11e919d-778b-4ef4-9e31-6d3bf5aff8a1", "value": "T18DC32B56E7414F13C0D61779B6EF42453322AB9493DB73069928BFF43F8279A0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783468896, "uuid": "1ab85d1c-4863-4de7-b642-30b7867f8fd7", "value": "1536:OOn3DydtUaywqQ690Ll/ThemKw4kTWaNle5iQr2NVL8lx8HWZOWOkpUc6zw/9aHY:3ybU7v+ThemKw4Lvr2N+lqHRW4M/9GAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783468896, "uuid": "924ac928-9ac2-4d25-990e-d5a5c40875b4", "value": 127418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783468896, "uuid": "bfe139a9-a588-4bcc-9f5e-2dd4e4dd3f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783468896, "uuid": "f4a858e5-30b7-465e-9a9d-4229b667a09f", "value": "SecuriteInfo.com.Linux.Mirai.9816.6486.20935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4ad656-7a62-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783469774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469774, "uuid": "af8aa44a-1842-4dae-9b49-5efe0849351b", "comment": "Malware payload (CoinMiner)", "value": "caec665edddcc92a1c70e8752ad2a03f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469774, "uuid": "2ef2e597-cae2-4592-9650-046214261aaa", "comment": "Malware payload (CoinMiner)", "value": "7ddfafe75d3b360530299abea5838bc26d6430be756030e1b9cccc2ec5fe4134", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469774, "uuid": "6468c9d0-015b-4e98-840a-bcdadd0e15eb", "comment": "Malware payload (CoinMiner)", "value": "670e253939e2797454418f337b535690e0b6690b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469774, "uuid": "859f36ce-7f52-47df-b7fe-f4cc306ed144", "comment": "Malware payload (CoinMiner)", "value": "af17ce255d03c2fb0470124b9cac4ab1a14a7ebfbbc39256769d2a0ce2ca487ebf4c6bb5b16a850ab77b61a9febf6626", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469774, "uuid": "cda8b91d-abcd-438a-81c9-a9a52c1fd7fe", "value": "T1AE3209197E494331D3A089F85479838BA53D5633E7C3E3EBF373965E4A962448840EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469774, "uuid": "425f6add-7890-4f68-a782-b7526a2745b0", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469774, "uuid": "585ea067-05f6-429b-a619-34dd6df55f06", "value": "192:rnomWEzBa/Vx+eTRHj5PFJxTEZmFhSac:rno+w9w2lPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783469774, "uuid": "6177141a-305a-41a5-9cce-7a395ea7b57a", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783469774, "uuid": "b4553ebd-8dc5-408c-9c72-d9dd9890ef87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469774, "uuid": "5919cc81-91e0-48c2-886f-8820c9e57d40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f001ef6d-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473943, "uuid": "29ca550a-c0d4-4151-bd83-27995355c355", "comment": "Malware payload (Mirai)", "value": "c2aa9abbdf7a03ab53f37c077f61e7d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473943, "uuid": "9e76a8dd-8928-4b1f-995e-43cb112a2fe1", "comment": "Malware payload (Mirai)", "value": "7e1c84a430b802180aff2c1e2aa1eca1bc5361f9040c5eb801b34b3517aabba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473943, "uuid": "8369cddd-0d31-469e-bb43-012304d23e85", "comment": "Malware payload (Mirai)", "value": "65904986ded7f8135fc7e5d0cf0f4af1cb46a068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473943, "uuid": "869d63bd-f187-4a3d-b097-a385ab120621", "comment": "Malware payload (Mirai)", "value": "5020a2b78c7aa69b6ad238bff7d04e3466a6fe0fd07c453dcf510413304f0e3fb8e1235e75b492f1db1f0f042e3ca3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473943, "uuid": "eb6205ea-6ea8-4e53-9731-99e41de83ebc", "value": "T18F541916AD419B02C1D116FAFF6E829A33173FB8D2DE3112DD246FA4378A49F0E7A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473943, "uuid": "dfea323d-992b-4ed0-8bad-dd3010b13fcd", "value": "6144:++/xamiWDaapJ02VxEhWCGNnntX6F7x5af62GZoA44PNWUu0Dv:BV902Vxmb8ntXQ5afeR44PNRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473943, "uuid": "f8c6911d-21b4-46bf-9aeb-897f618922d9", "value": 287260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473943, "uuid": "030e8090-bd60-4f61-87fd-c457c2b4d92c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473943, "uuid": "477b7f54-b6ee-4891-b439-7cdfdf1c1b7c", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb617f0-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493268, "uuid": "feac4489-fbdc-4b9c-8f19-789faa15a86a", "comment": "Malware payload (ArkeiStealer)", "value": "ec604e13ab8bebb1708fc64caa7096a5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493268, "uuid": "a77b22f6-802f-4ffc-96b6-226ff88bf65b", "comment": "Malware payload (ArkeiStealer)", "value": "7f5004c33185df5e036ed42d6d3e2f7933081a562a1ec3795ac173b968383b80", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493268, "uuid": "4dd22235-4336-4211-b38a-a83007f7027e", "comment": "Malware payload (ArkeiStealer)", "value": "5e146bc72131ddf57bdd0e8bb5cd39a32748ef2d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493268, "uuid": "3b2db46e-5460-4b33-a755-2d2d48271385", "comment": "Malware payload (ArkeiStealer)", "value": "f7f4242d581f73b15d69ad40894188648f7b959ac8831642d2df6f5c14adb1b6cd18abbcf8264ef04fa0e2e4206f0427", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493268, "uuid": "92db465f-c7da-49a9-8ace-7288a9397b2c", "value": "T1E8E57B07BCE149EAD4AA923289B752927B32BC080F3663D76E50B3382F72BD05D75745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493268, "uuid": "ccab7a93-03c3-45f1-ad1d-95c94cbb6746", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493268, "uuid": "ac2dd605-844b-48d1-8727-b0b60fbc1b52", "value": "49152:WAOs+RrtG2Av3hW0G62VufKtFn5K6WNwGgb06tNkeKxP7g8:WAWVn+ONV2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493268, "uuid": "43deedb5-360f-40e8-adb4-b8f95bc2ae86", "value": 3089760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493268, "uuid": "ec12fb67-cb12-43fd-8746-ed31a5652fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493268, "uuid": "7420c3ac-46b9-4bb3-89ef-0d3f17a2f20f", "value": "SecuriteInfo.com.Win64.Evo-gen.25158421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9859b9a4-7adc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783522329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522329, "uuid": "fdded3de-b6f9-4ce7-a7a6-42a142a1692c", "comment": "Malware payload", "value": "fcdf6dff0cda535850b15e5d371cd477", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522329, "uuid": "06087cdd-8936-413c-a517-bbecea634f6a", "comment": "Malware payload", "value": "7feec5c841cc32460cff16d21582701e843d9dc6c009db85457fc030e35f7fd5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522329, "uuid": "9fc1e05a-902e-4903-84f4-550a5fd77cb8", "comment": "Malware payload", "value": "e669e4baf81e1a7d9c791d2c9171e98dbc12beec", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522329, "uuid": "815b9ad4-b3cb-4a3b-a6a3-f957747baa13", "comment": "Malware payload", "value": "a35efeef39a165b72c0794aa8ca602dc8aa5121572c3659e088ecb261dc777df0e058a227ee6c29d460b7b0bb8c04918", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522329, "uuid": "79730efb-8c01-4ea5-a2ed-4d0f5d675786", "value": "T190E6330E95D153FED5A29039BEA19619B1B5B4B20732C1CB0798C3A87E672E0CD3D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522329, "uuid": "20988839-dfb8-4da8-9d62-d9b0495853b0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522329, "uuid": "dd4e03cc-1ddb-4386-9361-8412b48a7a53", "value": "393216:xwoxOtWXrDo2sFCaUmoWVXMCHWUjXGcuI3/PGTAI:xwvqtscbmNXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783522329, "uuid": "5039dde4-1c9d-4fb2-821b-e90747bb1928", "value": 14320454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783522329, "uuid": "10292846-c23c-4871-9c9c-b6e361f24099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522329, "uuid": "03d54c45-0912-46d8-b94e-c6c56d278d00", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49118c8e-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517042, "uuid": "fc1fbb0f-6675-4ecd-aba1-fc16989eb99a", "comment": "Malware payload (ConnectWise)", "value": "49ac80785892aa2b4439f16be01f3e19", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517042, "uuid": "573bfc43-7370-49e0-9d24-c6428aeec139", "comment": "Malware payload (ConnectWise)", "value": "8012f85333babb85f8d111f3dffcfc71b83a8aa5269b6ff301063712492e5f76", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517042, "uuid": "312694f6-444a-4c5d-8a6e-c07d31aedb67", "comment": "Malware payload (ConnectWise)", "value": "97d271ae9ec9eee6cbceb8c1a1e9053cf2787b97", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517042, "uuid": "95adcdc0-b820-4d2c-aaea-8ebced2e2995", "comment": "Malware payload (ConnectWise)", "value": "d92029c64619abd77a7da0bdc85bcbbcabb7b440e8d3ca8cd4c91e7af1281569b25f3296a0caf862beb46798e3455abb", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517042, "uuid": "41ce40e7-e193-426f-8707-c0b520190e54", "value": "T10AE022272065D5748AB288699ADF57A2A226F490E737004234774020FC082DF82ADBC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517042, "uuid": "6ab20fde-8185-460f-b355-c395a8fcd6aa", "value": "6:hSG81R3KbQO0cbadb+QD4V7tZZ6dLBIMFIYTFCa1A3CFSBLzLpLyE/BB/i:0G81kbQpcGdqQDi7NUIMtFC+A3CQysB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517042, "uuid": "92ef636d-3f4f-4f35-a98d-f8ac2b17f3af", "value": 405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517042, "uuid": "147f3277-47a5-45d7-b26f-fcdb246bfc36", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517042, "uuid": "4e35b458-3ecd-4795-b9ca-72b663e0a0d5", "value": "run.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2423699-7ae9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783527956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527956, "uuid": "51c097c7-84fb-4fc2-ac5d-878d0751229d", "comment": "Malware payload", "value": "be197379e8546991e064ae7f7ae2c2fb", "object_relation": "md5", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527956, "uuid": "b4c273c3-5a94-474a-9119-dbdcd1c1fa49", "comment": "Malware payload", "value": "817dd50a5f00a50c9dd6645917a92ac202a144f8a393750ecf237f1948d075d1", "object_relation": "sha256", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527956, "uuid": "b8edcfb2-e6ac-44a2-8016-f740b2bdafd7", "comment": "Malware payload", "value": "e868c803be0efdeb669be22fc100d4b81b9efb37", "object_relation": "sha1", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783527956, "uuid": "0b3cee32-1cb4-4bdb-8148-4e1bb1e8d655", "comment": "Malware payload", "value": "fe97bd3a04280d615a66c40a076b2d7c83a1e76110e397f01bfd733fae7ad2a859b49700f490bcf17d9b45824691d5ed", "object_relation": "sha3-384", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527956, "uuid": "af1bdc84-8ff7-4679-b5c3-6e0d8c108de9", "value": "T1EA4102CFF96596288187C67403901D1EA58286B7042984B5FF9C15C83F64BFE26F03E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527956, "uuid": "2195d7a8-a6ba-440f-82f8-789de0038370", "value": "48:bQVaquzMBAdwoUcGH1uuz0HZadCAhc8K4TmgUlxkdM9XycY:b69AdEH1VBNa9bkSkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783527956, "uuid": "6c0684e2-25ef-476a-acc0-012e18ac5d21", "value": 2235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783527956, "uuid": "5912f2cc-fc9b-45ab-a9a6-d59fabae3831", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783527956, "uuid": "f01d39b7-1358-4bee-a8fa-09ee9338e038", "value": "Intel(R)_Security_Driver.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffad15a-7ace-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783516436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516436, "uuid": "21751d10-e2eb-4110-aea1-5eed8df271a4", "comment": "Malware payload (Mirai)", "value": "fe5488703baf1b8f9017f17e1b173bce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516436, "uuid": "ba0250b9-c6bd-41a6-a352-e3fb2bb116f7", "comment": "Malware payload (Mirai)", "value": "82a7132d24dda9ef4a6e165926a9f0dc6d0fdcd70b064ad21eaaeb66e8da8268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516436, "uuid": "c07262d5-2b3a-4ce7-bdec-17e37ca07e01", "comment": "Malware payload (Mirai)", "value": "b9f249c20380dc0eef6431c6b2769e6bf69651ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516436, "uuid": "735a85fc-3213-4fc8-9a4c-d6f5a20aa693", "comment": "Malware payload (Mirai)", "value": "c58f91b4a6acd001bec3131b0a13a5643fd4d6eccc6249905f673cead68ac6426e976ba09252d6aac68c89ccd8d103ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516436, "uuid": "5fa0f46b-6ae6-4750-9697-a0be8d89ae99", "value": "T142430786BC82865689D423BFBD7D41CD331273B8D2DF7102CD145F18B6CA94F0E6AA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516436, "uuid": "7b99641f-9c73-434b-ae96-dde99acc0feb", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysb:T2s/ITo7WCkybotgsJ913Dhrbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783516436, "uuid": "9f78db2f-9b5b-4aa3-b0e2-893c341cda0b", "value": 56800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783516436, "uuid": "bdd8e99d-de0c-4fe3-b133-cb7aa6870827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516436, "uuid": "ad20fe3f-c856-48e8-80e2-0c5ae58f408c", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c249d3c9-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537432, "uuid": "5b6301e5-292d-4b89-9445-db8f473945f5", "comment": "Malware payload (Mirai)", "value": "cfaf5cdd0deeba609c2eccd6d78b1988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537432, "uuid": "60aed6d9-d9d1-47c8-9fc1-5596b2331c62", "comment": "Malware payload (Mirai)", "value": "82cb5dfe51d3f66119dcb4340b4fabef0ce6a2a4da226f89be1b85443aa2ea24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537432, "uuid": "8ecf92a1-5375-4624-8e5d-9d8dfe4a1d81", "comment": "Malware payload (Mirai)", "value": "b9cb008d5b846521e7e36dc147584619f29d75aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537432, "uuid": "8d304572-6456-4300-8c96-388212f97ee7", "comment": "Malware payload (Mirai)", "value": "e1f985fc3bf968f3269c9e6f786c6b7aef5c3d7c000ec05272e1b9e17a922ac7fb2530ca93aa867a16cc3c478f6f67e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537432, "uuid": "3849dd0a-51fb-4536-b107-e0174ae41809", "value": "T1C7431881F44B42F6C44B493050A6F63F9F31D99D52B1CA1FEF99AF36DA67942C102A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537432, "uuid": "9c3d574d-f18e-40a6-91c2-fd43f17fd02e", "value": "768:8Bdyf/BW2RLyzIOhAN1UEct8jHJ9cehGC/Cu9TBjU09Tuh5c49ga6hXMNqZu6PUg:mylkIOhAN1vi8LDcehda6JMNKuqOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537432, "uuid": "67806737-90ca-4b88-9126-62e0eccdd062", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537432, "uuid": "09476b38-3191-4de0-84e7-4ebd42ba31c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537432, "uuid": "6f71ba4d-ee79-4d24-9b76-c623dc335df8", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fa04f7-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493218, "uuid": "5872205c-9548-4ebc-a1c5-328f1c250342", "comment": "Malware payload (ArkeiStealer)", "value": "4b657b31a143787522f9e9a212ecf580", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493218, "uuid": "653bd43d-4a27-46a2-84cb-be64201b017c", "comment": "Malware payload (ArkeiStealer)", "value": "839dc73d9bb3f3562ea39c5faf41d8908cb9f52a4f9d7cdf005a3f3ec4d58dd6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493218, "uuid": "bab926da-e594-4f8b-936a-02d56454f353", "comment": "Malware payload (ArkeiStealer)", "value": "e68e120c2d751c1c7d4c482e10ef798d1b89a9e0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493218, "uuid": "8667fa93-5db9-4e66-af12-e75ff69b6e0a", "comment": "Malware payload (ArkeiStealer)", "value": "6e3308e75a836137a78ea376c48ef5931132ad541e3a30cb537afe37156f1091f156fcb963fce1e6707c24c53f1f43c5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493218, "uuid": "cec076e1-e922-472b-9748-bca3e8c0a934", "value": "T17DD59E0B7C9048EAC4AA533289B656427B74BC594F3223D72E90B3783F76BE16D39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493218, "uuid": "a8b4db6d-c880-4191-9884-2bfd5287bff6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493218, "uuid": "9e5798fe-c405-4701-83a7-350ced26230b", "value": "49152:9wTrifD6hZClDGhxRzoM232dN9l4LbtwmjX1:9wKx1GvRncZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493218, "uuid": "344476ec-0275-433f-bfd7-95dbe559b149", "value": 2891640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493218, "uuid": "2f1f55e3-b330-4bc1-b1a0-d4c763a7317b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493218, "uuid": "90af5143-648a-4054-86a9-9dae2e20664c", "value": "SecuriteInfo.com.Win64.Evo-gen.66331732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf23a9fc-7ace-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783516408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516408, "uuid": "88d9e677-b607-4bf4-bd9b-26bddd4dce44", "comment": "Malware payload", "value": "6590da17d7f066c810f6927617771688", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516408, "uuid": "f0d67f6a-fd3a-40fd-a909-2869d532763a", "comment": "Malware payload", "value": "83d8568493affb4fb28d7337025af2ba44c5c174fb4d8403f3c31cf3584ca4dd", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516408, "uuid": "2952589b-e921-4a44-9e2c-0221b590a0ae", "comment": "Malware payload", "value": "65da5d1c706a5f771a90199dbe95b81fd1241c41", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516408, "uuid": "51277e7d-194c-409d-8901-b4a510a369bd", "comment": "Malware payload", "value": "5c3a047a854cb2b3defdefcbabca2ef9cc929586c9d7119cbbe827d1f77b9aed3fcc9a2f3b8836fcf34c6fe5ce96bab1", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516408, "uuid": "c50375dd-436f-45ab-b4cb-da98620f792e", "value": "T175C64947F8E24894C8B9D2B496358227EB34784D1B7A33DB9790B6702F337E09576B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516408, "uuid": "128c562d-da25-4382-855a-24b9b6842d02", "value": "98304:fZIcru0e6drG53JFs6xA6tdskLzZoTP7AHbgKqQv8ExpKbPC:fTr26s3s6xAEskL6TGbguxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783516408, "uuid": "380f8828-11f6-4574-80e6-b7407e89049b", "value": 12460176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783516408, "uuid": "1f2560a8-9b4d-433d-ae54-8c1b5c2d1377", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516408, "uuid": "88853812-62ac-46f8-9821-9201e1a5a3f6", "value": "83d8568493affb4fb28d7337025af2ba44c5c174fb4d8403f3c31cf3584ca4dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6144d8c9-7b00-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783537698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537698, "uuid": "4ce0acbc-9e4e-4608-bdc6-6be6357458f6", "comment": "Malware payload", "value": "effc3ebe1d02f109eddd66ed27865f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537698, "uuid": "3b6b35e2-144c-44ce-9b72-830779d374d4", "comment": "Malware payload", "value": "83ed44068b1fec44e77dded6511f9f308b2d818c78780a0cb6ded293bcf88e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537698, "uuid": "e52febf6-8729-4512-a244-773c298106cb", "comment": "Malware payload", "value": "820309e3b9c371382df1c68036e08e9d21ee02a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537698, "uuid": "45a47415-4a02-44ec-9f22-8e3519135a29", "comment": "Malware payload", "value": "8336ad03d3f3a4ae0c70f6c85858d7932a5a48d35dc34aea34f1b6ae82ab63eb50ec8521e48930e855020eda9b23824c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537698, "uuid": "b273a6c0-9d71-4770-aa76-cbead7e14a76", "value": "T15C85093A8E7B485285BA29728F997564C1E01CBF1CFB043B74EB02801FD2D36C946EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537698, "uuid": "ebf284a8-aa42-469c-bed2-643698e4b1f2", "value": "96:EWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDWDW:jk6NBi3sukWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537698, "uuid": "fbfb31ba-65db-4368-b6d4-b6c3731aabdb", "value": 1788451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537698, "uuid": "6457ba5c-1e9d-4f21-b327-e1ae561e0dbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537698, "uuid": "75ef7ebe-b9e3-40f5-a733-de2452b58975", "value": "DOCUMENTO ESCANEADO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a315206e-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783475532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475532, "uuid": "f6add5f6-7fe9-4ef6-9863-ea33d98c6f3d", "comment": "Malware payload (Efimer)", "value": "c054e4ac40efec39798d76fcdfae45a2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475532, "uuid": "1412b598-b62f-4545-85ee-b9f0ff73e217", "comment": "Malware payload (Efimer)", "value": "85752e86ea189634b042f5bb296f4fe0851a1a71ecd3a8228110740fff89f4bc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475532, "uuid": "a357c6df-6cbc-4e5c-8845-d2ccf5db06f5", "comment": "Malware payload (Efimer)", "value": "8c80bf39118b8533ad972e370922dcebfd931c33", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475532, "uuid": "03c1e43e-50a9-4f20-b873-33f9038b4246", "comment": "Malware payload (Efimer)", "value": "c05b3f1114df2d3c018d6b4621c7d0dda78b68a8457f7eb2c6e35761ade59866f53148bac3421b2c808a74542baef102", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475532, "uuid": "77bb959f-b24e-4dc4-9588-ec6205c02bcd", "value": "T1F5E633546BE012FED6B3507C6DD295A2C5B874B30732C98F6B18E7E26E672A00D3D613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475532, "uuid": "6c160eed-2825-4893-9787-c7b0365c12a4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475532, "uuid": "d2143b8b-ac46-4a2b-989b-a720839fdfb6", "value": "393216:TA+pn1t5R0dw4KZQMXMCHWUjXrcuI3/PGTAI:TlVb0m4uXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475532, "uuid": "2263b59a-ec6c-4229-9245-143c0b4761c3", "value": 14301555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475532, "uuid": "3d64ff34-6d59-404e-b45e-c119864f89c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475532, "uuid": "0b79eb2c-1f17-4123-bacb-238fddf630c4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84736c51-7ab8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783506833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506833, "uuid": "92f2240a-f0b3-4c99-9c4d-42017f00dd5e", "comment": "Malware payload", "value": "2787c4d72b15a09933516342977cd478", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506833, "uuid": "a419854a-5684-4824-9c9a-10d065a03a1b", "comment": "Malware payload", "value": "85a26196e60b87ba5e60acfb2a0e91936fa0ad16ffa74ae82d607975a8c97a96", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506833, "uuid": "9de59f79-0891-405e-88c7-3bda17a16f46", "comment": "Malware payload", "value": "a35d3eac754f306a5ebfe5265004775419dfc7cd", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506833, "uuid": "dc54deed-011f-4c46-a240-e84eb0ae6481", "comment": "Malware payload", "value": "8f112f61c69d03703c10f8d41757140d5dadd1b908b5520393b5a13be6c0f462201b2d8e867da5b5703664e9e067c4e6", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506833, "uuid": "4fd55a30-5ed9-49f7-8772-6ff24755bd4a", "value": "T1BBB4025239C05B42E6446A79C1E3A83913F7BC8B33B3C7453D1657DA1C223E0DE9AB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506833, "uuid": "882ff38a-18d1-4bdd-9620-01cef4207f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506833, "uuid": "81877b3f-041b-4015-a21a-707f0b947af0", "value": "12288:D10EVASORK6dWRio29I2BBEtTBS6onsgDeIJNTU1CeP:DnmJRK6dWd0tctTsnEONTU1Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506833, "uuid": "7da25fc6-d7f5-48c8-bcb4-7ec59ec6fd08", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506833, "uuid": "f0746edc-f336-4b66-8866-2534fa27b387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506833, "uuid": "5752e66d-aedd-446c-ab75-cda9ea4ff7b8", "value": "85a26196e60b87ba5e60acfb2a0e91936fa0ad16ffa74ae82d607975a8c97a96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18fe591-7ad8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783520734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520734, "uuid": "47418639-87da-4f2a-b5aa-dec86e9c0045", "comment": "Malware payload", "value": "949cf5177d3cc913cd3cc38c81abe5f1", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520734, "uuid": "0e3f2514-402e-430f-aa5f-8deb5ee242e0", "comment": "Malware payload", "value": "8632f4bb4e3fe4b3655476fddaf128f26cbfe0f0b9ad96c8a1ce27e9ba19f95b", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520734, "uuid": "8663ee7d-2f74-461b-ba4f-8f4068b5e0a4", "comment": "Malware payload", "value": "663ce6a73a98e8e3f6216313bd4d65c999931b5e", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520734, "uuid": "cca25ad5-476a-4f07-b573-1b730e4da24f", "comment": "Malware payload", "value": "4e748f66fb30802b884f94dc68990c248382ed7051ff39f8021b51e98aae0e2f49c301a88624c8063b36e1ce52a8fa08", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520734, "uuid": "00086d99-008f-4613-96d2-80db643cd4fc", "value": "T184E45D60AE0C6426F7CBF0BC8F4906D2711B38BC5B24D1A7312B451FD7C1BA966967B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520734, "uuid": "205bc088-b4d6-4375-bb3e-d6ecb140c5d9", "value": "12288:k7o8RbxvQDEH1QhgwNR4BN0YHcVtWj+HOPDEU/v7vwPkK18Ey2rq2EwcQPWaNm:k0i1EO1QhtYvPD7vwcKeOPWaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783520734, "uuid": "e68ea606-56b6-4b55-b519-fbd6946886c1", "value": 679848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783520734, "uuid": "06586897-0d42-4a3d-9a34-88386f4e042f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520734, "uuid": "523e7a24-f0b8-46df-9a76-df38d8af5d0c", "value": "v00lk.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dd3ac8-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517031, "uuid": "58a3d0e0-b952-4ce0-89f4-04b01313a914", "comment": "Malware payload", "value": "92c9dc3ddb4ba1002d81f4b27cd58d01", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517031, "uuid": "29133527-e5b4-463f-96e9-1085c2156b3b", "comment": "Malware payload", "value": "865d0e0d689aa45461d13c5cdf6cd270f12d52112bdb20895e5bd47bfaf751bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517031, "uuid": "51bcc1e6-e723-4000-99b4-afb87381ec51", "comment": "Malware payload", "value": "53eee43e569fd138539c2dd53e95c069fa343197", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517031, "uuid": "8c20b670-9238-4ad3-ab32-d7e0a0bb563d", "comment": "Malware payload", "value": "1fb2a6343f9bfa243fce59812e96ce9a6cd3c517daf2f6a3dd63cf42373cf036a987288a45160f804c728200ed6c3d97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517031, "uuid": "8e0f6a59-0969-411c-a8a9-b3849e48e616", "value": "T13991DD927C61B0B47E4B40294BBB6146340160479A253C3D36AF65160FEC7CA72EBEA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517031, "uuid": "c0f005fc-60e2-42fd-bd18-edee278f3327", "value": "96:D1FBq9CK31dh+RBWEuK8lKt8Tzff8iVtRB:hFBmKtofV3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517031, "uuid": "b963abbd-b9f7-49d5-8396-987fac6b36f0", "value": 4340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517031, "uuid": "d2e78230-aa49-4357-bcba-ce0e3637d33b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517031, "uuid": "d1f13b10-b637-4a41-9c67-b7a497d7278f", "value": "bot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892d00b4-7aea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783528316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528316, "uuid": "88a76673-f01d-4dd7-911f-d98780052ab6", "comment": "Malware payload (Vidar)", "value": "c6da85645488cfbb1120310f837f7fc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528316, "uuid": "15faa624-32d0-4099-a3fa-4308132a03ea", "comment": "Malware payload (Vidar)", "value": "86f77feba22ad9641d9464ac07c0fc4c2657f62cf02b85bdb50a192980265ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528316, "uuid": "3324ad14-f4bd-48ab-afcd-cf87c03c1c5d", "comment": "Malware payload (Vidar)", "value": "c43ca244dc9905ea3260dff1e7c9414dc3890b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528316, "uuid": "473ba13e-17a3-4882-982f-e43eceba12cd", "comment": "Malware payload (Vidar)", "value": "bfe70dbffc1d07f08ed041caea17e1df0bf9fd23d353843929627c593e0dbb9fd61c1b2d6ec400264f4e175df7d22085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528316, "uuid": "ca5bb6e3-c44e-4f45-88d2-2287e277dc5d", "value": "T193D59D477CD009E9C4AA67328CB652927B75BC094F3267C32E90B7392E76BE19C36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528316, "uuid": "717bd26b-3da9-4ac9-87b5-7dfd4645f0e5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528316, "uuid": "15762602-037d-443d-8c7f-45e1623ac7ae", "value": "49152:bZ+OcETV1p2qvrm4NWe+423JZR6f0onzFn:bZsooi25OTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783528316, "uuid": "382be2d2-3596-4741-88cc-ac528e9c781b", "value": 2952048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783528316, "uuid": "9af5d55f-d6b2-4cde-87f6-223d9de42b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528316, "uuid": "a296afb7-462d-4858-a81a-473de8a8fd89", "value": "SecuriteInfo.com.Win64.Evo-gen.76175449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a137a7-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517118, "uuid": "aded7e4c-7f85-4457-9ecb-69bb322ec6ae", "comment": "Malware payload", "value": "78a62e8a89b4d0b0a6733dd9eeb3ee9e", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517118, "uuid": "0f69f2e2-b8b6-4099-afcd-29010715f857", "comment": "Malware payload", "value": "873011c181d00709fdf66f32bb3cca0c5ff3147d00ef818fef72987a6773ea66", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517118, "uuid": "b59e4b42-2559-4221-a2f8-59471f9bbb27", "comment": "Malware payload", "value": "a2f75435e7ef85ee3f2a9badd46000438794edbd", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517118, "uuid": "99d3bb79-0a59-47dc-961b-8f3a0e53f84a", "comment": "Malware payload", "value": "ca539fb869995b5d01bc990a91f4dab7e8060af3aff0aec428f08d3aa02c0f85b29455a5f3c11b07f8442c456eacbe9a", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517118, "uuid": "38ccb08c-4842-4876-9697-bf75457118c4", "value": "T10DB1525EA68490156077D2B4A3B25369FAAB4017830781153FACB3B2CFB5A118973BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517118, "uuid": "ece880d3-42cd-41a6-ad5c-823741b171b8", "value": "96:TwJA7Xw/0Jz9RwvZz8hA2J7YP6UK+Minqe1XN3Q:T8Ak/M96vZziTUP6UK+Minq4XN3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517118, "uuid": "6c579274-aadb-4ea5-84f5-c9edf80b4329", "value": 5424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517118, "uuid": "adf10882-c5d1-4d6f-976a-eadda3563ec0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517118, "uuid": "1a40419b-19c3-4b01-b3f5-fdf30d76b761", "value": "zoom-update.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b825c18c-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783475567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475567, "uuid": "5da7182c-cbb1-41e9-b179-515d419a2038", "comment": "Malware payload", "value": "b2083bceb73991db1f2483a6fe14e5cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475567, "uuid": "9b645ef6-3bc6-498b-9ddd-1f12eee2a22c", "comment": "Malware payload", "value": "87b25bb68d599cee8dcd11fee91b3b1a03c87eca0f460c6ed0962fc26239674c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475567, "uuid": "8071d0ac-c367-44c0-adf7-55eed45f5361", "comment": "Malware payload", "value": "e8a42ec3282560b9baee22b5cb48149c7a75b3e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475567, "uuid": "38bdb333-e005-443e-bbbf-1cc6389b73d9", "comment": "Malware payload", "value": "8ce9deaffdd0f1b19c1d361bfe3750ee78a457900312dccdf9b83f2da15955de241e9646038a42d44832f5136b234186", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475567, "uuid": "9a3526d6-8030-4f9f-b4c8-40d005a48f10", "value": "T101336D6616817C24AA98D8361D7F1F0CBDAD43E6320492DE7FCA3CF28C5AA9D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475567, "uuid": "a8eea3c5-3f34-4b74-9e69-43f72e429c3d", "value": "768:SXRWNGxVm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:elxJcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475567, "uuid": "d045cdcd-01fc-487d-a72a-854c3677ad68", "value": 50386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475567, "uuid": "56c3ab57-5e8d-4451-bd2e-4474b28a40e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475567, "uuid": "9a44b2fb-ea13-4555-8264-daa2cc6829c7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51ed812-7ad8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783520740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520740, "uuid": "d35e63a3-40e9-471d-90df-41d54584eeb4", "comment": "Malware payload", "value": "20b168afdbeeed40a4db9f5fe3a9a151", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520740, "uuid": "cc988529-62a9-4cc4-ba37-74862774e8bc", "comment": "Malware payload", "value": "87f032e23811caa9fe970b6a8ab65ade386f4e510d0b8ec5ab1ecf18d50a98b4", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520740, "uuid": "9906f8d2-965d-4b79-b24c-eca3e6944167", "comment": "Malware payload", "value": "19deeeb806c5da3760ac92822773ba2d02050755", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520740, "uuid": "27ba0fa1-dbfd-4585-8b51-98ec7c6c9d64", "comment": "Malware payload", "value": "cabce6947d57800b6da1c728c8ea217f2af84ac4a24170db3778e1641d83203f1292ecd0f54a33c34274c5f234d3b4bb", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v00lk", "colour": "#07857D", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520740, "uuid": "b62019d3-7370-46d8-b936-b78e053871eb", "value": "T1BCF43A13F7E124BED561D834829E9223DA34789853126AFF27C4AF603E45AE4AF3D711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520740, "uuid": "b629e808-12ab-4772-b644-69dc460e6cbd", "value": "12288:nlmBlU3jNUXm2/PLCO/gX1r2D9T5AL/3NxsrgVs4LnZg+QR3zL:n4Bl4NQXPLCvFri9T5+CgaYZg3zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783520740, "uuid": "cc235bc3-d3cc-4938-b64a-cd8e80a15a84", "value": 746088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783520740, "uuid": "13c6fbdc-ea4d-44c3-9e8c-9efd150affb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520740, "uuid": "432452b3-ce92-43d7-b568-c3da659b6fa4", "value": "v00lk.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f32e363-7ab2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783504301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504301, "uuid": "7bc2d9e7-e2ea-4279-a0b5-b353d4201eb1", "comment": "Malware payload (Formbook)", "value": "d8d881f9e50a0de244e5ca85a9e88b0c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504301, "uuid": "e4cc7595-6bd7-49ed-a59f-6a1bf8bc204f", "comment": "Malware payload (Formbook)", "value": "8a93ff80322c0005491ed6fd0f36518ab6f7caab43e7406ac473db85a447cf0b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504301, "uuid": "80811303-054b-42e5-96f5-0a27fb9df9d0", "comment": "Malware payload (Formbook)", "value": "b3c13eb5779f1bd70f53e9c8c05cf8fb6db718a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504301, "uuid": "1a6d54b7-be2f-4384-b736-85542f02a633", "comment": "Malware payload (Formbook)", "value": "965b510a7fd0a82eae459d48955e4adeda52438614306d9607ab51f41e672bd852ce7dc8ca6e143b385a0170cda2a25a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504301, "uuid": "78955d62-072a-4cb2-a6e2-611d8b183208", "value": "T1B11394893BE1F1B45657E03B3E37A289E27F4C85B688C844F7947098FC6472C8E657A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504301, "uuid": "ae7edaf9-6ed9-4804-ab5f-7793470aa73c", "value": "768:Jm9q+c/UeYBNXDCe9N8f/Uyx0hPwkfOOEG:JF+c/eNTCMgU3YepD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783504301, "uuid": "f1d7d02a-8a72-4db6-9eda-50b3663eb559", "value": 44971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783504301, "uuid": "28596c7b-3859-4305-9708-16bec450a3e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504301, "uuid": "4ce2421a-e90c-4a8e-aef7-8d1d17107f71", "value": "REQUEST FOR QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2977fcfe-7a91-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783489930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489930, "uuid": "d6ddf173-e328-4b44-8bc2-78ec9902a6aa", "comment": "Malware payload (Efimer)", "value": "6e1979f470580841f5f5b0144d630ef0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489930, "uuid": "1e253897-7058-443c-b4e9-413a3fd41607", "comment": "Malware payload (Efimer)", "value": "8bc8f1b1add9e160922ffd6081c4c3740a0d86f2e41972ed2ce159f374d20c61", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489930, "uuid": "8523fd3b-4789-436f-8cbc-e241b1fa67eb", "comment": "Malware payload (Efimer)", "value": "86fe7ed37744c99a8d0c37e06bf89cf654587786", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489930, "uuid": "9eef4633-9c78-4262-88bd-6611f3b5d001", "comment": "Malware payload (Efimer)", "value": "c6e9f6ecfe45e45c849fe10bb8193a7c4a905e1c45722d95260772c0f3487e636a57c82ce0a569e89a04c1b5a24111c7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489930, "uuid": "823829ed-7a4a-44b7-b365-4588dc942bb6", "value": "T101E63348BAC405EEE673813CDDE35995D17274F50731CACB0BA49B5ABD670A0CC3A6B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489930, "uuid": "ffb00bc1-11bc-4cce-9f1d-bc1136ace6f4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489930, "uuid": "5216f946-3914-4ac9-8f7b-e21be5032278", "value": "393216:ZE3UiGM3MEUztLu+D38oTXMCHWUjX1cuI3/PGTAI:y3UjoUztPj8cXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783489930, "uuid": "7885269c-d95a-4ee3-b00f-34c90639cc7d", "value": 14280855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783489930, "uuid": "2a3c8665-1df5-4d1f-b558-06b4555400e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489930, "uuid": "c157a876-db54-4600-b682-f75d8a831a21", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652a2874-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517089, "uuid": "317ef80f-ddb8-4c98-9da4-07413bf967d0", "comment": "Malware payload (ConnectWise)", "value": "e9174663dd353d0faf56f005cf30a652", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517089, "uuid": "51be0d66-e2f8-4ad5-b89b-11977736905a", "comment": "Malware payload (ConnectWise)", "value": "8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517089, "uuid": "ea7ade25-1304-46d8-a6d0-3f28269fd344", "comment": "Malware payload (ConnectWise)", "value": "4e3422e4848147d648c5e82dfeb163035a10bf26", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517089, "uuid": "2d481c37-94b9-48e7-8487-5bae35fbb60e", "comment": "Malware payload (ConnectWise)", "value": "adc0c9376ad1f94b43fec1514018b2b918032d44f7fd2e4ef764d80b964073f0c327839f737b3391d3a5cfabbddb4d19", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517089, "uuid": "e3b6ef85-cb20-42c8-9633-004989df1a27", "value": "T1C2D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517089, "uuid": "1ed7f8f8-c56f-45ca-895c-207632b1eb9b", "value": "196608:6Hxcp9ym3iltDUJVAHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3PHW:IGpMpnGpPGpjGpeGpOGpZGpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517089, "uuid": "57fd6ff8-9e6a-4853-8614-61a7ca6219ac", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517089, "uuid": "a04c8d04-0d4f-4c47-8e82-5ba3e8978af9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517089, "uuid": "28d272c1-b2d1-4fbf-a351-e752329b3822", "value": "JqbMljCi.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcdec1d-7ad3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783518523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518523, "uuid": "baba1171-cefc-4cf5-acd3-a0d78e211d96", "comment": "Malware payload (Mirai)", "value": "3218eacf0efca8d2a7bca8a207e89f2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518523, "uuid": "582a8f3e-b402-48d8-93db-7d866dd74a56", "comment": "Malware payload (Mirai)", "value": "8eb655127e328ed318330230c12bfb3c3278ad328cf201d3e29b30132e55d115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518523, "uuid": "b6dcbf58-6dcd-4119-b603-888bddabb57e", "comment": "Malware payload (Mirai)", "value": "ef782bc4515013ccc704654bc73455cfc73ab473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518523, "uuid": "b0c1bdfb-7d0e-4874-b4d4-b7a6b89a8c45", "comment": "Malware payload (Mirai)", "value": "077e5e27fdb4a9c9fcad3f31d4ca9da9afbca5f48b7e2b10a95279c9bdd28ceaa68c61c60477cd933f11bf3e19a16616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518523, "uuid": "680de73e-764f-4137-82ed-6d2a819e8ff1", "value": "T1E2B35BC5E247D0F9D8160A302276FB375E76E17B1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518523, "uuid": "2dd41856-a4d0-4e31-b48f-c6de823fca01", "value": "3072:vpe9zJgGmi+dkEF5nSMnuAhDb4ySUBNPHAC+BX:vpe9zRx+dkE5nfuzwPHAC+BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783518523, "uuid": "e2ec2716-5223-49c9-b253-849bb1f88cf0", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783518523, "uuid": "1a7672bc-5b4d-4fc6-9987-7f5af1c424e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518523, "uuid": "fae2d5d6-3eb5-4ee9-b9ef-0f8f60500aac", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7479b6d-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493229, "uuid": "f864e4c5-8ffd-415e-8caa-d586faa99b9d", "comment": "Malware payload (ArkeiStealer)", "value": "5cf2cfefbc36bf73682f024fa31d7ba4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493229, "uuid": "eb8bddd8-d412-491a-b413-dd4179c9aed7", "comment": "Malware payload (ArkeiStealer)", "value": "8edf5865a87829fe59b97ffe2c3dda7a4b104b0ae08a202b6be7a5e6ba90eea7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493229, "uuid": "95489efe-7e2d-4d62-9bc5-e05591300696", "comment": "Malware payload (ArkeiStealer)", "value": "7e127df1b5c3d0580d4adeedb8a50d245d1480ff", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493229, "uuid": "eff63608-81db-4d04-87f0-2b618982920c", "comment": "Malware payload (ArkeiStealer)", "value": "6afa2d396820493526c237b84428e894b775166f637224ef76b7d22335f0248737a975841cc4e1d0c1387382ad03dbc2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493229, "uuid": "73e2c1fd-c8fd-446b-bcaa-121d8b658423", "value": "T10ED59E4B7DD058E9D8AA937248B752957B75FC0A0F3123C71E94B6382E72BE08D39B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493229, "uuid": "e69bbd32-282b-4fff-918c-da3418001575", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493229, "uuid": "629b8d32-3d83-4b95-948a-0f0ec392b497", "value": "49152:pwaC2DVm+TGr1XIadosKkSKO9K4DkIKsziFMehNz:pwy8foASKOsEk/t79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493229, "uuid": "82981b43-37b4-44a1-8fb0-3155adf3d2f6", "value": 2937224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493229, "uuid": "cffa3b3f-9cac-43ce-b757-7cab5eca4d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493229, "uuid": "021be199-6cc6-4b34-8d82-0e5f2db20285", "value": "SecuriteInfo.com.Win64.Evo-gen.85199665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3d8c59-7a6e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783475198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475198, "uuid": "05085667-4b92-496c-b685-b66bde7216d8", "comment": "Malware payload (AgentTesla)", "value": "2186779b8b0ea0d203aa817c8691c3e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475198, "uuid": "e3f830f9-e68e-4cdd-9dde-ccaa136c95fd", "comment": "Malware payload (AgentTesla)", "value": "8f3e745546f76f645ff13164d65a18c60a7e74324ac902bca3c1af0f7b21a40c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475198, "uuid": "8b5ddf89-b54b-4ab8-9642-d10b6bf2b200", "comment": "Malware payload (AgentTesla)", "value": "baa9f746c6149076b4dfa113c519a803920d96f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475198, "uuid": "14babf16-d3a1-4418-94ef-1d11d4e71c9d", "comment": "Malware payload (AgentTesla)", "value": "292761267978e490a8f71a0c119da09063eaf002e8710c5672fbcff95128d8cdc46511a0ce76a1b37f189c924a81d4b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475198, "uuid": "a07fc6a6-aa96-4952-89cc-db2e9b70b4fd", "value": "T1F75501055EC07F74CFE9662950FE161EE3B04D8A5019A989FB23FD4AFFA7B04511B288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475198, "uuid": "51a87375-83a9-4d94-9d07-c37be37dc26d", "value": "24576:gBjPi2oTNs1rxI1DpMS2vpJ/YotvOGRDyMlybagD/bveEr:YB+gIENhN89r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475198, "uuid": "40aa4e15-5edf-4c4b-aa22-7c7e03139d34", "value": 1317024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475198, "uuid": "5c82743d-b451-415b-b0d4-e7abbd298bb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475198, "uuid": "33524371-4907-4183-aa5a-103d3bbe56fa", "value": "NEW_PURCHASE_ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6878a5-7b00-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537612, "uuid": "7e4ac86f-3583-4b9a-b89e-5981f18a376a", "comment": "Malware payload (Mirai)", "value": "da5281927518998bd4eec207c5dac3f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537612, "uuid": "4fead8de-2ec6-4888-9483-6aecf8d515ba", "comment": "Malware payload (Mirai)", "value": "908ba87316fb65dd8a155177d53343bd19a2a0c99ff5d92a18c785a2746ff8ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537612, "uuid": "c5857e80-3e8f-4aed-87f7-980fa11b68bb", "comment": "Malware payload (Mirai)", "value": "4db18dab44390ec8cc3ee34691373e9b04a17b08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537612, "uuid": "f90faec4-d36d-4c9b-8872-815585fa1123", "comment": "Malware payload (Mirai)", "value": "b262d5f198af5e7b0293eb85025454059aee6af3e88cbc3abf5dfc08f12c2634ec7b3e2df1f0079bc27b40ca6c4aa9c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537612, "uuid": "d97e06d5-aad6-4b7b-b2a0-1543ac187a17", "value": "T151A2C131426BACE2C6F009FDD67CDB5E65BB0FE5E26D3553273482D8244B8CE2434A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537612, "uuid": "af1809df-bdf2-4211-90c8-53a1fef76613", "value": "384:6mpz2kRhPfiJIVZxQdCpkaNLwjQK1dxKvqxp3j6Cc4HSKj1jOpQ0CcBYhymdGUoJ:X2aVia+C2EwjQ0TKSxp3mCSQapQBzs3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537612, "uuid": "67eeed63-dcef-4a54-bcdb-f727cdfc171f", "value": 22608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537612, "uuid": "2e7368f5-3937-484c-98b4-1dd538022fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537612, "uuid": "5652008c-f880-4984-978c-4f90950d758e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5991307a-7a71-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783476267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476267, "uuid": "5d94a58a-407f-4b30-948f-a003b8bab6b2", "comment": "Malware payload (Gafgyt)", "value": "27c926823687337fe491a0578dcee3bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476267, "uuid": "78c8ed21-b406-4bd8-b8cb-42cc6256f653", "comment": "Malware payload (Gafgyt)", "value": "90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476267, "uuid": "82851daf-18f3-4c47-9e6e-d405fb14ebba", "comment": "Malware payload (Gafgyt)", "value": "3c11433b0e5a3354dab55eea7b535074e3c11103", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476267, "uuid": "969206e7-5e8e-4c4b-83e2-89735154cac7", "comment": "Malware payload (Gafgyt)", "value": "2ecf5f5902c3804d111cdc2f1666df95f66e05bafd7910ea316d3137279456bbcc86e59cbe133fbbd357f14b98844c09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476267, "uuid": "39f915c3-c4bf-423d-9889-928f2fa44d0e", "value": "T12B8171E6F834A522304DFAFCF217A7848746CEB990BB3601A046AD7301CF558B54DBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476267, "uuid": "dd7c3650-49f2-4232-94eb-38c226ee8524", "value": "24:j96f0fs+L+Jmgs+LJlSlLxs+L5M7ldls+L0fxf2Us+LuifibVs+Lcmfm0GCGs+Le:ev5F7Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476267, "uuid": "61a866b7-2815-457d-9e29-462c3296c618", "value": 4172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476267, "uuid": "c18c5d59-c28a-4e09-b5f6-47f3426eed8c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476267, "uuid": "5020eee0-73af-4d7d-8f71-75a02a64836f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae879d98-7b00-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537828, "uuid": "6b1f519e-8dfe-4b33-ac2d-8599d172da73", "comment": "Malware payload (Mirai)", "value": "8a6a70808a71a1413260abb03edcb07e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537828, "uuid": "0753fff0-d8cc-484a-9286-1769eab16351", "comment": "Malware payload (Mirai)", "value": "9151cf8957119d6549bfb4308e5f281263e7fbff2874f2d6f1847eac2dc1b556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537828, "uuid": "91c88901-dbe5-45d0-b5e8-7da36781ce17", "comment": "Malware payload (Mirai)", "value": "40fc9c360287e86f4973de174eed8adf36088d86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537828, "uuid": "7f4d0445-fb3c-43fd-bf83-3e28bb7b74a6", "comment": "Malware payload (Mirai)", "value": "e0d88b986fc3a7d5de4db26feddc8dbc2e4fbf57b338157109daeda73ef6d9d04731535e454a4a8df55b7baefca267f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537828, "uuid": "b4be330e-95bb-4f05-96cc-ee377b5cac28", "value": "T19EB3295AF881AB11D5C626BEFE4E118D33136B68E3EE7112DE205F2423CA55B0F7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537828, "uuid": "9eaf0120-1ebe-4893-9646-f1cc928e7371", "value": "3072:FJPzX/MYBSxkQvaL+KEztaKqwsdMK5bCJjvdDhpcmdg:FJPzku0DaLnAtaKqwsdMK5Cvhmmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537828, "uuid": "32fb908a-ac4e-4169-8ac5-216d7da1430b", "value": 109684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537828, "uuid": "bf2e61f5-139d-473f-b919-ee2a902125cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537828, "uuid": "96fdc68e-411c-43cd-9c3e-adc8dcca50eb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d586c70a-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493226, "uuid": "6404aa11-c8a5-44b4-8bb9-cbdb9712e4c6", "comment": "Malware payload (ArkeiStealer)", "value": "579bcfdd754bfec0639cea39092120c8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493226, "uuid": "0cc4050e-b8df-4854-b823-326439df724e", "comment": "Malware payload (ArkeiStealer)", "value": "916b63175a16484b5dc36e51ac2453c6c60e481b4fad4ec9ab511b6c28f2f1ed", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493226, "uuid": "89b76c2b-c3af-44fd-ac15-a07b8e2e4698", "comment": "Malware payload (ArkeiStealer)", "value": "03deb3e68efcf9776fcebe5346d9f06fecbf8d53", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493226, "uuid": "4136be4c-1251-46bd-b917-ed81f08b0075", "comment": "Malware payload (ArkeiStealer)", "value": "1c2b319c40cad0511c5e6befc0ec9422c243e46a0cfa21f3e9b4cf6560343294934f91dee81feca9587eed3c5f099b96", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493226, "uuid": "06770215-bae0-4841-ae24-f41ed74d15ec", "value": "T1ECD59D077CD049E5C8AA933289B61286BB74FC194F3623D72E9076782F727C48D7A758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493226, "uuid": "25e9c01a-fa9f-4747-acd0-c88afbb3596c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493226, "uuid": "2c20f283-bc61-479a-b515-e2a1f0c7ca29", "value": "49152:Uyx4HZNMjJJpNAQKvePBhUCp6Q2TLwaUOrM4d:Uy4SH9PU7/TLwaU9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493226, "uuid": "b0d59add-15a0-4861-b06e-d1e7c0464da7", "value": 2979704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493226, "uuid": "a57e5640-7896-4661-a8e2-54546a5f2d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493226, "uuid": "185b5f6a-d767-473a-93a1-a0d769e43be8", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40332.3894.5586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877601a5-7af8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783534326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534326, "uuid": "1c7cb75d-fa15-4037-8457-589d8482582a", "comment": "Malware payload", "value": "71798577d77eb91123956b064aa7b874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534326, "uuid": "df45388d-12b1-4df7-84d3-d1aed93ca170", "comment": "Malware payload", "value": "918c42d88be3dd369ddf630867901eaec3a90f1e833d486a2a1ecff6879bd8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534326, "uuid": "54b17320-2d26-435b-be59-71767e8f0d95", "comment": "Malware payload", "value": "6ec39fe7fe8611690496214d8df2e2f5ff8d129c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783534326, "uuid": "4167b779-aa77-43d1-912d-adf7b7b273ad", "comment": "Malware payload", "value": "9773bf5449426177b48ef4fff39f32b008baa765bbd98fe8def27bcbea386e946206f70434a100ab384fbdb413b09aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534326, "uuid": "1e4b8f35-6f69-4bc9-97a8-acdc207b216c", "value": "T17277336CAA921598F0D7643BFCB3983F524339912730458F9FE82D9639D31E0AD68763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534326, "uuid": "cec43378-74d3-47c0-8ffb-e94418ac0ce1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534326, "uuid": "321dcbef-1240-4345-8e7c-469b7a5e1ed1", "value": "786432:3Pas/xJMheCMyXiFvW8wPW+NjlZcKAj7dzvVgax5q2j3W4cqwyi1sL:3Pas/XMheC9yFvWVNNB1o7YEq27WfLDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783534326, "uuid": "a76167dd-06cf-4874-bc2e-7160efe6bcf1", "value": 32988092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783534326, "uuid": "88a74b4e-1cb8-4484-84b5-f7efd5f6d2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783534326, "uuid": "4b5a3e60-0103-49f6-abaa-71abb74cc5cd", "value": "918c42d88be3dd369ddf630867901eaec3a90f1e833d486a2a1ecff6879bd8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087fd417-7b0e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783543562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543562, "uuid": "1519f79b-e0d6-4453-8b21-cf49a9a4f191", "comment": "Malware payload (Mirai)", "value": "d4026a62a4f3748d6bca3f4bb4f86955", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543562, "uuid": "e08be20a-39bd-4a8d-897c-cb362de3ed2c", "comment": "Malware payload (Mirai)", "value": "9226e30e0d83924d750cc04b1898d5d260e524808e35e628b69dba215a48dab2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543562, "uuid": "ab29c413-dc37-4f30-9db1-073b43a61356", "comment": "Malware payload (Mirai)", "value": "50f541f3e378536b11ea5045b909b4e6e77fab3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543562, "uuid": "553f6964-df04-4fe6-9a08-597bf55898b1", "comment": "Malware payload (Mirai)", "value": "9258b6fda9768993c5827f8ba5d865e1d5d634cfb07fc8bde2873cc6b53bcbeb7e5c5f1f295526434d6a28cdd52db1f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543562, "uuid": "1b905172-d3e4-4e43-bcb8-a13898234b8c", "value": "T1D901F588263410F031F6D8E64A331C1C34E7D4673D92ADBCBC65E9D64A95C0AF1821E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543562, "uuid": "cb7f8424-657a-4ff6-a652-0460c0c56da0", "value": "12:YkF1kcClZF70SrjHFxjHFwjHFWShFSoFM5gFzAShFSuFMDgFzwA1LRPb:ZDkH/FbrjHFxjHFwjHFWSF9FM5gFzAS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543562, "uuid": "71e797f1-f792-497a-94aa-9fef2eb19d5a", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543562, "uuid": "939804b3-6652-4f85-bc6a-e62d34ab1e9f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543562, "uuid": "dd24fddd-8505-4335-9866-1a18e5828c79", "value": "9226e30e0d83924d750cc04b1898d5d260e524808e35e628b69dba215a48dab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74d3380-7aa1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783497148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783497148, "uuid": "45a90045-2873-48c5-9fdc-15311276fe94", "comment": "Malware payload (Efimer)", "value": "ad775483f0b16cc59cba1cf9690d47e6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783497148, "uuid": "68e09d26-2531-4663-8d96-c428d867c90f", "comment": "Malware payload (Efimer)", "value": "92429d9ab6518c2d0aca85f1e337a607c861d81445d2a56b027555824dc1fd4f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783497148, "uuid": "fa349463-535e-4d12-bcdb-4e9bd6f52cc1", "comment": "Malware payload (Efimer)", "value": "c5c942e7689416d5e9894d180a293d18f53ee63b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783497148, "uuid": "cafefb4f-59a0-48c4-91c7-7a08fb947799", "comment": "Malware payload (Efimer)", "value": "35ada1db480406a7086adf0258f68b31b24c1714f43c61959b79e16c85b46844ca62c31ace0c57c5c02c7131ba742a2e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783497148, "uuid": "8ed6e7b6-b16b-47b7-ba14-d8d3bb236342", "value": "T126E6331476D016FEE6B3403CDFD28695E67074651B72D64B87A8C6A1AE233F08D3E60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783497148, "uuid": "73c1985a-8342-4834-9463-c1734f5e3514", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783497148, "uuid": "07389698-14c0-4871-9a8a-e2a96d8fb95a", "value": "393216:Hx0lTRWVN6I7XDWIcgA5M1ZyU0j4XMCHWUjXmcuI3/PGTAI:H+cj68TWN5MrYj4XMb8XbH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783497148, "uuid": "33f460c7-98a0-4f51-9842-b8e4fa646987", "value": 14289814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783497148, "uuid": "0ec415f6-f8b5-4f07-b96e-f20c669eea46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783497148, "uuid": "c2cd39d5-cf70-4dae-955b-066b6c8b4ab3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095344d5-7aea-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783528102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528102, "uuid": "a9533126-2956-4129-b4b5-8466acec418e", "comment": "Malware payload", "value": "0ab6177a0dd0b34958856130a7fa77a4", "object_relation": "md5", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "cpp", "colour": "#6A4593", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528102, "uuid": "99112477-fb81-420d-b712-87c05c1fde3a", "comment": "Malware payload", "value": "927a786e2521be78ea982bcb7a17af5bc4e2b5b657ef108f6ffdd9e76c779a91", "object_relation": "sha256", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "cpp", "colour": "#6A4593", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528102, "uuid": "9f74f7ac-58e8-4b91-bd5b-d13f93da8186", "comment": "Malware payload", "value": "c15e201cec6ceae1ccba4389ad526c33fd631105", "object_relation": "sha1", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "cpp", "colour": "#6A4593", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783528102, "uuid": "7c960cb3-1bdc-4fce-b3a1-1f80a991d92d", "comment": "Malware payload", "value": "f6f9fbe691b60e18dee821aea4673c92c7034a3a4d88e127b65a703548be082003b3bd458a454334aaa8998716e94cbf", "object_relation": "sha3-384", "Tag": [ { "name": "cdncourier-com", "colour": "#645831", "exportable": true, "hide_tag": false }, { "name": "cpp", "colour": "#6A4593", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528102, "uuid": "1a9bee61-27ea-4105-86c0-fae9f2ab78a3", "value": "T136428449A4767B210D33E736EF268104DB2F2517A3285B7BB81E42C05FB9454A374F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528102, "uuid": "0147a0b7-a943-4e89-a563-769b1512dde5", "value": "384:t8WFcB99QqhtNSxdWim9biRdBt9RgsJbuBV2cruE0rup0ru+tcdB7uOY8JaWNRRz:zcB9IY9biRdj9Rg0cdNY84WNRRZRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783528102, "uuid": "f443aadb-da13-47e7-96c9-3ff6359f7f64", "value": 12417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783528102, "uuid": "9c9ff890-e905-4da1-b910-083f54bf63dc", "value": "text/x-c", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783528102, "uuid": "5489842f-ae81-4f6c-aab5-0c558bcd5140", "value": "Intel(R)_HD_Graphic_Driver.cpp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf535e1-7ad2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783518119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518119, "uuid": "84466ea8-b826-4b40-acc9-60ee8b505080", "comment": "Malware payload", "value": "c1ef06054ebe9c7422a1605a52c33216", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518119, "uuid": "1f3a4d8d-9d4e-41e4-b120-ba4908059ec3", "comment": "Malware payload", "value": "939a3db851e7f7648babfe390bb8d93338ba57870d66e1a6b846e5e1a3207440", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518119, "uuid": "2b256a02-a9f7-4ea4-97ba-51199f46d40d", "comment": "Malware payload", "value": "6872552ea96ba2d72aaa6d121206cab12424590a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518119, "uuid": "ee01df95-6fc4-4b81-ad5f-33d4d69676bd", "comment": "Malware payload", "value": "a5d1bdf3ff5b2873fec4292e72e999112461cbf6c1d9d7a107b6d1df83d5640727dbca00062871e2e99fe76860f5b05b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518119, "uuid": "bfffd9f3-4ff2-48d2-8d84-e08443edb7f0", "value": "T10AA62383FB5CE61AD4FBD7368B3646964406AD22CF43D3476421B33C29B76C08E56AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518119, "uuid": "4849401f-8e82-4fd3-8f3b-c90a6f5ecf4e", "value": "196608:btKE51QZzAA9dry6eeOB+cMTKRCpbiwX/BZzZJM9CzxBi8qmt4zUPYhoZSWv:bkE5BA32AK4diwXfI/mdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783518119, "uuid": "53a3a8e6-7983-44b9-bfcc-5896b80dca94", "value": 9536683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783518119, "uuid": "609fd507-366e-4a88-92ac-ef6875097f82", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518119, "uuid": "3cbbb375-34f1-45cc-803b-0ccd96e28b72", "value": "TikTok.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c95b69-7afc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783536169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536169, "uuid": "d5cfb7cb-b04c-48db-b197-e8d0096b1ccd", "comment": "Malware payload", "value": "3247b1ceba7ac58009afed61f65ac396", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536169, "uuid": "3030977f-8e1d-433a-9fcd-4c78f18da8cb", "comment": "Malware payload", "value": "9481dbfb659113e977977f4872d9e620a83a5811fdc30fc4054495fe48cdbcbe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536169, "uuid": "0a109177-fea7-4b11-8f2d-4a8a21d715b6", "comment": "Malware payload", "value": "bc55760eb3b3d4c1e5dc758b219f37a7a621c16d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783536169, "uuid": "17331ba0-262d-4d8e-a792-46e059d8abd2", "comment": "Malware payload", "value": "1d0a3e73d457eede95b3b6c85de1f32c05065d1a037f576de55d456de54270da947bdf2e5fadd92e9821e868249084a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536169, "uuid": "fe3689e5-4e9b-4460-815d-864bb5929f1e", "value": "T13F221B11762E4F6CCC52FD3AD83C3D4891D20100F4B9B7FE27AAD789D2692E82D7458A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536169, "uuid": "b6b1afb1-e29c-407f-92cb-ea3d266396cb", "value": "192:NxNx9c9tbk9tbz9tbn9tbrxw9tbixgxh1GKlS0h:NPrdpar1GKlS0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783536169, "uuid": "30880b8c-947a-4a2c-a1cb-55c83b4ebc19", "value": 10690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783536169, "uuid": "3d56c673-2dee-4ccd-ba94-0928c0ceeaf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783536169, "uuid": "4b7eeb69-dbea-4282-a2ce-8f028d498f19", "value": "UpNetwork_Cooperation (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80938263-7ab8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1783506827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506827, "uuid": "4fbe9dcf-a33a-4541-8970-f1b02e52cc19", "comment": "Malware payload (RustyStealer)", "value": "1b47e72251fdd0a965a1ed8b4c929ca8", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506827, "uuid": "f8881c79-10bb-4752-8125-8186d80b0844", "comment": "Malware payload (RustyStealer)", "value": "94f740be53e399d29c524c4d6a60f1ad447beb5b074d01094f2fa28c5c24584f", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506827, "uuid": "5a570b0f-704c-4ae8-96b1-bfd1ddb6c6ac", "comment": "Malware payload (RustyStealer)", "value": "00bea6d00e5730e8342bcc1d0633395f3432cc9f", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506827, "uuid": "3c424dfc-58b8-4054-8dd6-b72e36598364", "comment": "Malware payload (RustyStealer)", "value": "6fb2a379d4749c353160bc704131c73230a5df45c839285178e36ad446b4c7340ea51824f4b8c085df02d8b891db0375", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506827, "uuid": "7837af6c-a57f-41f4-87a2-a5752526b76b", "value": "T1C7250211BA5158F8D46BC0F4CA351A23A536B8850B316AFF06A462393E66EF17F3C717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506827, "uuid": "1186aa37-061d-4189-97a5-dd6ef0691aee", "value": "cf73caac78d5b64e1786a59426ea14d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506827, "uuid": "b86d1c8e-272f-402a-adcd-5fef08dfbdf4", "value": "24576:Nqdcm7bb1ht6HlJCGHg+SvZ3rJCw9ybis6E:Nqdcm7X1/qyG43uis7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506827, "uuid": "199000fe-eb6b-4c99-baff-75f36e8d6ba1", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506827, "uuid": "4e30feec-e68e-4eac-b3fa-ae8465c302e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506827, "uuid": "d5da771f-f8d2-4b16-ab18-f0e231f63960", "value": "94f740be53e399d29c524c4d6a60f1ad447beb5b074d01094f2fa28c5c24584f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7833ae85-7b18-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1783548045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548045, "uuid": "9174383f-a8f4-47fa-bbe5-7b8045870a96", "comment": "Malware payload (Amadey)", "value": "3ad75444853ce3aca5346507bbd5f6e9", "object_relation": "md5", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548045, "uuid": "c13234cb-e87b-444c-8109-3e13bcc840f3", "comment": "Malware payload (Amadey)", "value": "957b16d148a33a4e6412d675a9dd3b99a6af1b5dc606b663f05107d5d98956f0", "object_relation": "sha256", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548045, "uuid": "10d6cad8-a01c-4ceb-9e46-e23e9ec389dd", "comment": "Malware payload (Amadey)", "value": "eb074508cdbea67e2f578e85633abee1153df4b3", "object_relation": "sha1", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783548045, "uuid": "e117bd60-cdfd-40f6-a844-28e8a7c7f767", "comment": "Malware payload (Amadey)", "value": "8da287b4d45869a1916f79721bc91886b0ddb7ddde9d2a4968c8dffbad75f574385e3e451b99e6096432706a40501398", "object_relation": "sha3-384", "Tag": [ { "name": "3c89c2", "colour": "#9C56D8", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548045, "uuid": "40078ea1-0395-422f-87ca-0b3e7fe876a2", "value": "T142359D16B941C071D49411706269BFF2593CAA35672144DBFBD02EB2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548045, "uuid": "2c9054ce-263f-4396-96e5-38d58c9682a6", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548045, "uuid": "52e5762f-d650-4c79-b7b5-5d5a8ea52381", "value": "24576:GLCrua2InCFeiwzFJEUoBmx4I1bzNEhzcJZBh:G+ruaRnC0iwzFgI4oJZBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783548045, "uuid": "3b5fedf5-c8c1-42c5-9a76-b2c02e2a9dc9", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783548045, "uuid": "2d57a7ae-5343-4dc1-9771-b24bdb32d26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783548045, "uuid": "4cde028c-a3af-4267-8342-cd74fcb3a2f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a22548-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473677, "uuid": "98152b4e-eaa4-46eb-9812-7bfc2c16ed43", "comment": "Malware payload (Mirai)", "value": "aa3078695c65f03ff363751ecd8286d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473677, "uuid": "bb1171e1-c324-495c-92fb-432d0d3c776e", "comment": "Malware payload (Mirai)", "value": "95fb2c80e84f84f6dfb95d31d9c3baa1e22735f8951ed9024a88deebd839a0af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473677, "uuid": "f72f088c-c378-4327-810f-964b4eded5ab", "comment": "Malware payload (Mirai)", "value": "a20d49bda4adbe99af42ed309772696e9b661fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473677, "uuid": "64be2470-a0b0-4ec3-9b9a-5cb083a7c316", "comment": "Malware payload (Mirai)", "value": "3b90c11a9faa18954db39b6a615586f1a4cebc0001f04e6b3033b0e0676617ffc28ee421fb0c7419402d1208dbaf4bc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473677, "uuid": "be4d2a4c-fa02-407e-9328-de8ebffdea4f", "value": "T120C34B9AB4019D3DF94FD57B58632D1ABD20A3925183272A639BFD93AC321F47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473677, "uuid": "3604348a-1ae3-4ac6-9003-b0305915bdf2", "value": "3072:XjXiHb1ZoCGRs0rBlpUjeZ5JqieX8KJFLOTs:TSHbPoCGRHqCZrquKJFLOTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473677, "uuid": "72a66d3a-6b98-4640-8a37-8344bbc76fd9", "value": 125920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473677, "uuid": "1c00dbed-c036-49d6-ac21-f986f47d6cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473677, "uuid": "aa1c42d7-278f-46c7-a8ac-d58201db4339", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7c89b7-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537261, "uuid": "1651e60b-665e-4a4c-92f6-96606d284054", "comment": "Malware payload (Mirai)", "value": "9a37976ddf7c39bb17a75ae76819d815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537261, "uuid": "88914d69-46ab-4bd8-bc53-89897ce56818", "comment": "Malware payload (Mirai)", "value": "9a618a6a73d274ac9102c388f4f1ec303abce082e99cbd49a542d1609bac4931", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537261, "uuid": "77c5a14b-92b9-4c24-89fe-f19269977f58", "comment": "Malware payload (Mirai)", "value": "2e82b7ec8e2810ec2de3dd336bcf254be6fe50cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537261, "uuid": "a87db3b7-a180-4d0d-aee6-c199d1aec196", "comment": "Malware payload (Mirai)", "value": "2a22b12e67544b19be671219820a8dc658f973277cb8dffb9422c117f8bdfdf09a2b95d5480687c2e9c28f4786a018eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537261, "uuid": "4d48429b-7e38-40c3-a131-8c4808e995b2", "value": "T11DD34C46EB414E13C0D61779B7EF42493322ABA593DB73069924AFF43F8279E0D63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537261, "uuid": "4233ed99-b373-41d4-9c82-5100690c57c3", "value": "3072:9mrM+N/zCYX29DtoSmvTeZ9Co2S23CM/9nOlkkN:9mrM+N/zCYm9DtoSm7eZF2S2SM/9OWkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537261, "uuid": "01705e74-74c2-4eb4-afbf-a35a591dde05", "value": 135406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537261, "uuid": "e48f75b2-950a-433e-b0f1-df8b6075f6a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537261, "uuid": "0e336133-e41b-4083-b8b0-97c6678ac89e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf2420-7b14-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783546551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546551, "uuid": "00002602-7292-4b5c-83c4-15f08a613fc6", "comment": "Malware payload", "value": "97f97e22884daf7790b2fd448ef9894c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546551, "uuid": "b6888f90-457d-49d8-a66e-d4739ed49e70", "comment": "Malware payload", "value": "9aa39922428dd0de8837773d4280782ccb2f4297814e451b00ef5182cdb08c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546551, "uuid": "c77375da-0769-4e93-b90d-83bef2e1cefe", "comment": "Malware payload", "value": "c0d6c16ce116aad5c05a6bdc4d732a5d1351c50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783546551, "uuid": "68fd85d9-c6b4-4c38-9f42-18dabde222ff", "comment": "Malware payload", "value": "641704311bcc3aaa045f48fcf113ea71329811f5927e08a1e7d37545a29a76de2aaae7335a46b2c48e6de0d8c9512a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546551, "uuid": "8adc7480-c6e5-4bc4-b56b-e2b9a4dfc32d", "value": "T18F08330B1C6EC487C07F56FA795234A6E240D82B1EB8E92E6F0E47E4B4E6D5110BD53B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546551, "uuid": "c13560dc-f08f-4c3f-90a4-a72a257f4bba", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546551, "uuid": "1868d448-2175-481a-875c-22a34d7c4c69", "value": "1572864:jt9IKPEEGSRWYKJImKljUoEkB9dNDsMLXgiMZrIuEt33ZSw7:jUK8EGSRWjImKljUvOhLXMxIuMww7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783546551, "uuid": "b15a6f73-ae20-443d-8cdd-763eb6d590b4", "value": 77491714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783546551, "uuid": "9e79d6c2-5450-43b2-9acd-1a8d82757e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783546551, "uuid": "85c5ded6-ed1d-42d2-a36d-195ec0d281d7", "value": "GALTITS_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c337d6d5-7a68-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472579, "uuid": "a29b747a-6278-42bc-b27a-53856ab576fb", "comment": "Malware payload (Mirai)", "value": "5be685d7104ad8a2f832a674f7c97c5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472579, "uuid": "43a4b5ec-d15c-41c2-8ee1-9153521980f4", "comment": "Malware payload (Mirai)", "value": "9b6e06c78785a4e2878a05702b1965036beb82a15104c03993720d621218acab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472579, "uuid": "c78182f1-6911-4f9e-a0ce-faa1be6ba3be", "comment": "Malware payload (Mirai)", "value": "91592fb3450e715655644384a7b407502981a084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472579, "uuid": "d810b06c-02d2-4757-a119-4a1abe930b8d", "comment": "Malware payload (Mirai)", "value": "d4341f28bb254cfb926c02ade305d8529f992e063bc95fc6134803ad14e65f31bef6f1cb62d6abd824c84e8e96a6de94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472579, "uuid": "9a007810-d689-407a-bb76-318f7f88dbbb", "value": "T10A43F795F8814B22C5D5127AF92D118D332367F8E3DFB2139E202F607B8696B0E36D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472579, "uuid": "5cc8fd2c-608b-4b09-8e4c-56459bd65837", "value": "1536:+In0Msd76aMEgYlSE/dvoY7ffkQIMVio/Osm:Hs56VGN7fr/Osm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472579, "uuid": "db0d995a-6a30-4eb3-a2cf-138f46b70b4b", "value": 58900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472579, "uuid": "f2702d6a-40df-491e-baa2-ea643d501e6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472579, "uuid": "474084b9-2812-4b97-bc15-f702fe01f9e6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbb590e-7a9f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783496110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496110, "uuid": "506a9d0e-14ca-4532-aede-bac64e17e580", "comment": "Malware payload", "value": "2976fb4223f7f3584f976a57b196afa2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496110, "uuid": "3641e828-b9e6-4400-87a4-6c6506888854", "comment": "Malware payload", "value": "9e53b8b2bed292c433480ddd989f4a693893a971c67dbf13174adc0b09780f4f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496110, "uuid": "2997d16e-6bff-4dd6-b6f9-40ec75cd4f98", "comment": "Malware payload", "value": "73fabd9bcc4c6ce7a665d05158311fdc577c59f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496110, "uuid": "8290a515-84e3-4122-a546-6b4b4c55bd8e", "comment": "Malware payload", "value": "54f7dea361178b630b83f8eccb6e1e4587a31678a371c77f89693256f345d76b7f1a02fdb4103dcad135b39689a317fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496110, "uuid": "d36e1c04-3e44-443b-a3cc-e6add28598aa", "value": "T155335C5516817C24EA99C8361C7E2F0CB9AD43E6324452EE7FCE3CF28C4AA9DE11971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496110, "uuid": "2ee94ff8-a46d-4ac0-9e98-44430184435d", "value": "768:n+K9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:n+fcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783496110, "uuid": "6de174de-0844-4be1-9ca7-1b6ef0e15f27", "value": 50390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783496110, "uuid": "c3768412-8e98-4320-b060-a489b3f32dea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496110, "uuid": "79e83180-b40f-43bd-8834-e448c44dd921", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb11b419-7ad4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783519058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519058, "uuid": "28b66bf1-3577-4f17-897f-c904bcaf1c32", "comment": "Malware payload (AgentTesla)", "value": "86d16be7f13332a53586982877db7f2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519058, "uuid": "f7f822f5-064f-46f2-b852-42b8c173609f", "comment": "Malware payload (AgentTesla)", "value": "9e64f676bd9c7e93045c6e1df0b0b55f402e909733a75d87ad260d1ace1ec6f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519058, "uuid": "c44039c7-fb22-4bae-b337-db44f73869cc", "comment": "Malware payload (AgentTesla)", "value": "edfb2fa0eb735c352a5b50254ef4828886958b14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519058, "uuid": "a9f9eddb-fb38-4b4a-b089-a59ea0a0490f", "comment": "Malware payload (AgentTesla)", "value": "bf844d21124cf745c304b02feb678f52e8a197af4947d77b8fc0d72853323eb9ea018028ad55226338c60014ee16ca08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519058, "uuid": "13f7940f-5f89-45a3-b371-28f183a3548f", "value": "T1CB65F14449C4BFE8CBA95A3E50BE150AE3B10DC9A115E588FB33FD4AFFA6704561B2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519058, "uuid": "a6e1ebbb-584f-4842-a357-14f1bd3992cc", "value": "24576:xJMRB7UTmL6V3ay4MyZB6W/7ic/GinSQQKLQp9MecoE:wuArs63PnS7NvMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783519058, "uuid": "84f6383f-72b6-43f3-afa9-ca6a8706384a", "value": 1455199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783519058, "uuid": "66e4802c-0fb3-42b8-b263-976401c8195e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519058, "uuid": "4418e564-1590-4b99-ac1f-18925fd5c483", "value": "Vessel details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0141d11-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493216, "uuid": "e0a31e3a-d8e6-4b88-bb51-efb01438c154", "comment": "Malware payload (ArkeiStealer)", "value": "8dbca105af66153b6735ceb8236672b3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493216, "uuid": "1b403449-5477-4b48-8d82-34c86cbba9e0", "comment": "Malware payload (ArkeiStealer)", "value": "a257198794219f14985ae2cb54c3938e8dddd0f6c1f245044fb991c7312a04ca", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493216, "uuid": "4f929504-b71e-4b6d-b32f-3aa634500d1e", "comment": "Malware payload (ArkeiStealer)", "value": "6b58546583d8bb103ae9cf64f75253b7cc686642", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493216, "uuid": "af4cc972-6c99-4bbc-aefc-bb9b06e4bfa7", "comment": "Malware payload (ArkeiStealer)", "value": "9787ccea33ed5e7cca6d771c767b4ee8d3ea9cb09faf0a7bc1356c2882871bae003aba400caccc155e546e2810d0431c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493216, "uuid": "19ee7ec0-ac1f-476a-b4ed-a763fa42127e", "value": "T152E57C46BC9008E9C4AE93368AB61252BB31BC080F3627D72E90B7783FB67D25D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493216, "uuid": "482ed935-8a34-4a23-a868-c455e554a24d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493216, "uuid": "e22a5783-3766-42a6-b64a-5c34df390f60", "value": "49152:UbMLIzafZVWuXAAqZlki9NZgvHxKIP7g8B:UbxqqZlD+x77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493216, "uuid": "8062fbd8-e562-45c7-9a5c-0fe2151ddca2", "value": 3086184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493216, "uuid": "837b3528-7750-4c04-bda9-af5f4c0ed52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493216, "uuid": "c3e503f8-41d3-454c-a6fc-ac3c30dff5ce", "value": "SecuriteInfo.com.Win64.Evo-gen.42569411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bffc414-7ac6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783512644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512644, "uuid": "b5d43e64-c822-4172-b98f-ff3167d93539", "comment": "Malware payload (Formbook)", "value": "a512c21f004f73fd95409d1bdda2762a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512644, "uuid": "57cbde32-5b4e-4950-8b97-975874ed44f4", "comment": "Malware payload (Formbook)", "value": "a26e5c848867ef349b10f9e05cc100fe0c0ccac5bb53c45b62e3b27857a2b9e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512644, "uuid": "2e1b9b8f-4f11-4b6d-9df8-81516d2e6970", "comment": "Malware payload (Formbook)", "value": "8219a713b02072810ff5718f0b800da81c16f194", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512644, "uuid": "0891806a-54ec-4747-8043-57e482c72614", "comment": "Malware payload (Formbook)", "value": "c3a68f9af4b8ee3cb74a8dd22ad0a5852f750a2dd0a72d28a6236ae134b1094a70eed8ca209c356ec3d1b13bea803616", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512644, "uuid": "5d7a3a24-6c05-418f-a6b8-996b44de4c48", "value": "T1111394893BE1F1B45657E03B3E37A289E27F4C85B688C844F7947098FC6472C8E657A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512644, "uuid": "c2090a00-2efb-40ff-b347-c5bc22c69f34", "value": "768:Jm9q+c/UeYBNXDC29N8f/Uyx0hPwkfOOEG:JF+c/eNTC0gU3YepD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783512644, "uuid": "e0950220-1f36-4b66-89f2-50521a1f94ee", "value": 44970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783512644, "uuid": "47350d58-cce1-4178-b152-428c285a4ebf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512644, "uuid": "25555d08-616a-48b9-86f8-339aa53de95c", "value": "Order Confirmation & Specs for July-08-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bb8376-7aa1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783496821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496821, "uuid": "79bb1a72-724b-4986-82ba-3962449f319a", "comment": "Malware payload (Mirai)", "value": "3084ff2e91888b1929194de3f00a28b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496821, "uuid": "dbd49567-e5ee-4a74-bf77-4f9069622f02", "comment": "Malware payload (Mirai)", "value": "a8877412d22348aafce79060d9f8578a94ec9adcf07dcea615735bf664370753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496821, "uuid": "81b6794f-02d6-4649-b3fa-5e860f5bb0ae", "comment": "Malware payload (Mirai)", "value": "511ea2e8d3ab74bd5b39db67d96e71449af044f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496821, "uuid": "c8860f84-413a-4701-b791-13b8ac897dd9", "comment": "Malware payload (Mirai)", "value": "89c2eed283d827c0485d552e6af2fe1399b6fbb0e8fcd36e520301df346f67a76bf42334f9a3f0ecbf6eca9bdc60db78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496821, "uuid": "12f442d7-0822-4e56-8e50-8f5ea9f5cb85", "value": "T1CAE3E80E7E218F7CF795823447B7DE1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496821, "uuid": "1f43a6aa-391b-42c1-a6b0-1e41ba674e7b", "value": "3072:ZhdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpURzrnPcH+14tTI7V7mFM7mYQrT:ndK+SE7ktsNOT8wR41M7qlkoKrMh8XQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783496821, "uuid": "8580fb3f-bb7c-4b9b-80e0-d77e811f026c", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783496821, "uuid": "ca105c42-5951-4cd5-aca7-416dc5a1c2c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496821, "uuid": "9025f03c-765d-4d61-8cb0-d20e50ac2432", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c74b9e-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517082, "uuid": "5d45266b-17b0-4572-bb8e-dd552e8af891", "comment": "Malware payload", "value": "690401ed2497ad939e05e0bddfd13dbe", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517082, "uuid": "e873d85e-f3bd-49e0-9281-4f6c63cc793f", "comment": "Malware payload", "value": "aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517082, "uuid": "4bf80d1f-a0f3-4d05-9c82-ef919d7dd040", "comment": "Malware payload", "value": "7618dd88cf6a07df1c64ce71dabc1a8167aefcc6", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517082, "uuid": "6cc59219-9910-4513-9d87-11ebf288294c", "comment": "Malware payload", "value": "8e9f2ce5264af81c68727102f1ad58060fa4a62a12b78384a716da691803519e91f84bef2cb88db73ce885759d71043e", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517082, "uuid": "ba8e943f-66a6-4460-b219-cf3fea47075c", "value": "T17B97334860F96E18C15FB372CA533B5D6BFF1566A83BDE42FAE3A18F43151C9821508D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517082, "uuid": "67cb1495-c3da-4ee6-a724-83ccec20d9db", "value": "786432:pl0ZmMQuvvHHb6daRumWzPJ0pIx/7ak1PHftafaemq6zKe:T04JyHHSmWbJNBIj16zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517082, "uuid": "7ee6285d-fe29-4b17-8208-cdeea1627c33", "value": 39605386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517082, "uuid": "a27cc9b3-420b-44ba-9b13-20251a9ee911", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517082, "uuid": "f159c47c-0bb4-454b-b494-33e07e040173", "value": "ZoomUpdateInstaller.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2543b1f2-7b01-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538027, "uuid": "9556e967-bb05-4c55-8e3b-40f742629302", "comment": "Malware payload (Mirai)", "value": "7e87b09ebfb48c252cf637bcd2337495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538027, "uuid": "0490dd4a-5a53-4be7-a551-d275ce29a36e", "comment": "Malware payload (Mirai)", "value": "aac0d088885a088e627c59514f90b485c874551e9dfb006adbb534acd3b57ad3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538027, "uuid": "cc6c78d0-554b-435d-8b0b-89470b01d8d2", "comment": "Malware payload (Mirai)", "value": "339d02462944d501ee0450604cf76e950164666d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538027, "uuid": "3c3edf16-8ed3-4975-922c-6e1c7ae84327", "comment": "Malware payload (Mirai)", "value": "7b80a9e89e640dae9aa579d5b617fb155f456d30114303e3247cde21458acbd103b7f06193426b96f608dcf0fded8f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538027, "uuid": "133cfae3-8a38-42b6-ac44-9477dd8cc539", "value": "T18A831B02731C0947E1635AF43A3F27E093AFAED021F4F688290E6B859275E355587EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538027, "uuid": "5a6e4401-0dbf-4236-9a2f-7ea5159aa6c2", "value": "1536:xBvzn/n4kYGTft2j7LJgZ7cJs2HlfD78dHz9:TIOfQjnw4s2F7gF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538027, "uuid": "b69a1c30-339b-48e5-b3ac-a00b3a3769c1", "value": 83388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538027, "uuid": "e29408a6-d4d3-4994-ac3d-bb09b18c2b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538027, "uuid": "cdf70360-b219-4e67-9699-2633d2d8826f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43c24d7-7af2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783531851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531851, "uuid": "85c7523f-4076-4782-bda7-674606a3c057", "comment": "Malware payload (Prometei)", "value": "52831711f0620c7579cd8a6e3af1d5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531851, "uuid": "00537d95-73fc-40d8-a2a1-e466637619bd", "comment": "Malware payload (Prometei)", "value": "aaf3b81e8bc8a31391828d56ef235e993ce7c3523f7fcaa332ff50551f5cd963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531851, "uuid": "224a29a5-041d-49f7-9d2c-0488f2afb9cb", "comment": "Malware payload (Prometei)", "value": "98e54da4d204e96267e683fcb87afe28d859ce84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783531851, "uuid": "176b9e83-80c7-4908-b2d4-fd1de4129ae3", "comment": "Malware payload (Prometei)", "value": "5ed8b860db5863ffe35aa87901a924efd4e7a9ddc2f7c08735b41d75428d84ff6544c85f48fb3b5c817c0a5e12f27279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531851, "uuid": "c401150a-5889-451e-9fec-e62a3c625e97", "value": "T1CE34BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531851, "uuid": "4c1a600f-370c-4c1a-9fa3-07d7957900b1", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531851, "uuid": "8a40fea8-49ef-4766-b0f4-5ea80ca55ff5", "value": "6144:GGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOm:GG60BpL8jk1FGjDc8GVdOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783531851, "uuid": "ada282c8-01ab-4045-a394-38dcfaa34ce1", "value": 245867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783531851, "uuid": "35454e42-106a-41d7-98ee-345505125d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783531851, "uuid": "10daf5dd-29b4-498d-89bf-ed344dcdcf9c", "value": "aaf3b81e8bc8a31391828d56ef235e993ce7c3523f7fcaa332ff50551f5cd963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbaaa15-7ae7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783526928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783526928, "uuid": "8efb9c93-2998-4a16-866b-66ab7e44ea00", "comment": "Malware payload", "value": "18c5e3364852d43120e54d365adecd9b", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783526928, "uuid": "03e7eb47-2b4f-46ab-a64c-729c0b3739a3", "comment": "Malware payload", "value": "ab0cb56912b87e6baf56ccced556f726d988c432561e94d671a15e891bb7d9df", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783526928, "uuid": "9a04fb1b-9397-4100-9d52-c816bade8716", "comment": "Malware payload", "value": "6560f4517da29b8aa3b1035e34499d61535b376b", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783526928, "uuid": "8bb55184-e990-4375-8594-eba83fee2eca", "comment": "Malware payload", "value": "b11657f5bc354185eab4d7a8f7d5135086a232be6d5377f19e7ae9bdc3f7a9fe5a53d879c8be3e64aebf574943a3acdf", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783526928, "uuid": "7df36282-29d5-4602-9471-994062491c95", "value": "T12651FA1437B0726B738A85A499506B7EA3B666B3710464D1709ED8C45BA6F23C3A41A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783526928, "uuid": "6cb47157-d0e0-4d3f-99f8-6bd19a928c27", "value": "48:UKpfKvdSHZRhjUX1PUxN4VE5F32GELNcHHH5c+LEqiZeLyjuH5cQ7TVz+Hu:HSvdmZvOUxN4GF32n2nH5XLEb4LyjuHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783526928, "uuid": "734aae50-c6ca-4fcf-af17-31f708b65eaf", "value": 2829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783526928, "uuid": "a0ab9cfe-a586-4dc9-be1f-9873fc2068a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783526928, "uuid": "be495841-cf79-485b-8f0a-bb84f1ae8b83", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880aae7c-7b02-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538622, "uuid": "23536b00-0860-4347-b991-b979d5593e5d", "comment": "Malware payload (Mirai)", "value": "f7ac75e3ce822f3013b1ac8618289a75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538622, "uuid": "46af974d-02b7-438d-8f37-728e74cfa957", "comment": "Malware payload (Mirai)", "value": "ad58baa37947b99252c70c0a4a4b4fafd596ebbbb5135a1833fa684a472b0a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538622, "uuid": "4548918a-2322-4365-9084-5c113e483d28", "comment": "Malware payload (Mirai)", "value": "0a8b0d73e348799775ad490d4b60cda5629dcbcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538622, "uuid": "c6ee04a9-a438-4037-aa8f-648453301adc", "comment": "Malware payload (Mirai)", "value": "5d604b059fe20a6075b08975859e6d87e1f24c24fd416205bcbe96956554e9769ce0813d700a2e7c108d599dacb9546a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538622, "uuid": "1486bc21-3b8b-41df-8aa9-132d59a390cb", "value": "T1B273D619BBA00EB3DCD7CD374AA92B01288D650735E96F36B535D918B40B35B1AD3DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538622, "uuid": "6fed3921-2bfe-4f63-ae75-62f1447e6957", "value": "1536:FtbTa4u9rujg97IxV4Mdd+yaLdZtRj1OY:FtbTa4u9rucxJyaZ2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538622, "uuid": "72a9465a-2166-4dc1-882c-8afbc8c7c22f", "value": 77440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538622, "uuid": "b222515b-531d-4ba1-b17d-0d0f7942305b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538622, "uuid": "504e254b-b8d6-4ab2-a91a-6da6ac5528df", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd1701e-7a9a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783494097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494097, "uuid": "52eca95b-f03c-495c-8678-382eab1fd2e4", "comment": "Malware payload", "value": "764e042f909b23caa0cca916879f85b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494097, "uuid": "1c9cb407-3ef3-4561-9152-1b1fddb01b07", "comment": "Malware payload", "value": "ad8657d3235485efd37d9b91ba0254f93a72e206bf45ed49fffe00aa3fc010be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494097, "uuid": "e59d14ad-1616-4987-a162-545da03fc262", "comment": "Malware payload", "value": "cd91c71cdfc65c1df04f401bab9047ce4e168a55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494097, "uuid": "7c5f5057-1064-4420-aaea-19b66ae951e9", "comment": "Malware payload", "value": "1da3eba38f4525579b70ec3a149cdff07c82e7aafed1136f04d3b49df0374a66924a93152331452385dea7329b0bf087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783494097, "uuid": "f30a7945-232e-4b77-9cdc-df07ec528782", "value": "T12917BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783494097, "uuid": "5cf264f1-fccd-41d9-9b91-396ed572a545", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ4:cqYUQuVDt0TZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783494097, "uuid": "762c9336-3e81-47b1-9e1c-da188578a2c0", "value": 19234816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783494097, "uuid": "a9061467-09f1-4b27-8cd7-43b6b1df9b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783494097, "uuid": "14f8ed83-0767-460f-a0d8-dbdb262da9db", "value": "ad8657d3235485efd37d9b91ba0254f93a72e206bf45ed49fffe00aa3fc010be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400560a7-7a67-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783471929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471929, "uuid": "29de4fdc-b7a9-4058-97b9-7ca8b9efb107", "comment": "Malware payload (Efimer)", "value": "c4765ffefd972d03a0f34b92791c9c50", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471929, "uuid": "a30323de-e739-4d4d-a2f6-d81f94f649a1", "comment": "Malware payload (Efimer)", "value": "ade67d4d7e7a5e572e78d5a1b47033c21080f7e136c108129b0e287774e83cc2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471929, "uuid": "400bd2b1-83f7-48f0-9344-20d0f597372e", "comment": "Malware payload (Efimer)", "value": "87019b0991b0219c52c5ab9048a10d5cadcf3fca", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471929, "uuid": "d68f387c-c46e-4cfd-ba64-bdafe88a9984", "comment": "Malware payload (Efimer)", "value": "137bae32ae7fedfbec0e362de7c32afb81fb5e7e3b858d5151d934fd09030d4ee38fe2103877fad6bf625291953eef8d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471929, "uuid": "51763d07-6d17-4b4e-8a99-0d9b4ca01bc6", "value": "T167E6335CB6E011EFFAB3413CE9E29194D4B874B32377CA9B475883619E530E14E3A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471929, "uuid": "99765133-eb86-4930-95e5-5cd82201571b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471929, "uuid": "6567cb74-f8f1-46b9-97ee-ebe64fe2624b", "value": "393216:Kjkd35hVVSQaTGwUw1Ls/UT7XXMCHWUjX8cuI3/PGTAI:KmhVVSp2/UnXXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783471929, "uuid": "80f4b78a-ad3b-4cf5-84fb-929d39e6a00d", "value": 14289708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783471929, "uuid": "a8afa591-df80-45c1-ba9f-087c9f161aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471929, "uuid": "deed918e-b3f5-4c5a-83b6-a04f7cd6f28e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec33364e-7a6b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473936, "uuid": "3d276708-0541-4198-91d9-843698699d18", "comment": "Malware payload (Mirai)", "value": "92709ceeee5228c3dc87b9f5e8aac524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473936, "uuid": "1a57a950-bff3-4a5e-83e5-7aa46b10d735", "comment": "Malware payload (Mirai)", "value": "ae5946d2ee25fbdbd341d3909c8226d3152376d2b68e523cbb323bccf29a0481", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473936, "uuid": "afe54434-eb00-42e5-861f-c3e2f3caab93", "comment": "Malware payload (Mirai)", "value": "743ec272e7a263d1cefb6c8646fb10efb2880c30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473936, "uuid": "0b3ff18e-a4bb-44ea-bdd0-0745498ad9f6", "comment": "Malware payload (Mirai)", "value": "aa653a63ac45c37a13b8767acad84a9daae08b15d43f6a48043bb876889b7fe9b478de40877b2d20a7901087d74c6cde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473936, "uuid": "142c85d7-6aba-4303-93e8-d721eacb19d8", "value": "T1978423C49432990EE5AA48BFEEFF83B96B98F5551BC128C4C52CED460F2419D804E7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473936, "uuid": "1ccc00d4-a4c7-4632-820c-fc10e22fddab", "value": "6144:JT1rObSMsvymUnNSBqEsKA0tju+YoLJdyKeDdjnJilzQggF5xF2iQuGIWXnzIjnz:DVJDw3EsKAT+YojxonJipQzxF2OuXBYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473936, "uuid": "ebfa9544-5693-4693-af6a-11c5f60fbd6e", "value": 386320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473936, "uuid": "7465e9a6-7e48-4b4c-be41-58ff77f64239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473936, "uuid": "09320ba7-c8d2-4873-9350-ad62e70f5a24", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11620a16-7adc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783522102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522102, "uuid": "8e56a4b9-bacb-4f34-8335-b19f7a707298", "comment": "Malware payload", "value": "0218d58a5bebc3b5cdd6297a4c1e8bcb", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522102, "uuid": "d2da4066-0385-44d2-bcca-c45d4f4687cb", "comment": "Malware payload", "value": "ae8a08274484f6db3631a169e46b2e9253cf1f3979ea5bdd7ea48423246d7da7", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522102, "uuid": "c1787185-b17c-47c8-ad48-b6fe725b69eb", "comment": "Malware payload", "value": "d47aa1812422cfea0bcedba03406d1b8eef57e2b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783522102, "uuid": "64ad4701-4499-4a0e-9fb2-36a10c2a96e5", "comment": "Malware payload", "value": "3e63b826d5b1c6b91cb09d8f5da7520646b07c852551323257e0bd629808ac869f370d3a7996444820104c98a503ae78", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522102, "uuid": "dd837dc4-b8a2-4000-9dc7-cb016d6ccd96", "value": "T174B5024FEA5957F4C57E91B880215211BBC17C028B10EEAF3AA93C766D67DE89F31B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522102, "uuid": "459e0450-e114-4526-8c8c-4ca981e89e07", "value": "5a08440e22a99b9fda864d620400de65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522102, "uuid": "3f1aadeb-b2aa-46c7-aaf6-a1f30e2e4075", "value": "49152:WYa/ec9hD+1Aa/M15fj6DoTUOk13rVIm/qJl0:Wv9hD+OeiL6uk1bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783522102, "uuid": "ed2767e2-464a-483c-830f-8cbdd028ec42", "value": 2322432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783522102, "uuid": "0d9bc8f7-9708-416b-aded-6479e100fc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783522102, "uuid": "5ed466f3-3d2b-4864-bcff-24ba978704db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671d3e6c-7a80-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783482732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783482732, "uuid": "e47259d6-d75b-4376-a164-8ad6ea25cd54", "comment": "Malware payload (Efimer)", "value": "f2280cb04cc1dbd45e5a6721abae7834", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783482732, "uuid": "c1cfadda-c1eb-4af6-ac3c-d2151647d28d", "comment": "Malware payload (Efimer)", "value": "ae8c08d1d0e0499724e11aa7a06aa2c39246732e230c9ab4a8b55c14cade7663", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783482732, "uuid": "385d0d23-107c-4a8d-8059-6dc17c161fee", "comment": "Malware payload (Efimer)", "value": "c697f8f2520cd42255f03de269b6a87eb997ad03", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783482732, "uuid": "3c1b2a58-262c-4089-bde9-6ceb4d29caba", "comment": "Malware payload (Efimer)", "value": "9ab55575d8325a5d77eb59ec261bc66d2923854861daba4d28079e732f12a3f102b1df113535c95e9c317292fc053a0c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783482732, "uuid": "34f01321-e1ce-4917-a4c9-9b7d5cdb5a81", "value": "T1EAE6338496D043E9FA73503CDFE2828AE47570651775CACF4BB88352EE831E45E3EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783482732, "uuid": "7a833112-34aa-4b50-a575-3ebefed72946", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783482732, "uuid": "02b690c7-7e78-45cc-bf1f-7300caddeb09", "value": "393216:0CVlisbmd9V6iY+GOaNEwkpjSOZXMCHWUjX5cuI3/PGTAI:0+iMmbV6iY+G/kpPZXMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783482732, "uuid": "3d615c42-c5bd-429b-8752-7626fa87bf91", "value": 14277557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783482732, "uuid": "c3060cf4-227f-4a26-b1fe-c1a212b45704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783482732, "uuid": "d0949b1b-83e0-4bf5-829e-097df967f413", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c355c3-7a6d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474675, "uuid": "585b7989-6a9c-4eb9-b2f6-657cc96a8092", "comment": "Malware payload (Mirai)", "value": "47178cb8fae3cf048f7f335357f74c97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474675, "uuid": "80bb17b8-32d6-4c61-b20d-4f2879daf272", "comment": "Malware payload (Mirai)", "value": "b072f91c6091716c3300189e14c3a0d6b6f52b3f1a2baf36f8df5456275da4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474675, "uuid": "83134e08-1906-468b-ac75-e84a62a5fa61", "comment": "Malware payload (Mirai)", "value": "946377d83f555083d5991171033c0a20c8cce0bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474675, "uuid": "522be358-5554-452c-b066-9704e8c05b65", "comment": "Malware payload (Mirai)", "value": "6d4e14f2a87b157ee8ec717970849063b97fecd3f8b60a7dbe724a5df07a0cc1a451e6a64a0f81b864962f4d92715594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474675, "uuid": "0a883b14-518a-49a1-b0dc-8364ed5beb1b", "value": "T11A233A02721C0B57C0A35A70263F57D09BBFEAD022E4F685665F5BAA8A35D371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474675, "uuid": "15b330c4-cc87-452a-bb42-2c2d793626cb", "value": "768:LcI0yS1+wRl+RjHR4GtKDHdzzVECjOELqxVNKywesIFAGsawRH:h0hexGHMGTYK2sICPzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474675, "uuid": "0a32a638-e4fb-4b92-a06d-1474ffb25a02", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474675, "uuid": "3d1b004a-290b-406d-8e72-8e079e780d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474675, "uuid": "8b75a86d-303d-47e5-982b-c37e1b56d98a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bd21ad-7a92-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783490459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490459, "uuid": "d29b4782-e779-4580-93a5-92b24a311105", "comment": "Malware payload", "value": "645122d25d2bc30a04a09e8d77b93cd9", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490459, "uuid": "0fb496b7-8c06-4d03-be93-0adbbbd0c018", "comment": "Malware payload", "value": "b1633346a694467b99d9596fe36d0cc88ff1f82f8e86f1c53d3218de1839a43e", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490459, "uuid": "355f7905-d697-4ebc-b7ec-94e1941ca2c2", "comment": "Malware payload", "value": "23f54b610863e9fad1b8999421d2ddd730e686ee", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490459, "uuid": "2c276c3f-cb55-4bdd-add0-65cb303b7df4", "comment": "Malware payload", "value": "fd61c7505c3cee362c97331d77df74905322676de85ce8de45b452b600e1aabd80b76f7f69b90dc9f63930b65dda72c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490459, "uuid": "e080c93a-1031-4d2e-967f-c2c41418b143", "value": "T17CD2E9004C691EB0938BC5BDBE999495B126261B1A197434FFFCD2941FC8B3542F8AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490459, "uuid": "ab6fbef3-063d-488e-b553-ff6de23bff9a", "value": "384:6zGO/0fbxyAXtAn/q8jU3NqOhbTVgO508/OntheSK80KVgUyJqbTNRQmX4nXNEuM:qcbOC8jQLhb5fdUXbTNRfoX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783490459, "uuid": "aa440969-d62a-46ad-8e0b-1bc3c41bf181", "value": 29619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783490459, "uuid": "d5bb9d5d-62c3-41a7-9a49-dff5a9a06cb5", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490459, "uuid": "f328b985-0aa7-4bf6-81a0-4bd3ba285523", "value": "b1633346a694467b99d9596fe36d0cc88ff1f82f8e86f1c53d3218de1839a43e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1dddbe-7ab7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783506283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506283, "uuid": "1f2da1af-fd95-45bd-90c3-523fa7bf2fed", "comment": "Malware payload (XWorm)", "value": "2930642e3746e02b56a50a543e5fba86", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506283, "uuid": "3edd6ae6-ac34-43c6-ae03-3d97655f2bb2", "comment": "Malware payload (XWorm)", "value": "b222bbed4c43b8f1e9de9af148a29f49c66ae6fe2e49a8ad45669211f7b7c1d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506283, "uuid": "66dcc06c-aa36-4369-ac0e-5baaa3dbf1ae", "comment": "Malware payload (XWorm)", "value": "0542063fc3ab0c97be72722770136d4517aa5995", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506283, "uuid": "25e33ad2-0628-461a-8219-1c4a39ef928f", "comment": "Malware payload (XWorm)", "value": "2e9ab5ad5dc622f61879390ffa2c9eebff5137d18258677e40dd0dfc0ac80e0968c6c7c652dbc305e7eca5df2752f8ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506283, "uuid": "5b4a18c0-1dd6-4e31-ab3b-39d879879109", "value": "T11007F9BDD77A42DCF5FDBC833A1E2325762DA0A8301465453423E28EC5DAF7B06BA161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506283, "uuid": "bc25bdac-43bd-441d-bdf4-652daeff7e63", "value": "1536:iKqEZkqxCTv/wcqH6emZD04Jh9eMNpJGDE/l03O+9RHEHArJsJMgHKaefLJ42bOd:WYAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506283, "uuid": "96416b3f-855d-4d03-8a18-13fc65d7f072", "value": 17168232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506283, "uuid": "d91a6473-3ece-43c3-94ea-d6759e8778ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506283, "uuid": "f48bad7f-f1cb-4a52-94cd-2fd56f7a4044", "value": "AWB#883494406252.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c89927-7b00-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783537726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537726, "uuid": "6f4c6cf7-eb5f-4f11-84d1-cc4b89412491", "comment": "Malware payload", "value": "64a4b10788863ad0924fa6e73d114a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537726, "uuid": "373a7fd3-c906-4af8-97bf-9084cfde9abd", "comment": "Malware payload", "value": "b27070a8cea93bd95ce8dc3e70a69391138f030bc8e48927bcd16d87e492b67a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537726, "uuid": "785b0b07-e500-4a21-bd8f-a9d2dd70aaab", "comment": "Malware payload", "value": "03f56c4f9a1a7ea34ce245e854b4ea4b62398254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537726, "uuid": "b2244cf5-6596-48ea-ac56-93780b7ef5d3", "comment": "Malware payload", "value": "cf5c5460346c8878bca0bbfa4c5cc9dfb6eaad064d3f9105be807ed04f6c3b4b4ade5ba6cdd4bd3b0a1e91c4904debb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537726, "uuid": "f098667e-e21e-4fcd-a5db-1e121949c121", "value": "T1F0453323162CED5F15B5D32845AB9EAA1E700F816848F2BF67192DC6193FF24613BD2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537726, "uuid": "b6751511-0257-4ccf-9dff-b159dd72b589", "value": "24576:NfFA72UdMjbGrQFqbE1cK5lxT2Sy6J5+tiFseAJQqgB8+OPzhHJNU0y:9GM+OcM2S1i+uJi+dz7N9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537726, "uuid": "b9dbc997-6ad8-40a8-b6c8-e83e0f53b535", "value": 1278591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537726, "uuid": "beb2071c-1e43-49a8-a0d4-116241a6a42c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537726, "uuid": "e7f4f5e9-153a-4d60-b5db-de453dc65346", "value": "PO6766.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4837075c-7adb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783521765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521765, "uuid": "c73fb0c7-9640-469b-b9ab-b807898992b8", "comment": "Malware payload (Mirai)", "value": "869bd79459de305a64bc6201150a07f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521765, "uuid": "68275e0f-72e3-4fde-81f7-d0773fd16dc6", "comment": "Malware payload (Mirai)", "value": "b2764c8e1e6d9dd42c1a4e79f9aee49d9c18f265b65a98ca94c1182a60dd871f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521765, "uuid": "9894d284-567d-48db-a61f-4d1ecafe9341", "comment": "Malware payload (Mirai)", "value": "37a1e115fd4e13ea6da7c4ad6201b95e41ee9c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783521765, "uuid": "a7ff29b8-a091-4f93-b384-a3a4bc2f2e01", "comment": "Malware payload (Mirai)", "value": "d71b350e0fc221a81a76733ef24bc56cfe086722f042fcfdac5e5baad571577ec981e586dc94af95a773c6eb709b81a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521765, "uuid": "b233db02-11db-4b44-83a0-c0b7040d6d99", "value": "T1A0B31907BDC18DFDC089C038477F753ED822F0ED0239B2AB67D4AE262D5DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521765, "uuid": "ec1e64d7-c6d0-4e93-9f38-a943682bd3a9", "value": "3072:gHoE9uzAHZeQ9eAT9kkzyQtJGCvR0MeITI8IunX59GSe:gIE4zAHZeQ9XT9kKjGMeKIIX59GSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783521765, "uuid": "65764b1a-0944-4051-a303-89317993e4bd", "value": 117744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783521765, "uuid": "40b93e89-c507-4548-a716-dddb62005271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783521765, "uuid": "72c29b5c-bebe-4942-89e0-002108a528c2", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a0331b-7ac1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783510815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510815, "uuid": "944d6757-4e3a-4b54-ab0a-80385621d8be", "comment": "Malware payload (ValleyRAT)", "value": "37c96034fc004009ff73083b04ef9154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510815, "uuid": "2bac4ba4-4885-4176-8c0b-b7656da4510e", "comment": "Malware payload (ValleyRAT)", "value": "b2d18d22f1aff68fc7fc03c56afa5c1be8fbd93d2f4caad1bff7dfec761b50f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510815, "uuid": "2d603c26-f2e0-4cac-9c4d-16cec48d59d7", "comment": "Malware payload (ValleyRAT)", "value": "74b9de7394b90e8ec53fbcacbd93d735eca84089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510815, "uuid": "8e58cac5-7e6a-4eed-adb6-9cb122413cac", "comment": "Malware payload (ValleyRAT)", "value": "3483904129ba08638d650a8bb9f67f163826b42df57e33fef6fae7ebfae2b82fa0f1839650a1a1753bdbe19c8bd482e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510815, "uuid": "f73b6cc5-587a-44be-b29c-3dfb34a5c26b", "value": "T11A731A29B3A220FDC05AC17966D757B3EA73F83111316BAE0394DE761F94C906F6E620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510815, "uuid": "aa41d7b7-4549-4e25-bdc1-95474774c225", "value": "1e81bbbd3c64d04e0cbd249a934e2ee7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510815, "uuid": "dbd423d4-d7a6-428a-a8a0-e1afab6fb72c", "value": "1536:ZYZIJ2b2yX/3s6hmEOZReAUI7dYVfJubZADdzhoWY:52tvc6hIrTZYVBuKNh9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783510815, "uuid": "18f788fa-a62b-4897-a0fb-dc0bee490c9d", "value": 76311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783510815, "uuid": "a3e6ca7f-7769-4960-89b1-0a445ae0d1e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510815, "uuid": "7a456d2e-268a-48a8-bec8-fee51af29c1e", "value": "b2d18d22f1aff68fc7fc03c56afa5c1be8fbd93d2f4ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1022bfe0-7ab9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783507068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507068, "uuid": "362bc20e-513b-4931-80db-49511005b76d", "comment": "Malware payload", "value": "e64793c5d1d85fcbeef859dd62e50ea2", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507068, "uuid": "a87002ca-a501-48f4-9fda-da154118760f", "comment": "Malware payload", "value": "b2e710a1351a40d27575483ebe16cf0c2c5e3977c36eed9efb6901a49e4688b9", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507068, "uuid": "02f09171-8c34-4f24-b951-2d13c84977c8", "comment": "Malware payload", "value": "019dd64437c3e9a3b0fff0c0b4bf15b9968a6dfc", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783507068, "uuid": "344b2119-7159-40f6-be71-76500e3730c7", "comment": "Malware payload", "value": "509158a3fb9cd5b74d9d545433088ac49664a878b257fe87c9e25f25e48c7b9b3a158a3f5f5ff4b1e7180eca25fa415c", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507068, "uuid": "7265e62d-8de4-4e26-a740-855357a34865", "value": "T1BD850280EE5A0D9DB7CD73FDA990814EF724F5A243B8C8BC9A7C5867857D5CB10E2221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507068, "uuid": "7f35b095-fa84-4baf-af60-e08e683ce32e", "value": "49152:v/YtW5afYTM7KS0gv3ewLthldBCfNGmBOENz:Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783507068, "uuid": "562573e7-0c64-458c-94ce-1a219bfb8ade", "value": 1755264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783507068, "uuid": "a12b12f3-5f3b-43b7-b69f-31c8be37d9b2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783507068, "uuid": "45d08d6f-7bbc-4557-98cd-18d370cefda2", "value": "audio-driver[1].hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897448b8-7aa5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783498681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498681, "uuid": "3cde5ddb-790b-43b5-9b3d-f39e0d17c5e9", "comment": "Malware payload", "value": "a769f64a4df6f300c96a6be08a2be714", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498681, "uuid": "b056ab46-7561-48d0-bb4a-bdcafa8f65e0", "comment": "Malware payload", "value": "b526eb0e34074e2d8815385202a96fe85cd70fcf084a56675250fd378d133b6b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498681, "uuid": "462c19fe-5c16-4b07-9951-ddb6acdce943", "comment": "Malware payload", "value": "9cbe36ff246e151b098948fc9bca0365f2fd2ffc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498681, "uuid": "1a341c4d-0c16-451e-8c24-eb732eed28b0", "comment": "Malware payload", "value": "b70f76c54ef28fc993eab66c4138ca01fb06af5500b5fd6fd34259d5f48b9bc1ef15ab6a099833f100471589feef138f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498681, "uuid": "d12e00fc-52c4-465d-b9a7-f4a20f35045e", "value": "T12B337D6516857C14AA99C8365D7F2F0CBCAD43E6314491EE7FCE3CF28C4AA9CA21971C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498681, "uuid": "044c2371-d24d-4256-a13f-7826763c4881", "value": "768:lr9NyXsZztCD9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:tHusZZcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783498681, "uuid": "2bbdffe9-07d1-4365-af37-1fd0eeea0b34", "value": 50394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783498681, "uuid": "58bebc7b-01a3-45b5-80d7-1ef811aded19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498681, "uuid": "0d4c2295-76eb-431c-9f22-fce06f356817", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b78d262-7a67-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783471895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471895, "uuid": "249a406e-2245-444c-86f8-c9bd5da1faf9", "comment": "Malware payload (Mirai)", "value": "5fa99938af45a5279d07d97e6974f192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471895, "uuid": "161c61d8-e336-4590-8188-aa9cc2c52ea8", "comment": "Malware payload (Mirai)", "value": "b60a4c6391bcab56d7b152aabec161ef462ca4a3dd5469019aca5b45a4b09c91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471895, "uuid": "234b9392-793a-4a10-90dc-9e3a9148c5a3", "comment": "Malware payload (Mirai)", "value": "fa3a6005518e553a06ddd98c23ada17d9187194f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783471895, "uuid": "7182f886-17b3-48c4-910f-e9710f12a417", "comment": "Malware payload (Mirai)", "value": "4a434ba78f53be975f089598a37d2d60460b5f74057fd8e172b1352ed0a64575998561e85fe66654aa093fbf6d8267f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471895, "uuid": "8583235b-7999-434b-a4ee-9ec94929cb9b", "value": "T14D73023CD9337CAA6C407A27A8060FC0264A657CD0E5A45F8AD44118AC9CDD96F7BEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471895, "uuid": "d1ec74ac-58b5-46ef-a3ab-d8d778ef0355", "value": "1536:0C63v+lqi/A3n9OHtOuu1m/LO2FosZr5PKTi917LcrAf4YfCOYCin:0bvW/cQFB/Lf1BlKTi9dLc84pCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783471895, "uuid": "57b68e3b-0025-4221-ad55-c58f3f263863", "value": 74900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783471895, "uuid": "ec0e6288-0e23-4ea5-bc05-006d54b8f3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783471895, "uuid": "900439e6-6642-45dc-be6c-0023ded7591d", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc86e1-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493260, "uuid": "9f2fa5d2-26e6-469a-b92a-25626115e287", "comment": "Malware payload (ArkeiStealer)", "value": "2b71b740cf461a275d26ee1ca31ae89a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493260, "uuid": "7c83890e-ed7f-42f3-918d-5f40a41d764a", "comment": "Malware payload (ArkeiStealer)", "value": "b6cd1a7945bf1268a516a55eafbbddf48e368b495c12bab4b3e9c9df854aad67", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493260, "uuid": "df922bf8-47a5-4256-a269-3f8ca9e120f8", "comment": "Malware payload (ArkeiStealer)", "value": "f5e179cdf2dc104666749c97a5d88b0466e79d2d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493260, "uuid": "1b7d37f7-1941-4ea8-8c1d-b43b632d3042", "comment": "Malware payload (ArkeiStealer)", "value": "8624b812541857c96441ae367ee1896a7e0922070b272d2ceb4e670b09e4959fc645980ce80a05855c531e316dd12833", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493260, "uuid": "600a2623-e8a3-422a-aa57-503774d8f318", "value": "T1BBE57B0ABCE149EAC46AA2728A7651527B31BC090F3673D72F50B3782F727D11E39758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493260, "uuid": "a2111d66-1888-49ca-a32f-7e6b34e3746d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493260, "uuid": "5d8c9b3e-ca85-48ca-b36b-4f028a7c7d0a", "value": "49152:l+8Kj8lHzhK3gwtmpupW0+CWZtE3LkYG0HvoZZBJfPKQP7gz:l+D/tmpz0+TEbkYq37w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493260, "uuid": "f083c16f-fb38-42f8-a7bb-352b52c4bd79", "value": 3088216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493260, "uuid": "20875f7f-1d4a-4bcb-958a-6d6665daa219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493260, "uuid": "379c8a60-8450-40ff-90fe-e9f0b41375be", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40324.4532.6613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47986225-7ae1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783524341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524341, "uuid": "83e6a135-2238-4233-b2a5-a8e1ec5ee61d", "comment": "Malware payload (Phorpiex)", "value": "3c6449c622b14c1eb7d4ad976dc66385", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524341, "uuid": "1e6b5c32-48ed-42b0-b61f-940d1e966851", "comment": "Malware payload (Phorpiex)", "value": "b9094cad28a8c4b6d355a9bcf33c405622e3320e484da07efcaa2a3e99ee8c55", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524341, "uuid": "b15524a9-06d0-4b90-addb-6d9c2952d3cd", "comment": "Malware payload (Phorpiex)", "value": "3fb9319ba2768b74868be6839ede3873764cc926", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524341, "uuid": "f5342472-7756-415d-bdab-cd3814cd8445", "comment": "Malware payload (Phorpiex)", "value": "65ef984e3ea2ac6b6788ff43a0db5931be4fb1f83f2f8cc6ef375cf621256974439080c696f97c4b9e3fc4a6e1cde692", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524341, "uuid": "e19b2f76-8a39-4d22-891a-02772adff763", "value": "T18A825C0FB9424726C0E210B49676863BDA786871338854DBF7944AED0B686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524341, "uuid": "0d03bfdd-addf-47e1-af4a-098f101c0f6e", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524341, "uuid": "690f9bdc-51f9-4082-a8af-077e9d6c22fe", "value": "192:zaISCngTBvqQ1jV6lXwIXZ5qh4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdEFWEo/Gb:/IqQlV6lOh40uu9JgFtfUhav8U9cPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524341, "uuid": "d3861559-7ba3-42a7-9b58-e90a18a6760d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524341, "uuid": "7518ec63-9b6b-4823-8821-5d5fb23542cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524341, "uuid": "45c4df0f-4443-43ca-88c9-35db385f20d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb0d067-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493264, "uuid": "361a147d-f68c-4fd3-a358-008fc640c28a", "comment": "Malware payload (ArkeiStealer)", "value": "a6f68561504f2d3af0161807e167a71d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493264, "uuid": "02f1dc48-54fe-49eb-8437-37e9813f30f3", "comment": "Malware payload (ArkeiStealer)", "value": "b9f4913add84ff01bec5f0f238e719b5128b7efc578118c5fac4f881fb97167c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493264, "uuid": "5c1a7d74-28d5-4881-bfd0-a8e94e2bb83a", "comment": "Malware payload (ArkeiStealer)", "value": "ddc96de60f9ec3d9983dce9663efd5817acc93df", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493264, "uuid": "62d187db-d3aa-41f5-a6ca-692a60d37d46", "comment": "Malware payload (ArkeiStealer)", "value": "eba524749093d0fa71b4e1143ee0c96bcb6d53438b5d15271e05d4989c9043862d9e287a849eb771691be6af8fd7f2ad", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493264, "uuid": "5aa8590a-48b6-4e3b-b3d3-ad16ca1083de", "value": "T178D59D0B6CD009F9C4A6977589B691927B70BC4A0F3227E72EA0B7783E72BD58C35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493264, "uuid": "c4d82fab-cbcb-46b4-9c0a-7581874fc2fe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493264, "uuid": "f8cfea06-9d0e-4b22-99f4-f97e803c5537", "value": "24576:2Jv6o22NNqNQXUN+IvJCpQDK2XI2W3gP7zBTSH+KC1Fc0/kY/8wQxQYHNzV9qcoV:2Jvr2kNVUMIRSspXkwdWQryQmHI+d4dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493264, "uuid": "a14b6aba-9107-424b-b659-b34ce3528d47", "value": 2936176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493264, "uuid": "86142f6a-b9bf-4859-95a4-336620241dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493264, "uuid": "d01f078b-fd96-4ccc-966b-a2038c63027f", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40298.1267.13505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6022b7-7af5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783533130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533130, "uuid": "d5e51d24-cda7-4fcb-adf7-b0a6beca7935", "comment": "Malware payload", "value": "4e80637cbb489ef5db4b98933f5a98d7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533130, "uuid": "045260be-5384-4074-ab09-5fc1aff78b93", "comment": "Malware payload", "value": "ba1584ade44b7285a92de901daca752a433e8411c1efd6dfabd716ce737d10e0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533130, "uuid": "4a98d5d3-0b16-4fef-9810-2dc98de5d140", "comment": "Malware payload", "value": "5d7c1ff0502ed97cd1474bc731e92da16f05bb71", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783533130, "uuid": "5ebc486a-6228-44c5-a6d9-c7d760bc42a0", "comment": "Malware payload", "value": "6ca2de7bbca8bd517c317a752f1ec92b473ceac2d6a1eacb7741517cb2ff67106dcec69690caa4de216a04f95048e6ed", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533130, "uuid": "9e310d54-749d-4334-90d8-0ab50a3c3049", "value": "T156E63398B6D005EEF6F58038ADE35AD2E9B6B4721732CADF131C82666D172E00C39757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533130, "uuid": "0b39a982-8ed2-4675-af7d-cfe3395d0395", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533130, "uuid": "f9d5064a-9344-434a-b8ca-75756a54a4e8", "value": "393216:LoGhgOFzABiibFWhTM7XMCHWUjXxcuI3/PGTAI:LokFQFWS7XMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783533130, "uuid": "62d9f6e6-0e61-4ec8-ba13-fe6a19b6a7cf", "value": 14318985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783533130, "uuid": "6b34e498-c4db-47e0-a95e-d1a435a64902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783533130, "uuid": "6adcf6d9-a493-45cd-b645-b6c8a9322de2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7149a7ae-7ae1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783524411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524411, "uuid": "3a6886fd-ff8e-4c95-900f-734db2047bf2", "comment": "Malware payload (Phorpiex)", "value": "57b6d1f329f4c3304bd64faf34819c17", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524411, "uuid": "c6c56b77-aca6-47c1-994f-06ba3b10c7f3", "comment": "Malware payload (Phorpiex)", "value": "bb3f88e931cc18549532c45897798927fea51e14265714c097cb1af623a65e00", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524411, "uuid": "6d86e11b-54f4-4d76-8170-4f014c648832", "comment": "Malware payload (Phorpiex)", "value": "35113a27584a19b8561301d13aa0b4088eaf2735", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524411, "uuid": "8daea676-edf9-4461-af10-04f6f0ab22ae", "comment": "Malware payload (Phorpiex)", "value": "494b0e8c890addc3600a0a20cdd567e165fdb3bc05fa14cda74c39c95550d5accee4010a1073bb70a89481be05338a25", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524411, "uuid": "0cc1bb55-a7a6-4c8d-b794-37b6cf2a2fdb", "value": "T163826C0FB9424726C0E110B49676873BDA786872338854DBFB944AED0B686D6FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524411, "uuid": "39bea660-2deb-40da-af3a-dd7f9cc7c721", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524411, "uuid": "b72ce1e3-c73d-4e5b-9640-2875b160e11a", "value": "192:HaISCngTBvqQ1jV6lXwIXZ5qh4le6qo/fKUSiu9zw+gj5tKCgbOBqmEdEFWEo/GU:rIqQlV6lOh40uu9JgFt2Uhav8U9ckF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524411, "uuid": "3a75215b-0cbb-481a-90d7-7b59e2face6e", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524411, "uuid": "74a56149-7d4c-4cd8-9c99-6bbbcef1fb36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524411, "uuid": "87ac7742-c7c8-440d-a609-aceb967e8179", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa77966-7ac5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783512481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512481, "uuid": "14f43098-c7bf-44f9-97e2-ce7befd2c874", "comment": "Malware payload (Formbook)", "value": "1f347e61681032429ed53da8436c04ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512481, "uuid": "bfb41d67-c5f9-4bdb-8a49-f0eecca99732", "comment": "Malware payload (Formbook)", "value": "bbaab660f1d2468b7198fd5e7cd53aed7ebc8a99d5bbdbd7fc5223758e114117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512481, "uuid": "93c68f26-7af1-4916-b974-77da70c8be90", "comment": "Malware payload (Formbook)", "value": "dacf04059818a5454856e12c29611f64c143607b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783512481, "uuid": "7ac2de05-c9a5-47d4-88b6-18a932a2aeea", "comment": "Malware payload (Formbook)", "value": "6d7c6622eca6058c3293a5b7958eb1dee3fe37a38112fdf54211d768b29d86eb316b01a01a2ebe324b800d70ecf545f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512481, "uuid": "fb28f017-74bc-4bba-a07e-e694064855fe", "value": "T16F452360BF786D5A427CD374706B9E6A23A0471E844097F2F3AE74C21356F8ABE1F419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512481, "uuid": "fc3ee76b-f7f2-488b-9e32-bbdbeeb78341", "value": "24576:5ONTDmztg9GUeIqObrp42zvhvOCgB4jMbTA6rhrlbi4qkE6z:5OBQq90OGHB9V9bbEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783512481, "uuid": "909e2438-1663-448f-9724-52ad8ed20051", "value": 1279853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783512481, "uuid": "f59149c7-6264-4a15-8da8-58273767dab6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783512481, "uuid": "bb9e60c5-2839-4c00-9306-7ff25dbfa83c", "value": "Supply chain inquiry attached requirements quantity.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb0cad0-7ac2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783510954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510954, "uuid": "68ecc2bd-d644-499d-a89d-19dd4df2f291", "comment": "Malware payload (Gh0stRAT)", "value": "2012d1a323722a43d8c4c7f1e3dd650c", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510954, "uuid": "8d9a7345-eb89-4665-84b5-5d5630406381", "comment": "Malware payload (Gh0stRAT)", "value": "be33857b248abf63e9a1883f5369ee14f34c274e2ad82908ffde00477cc4cd2a", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510954, "uuid": "39a31c13-be79-4144-bfda-10b39d37b6b4", "comment": "Malware payload (Gh0stRAT)", "value": "d39952cd252601f4f12876d189ca0718fe6c9285", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783510954, "uuid": "249771c3-32bc-48f2-9a2e-e13c3fc7246e", "comment": "Malware payload (Gh0stRAT)", "value": "b12a01ae84dad78628f852cf7e4e8d034615b0e6f4e0b7e024be75ea25ec664cb6bd8b6872c929b909ee60531ec20e16", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510954, "uuid": "05284172-698a-49c9-b131-b2fc2a3a9fc9", "value": "T10B0733335DAEF4645FB6E605DBC82608BAF262E73853B566931CC4F2D74985760E32C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510954, "uuid": "78336068-e36a-4160-8066-08cdb30447d4", "value": "393216:JMBl/oqHkU1YI3T/nPsxwL60vjgQtetsHFqKbBYslshNuimUoztgp:JMb/1H3TnPBtetmFqKbqsYNIUIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783510954, "uuid": "1513f4e6-f215-430f-980e-3d439018aea3", "value": 17702059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783510954, "uuid": "68f0e49b-e8d0-4617-90c5-a4696cdc9ec0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783510954, "uuid": "8a08ec14-1c59-455c-b0f2-5b70f69fa5da", "value": "Important_Notice\u179b\u17b7\u1781\u17b7\u178f\u1787\u17bc\u1793\u178a\u17c6\u178e\u17b9\u1784\u179f\u17c6\u1781\u17b6\u1793\u17cb2026_07_08_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83c186a-7aa8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500129, "uuid": "50bb4126-beb1-4eb9-a7e4-86a0f1aaab9e", "comment": "Malware payload (Mirai)", "value": "95d4e3be0424f5c3b4c92f820820e351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500129, "uuid": "433249f3-9bc1-47fb-b79a-9a56c981df27", "comment": "Malware payload (Mirai)", "value": "be5c0d1d63138e42741950fbd2944f306b46f5048a2219906c8a5b1b0ed6c099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500129, "uuid": "9061d3c0-3a1d-4d4e-b3c9-3d88c49d6fb4", "comment": "Malware payload (Mirai)", "value": "4561659acf09059a6e705c5a76c773fcc3600b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500129, "uuid": "bdb280ee-cd1d-4a52-b9c3-aa63d8febaef", "comment": "Malware payload (Mirai)", "value": "847afa6c65e1d433b48434fe36a31249a8244f4cb8fc7a482d08d41661f669443f082973295155ef63488785edb2c76b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500129, "uuid": "a9d9a142-51d3-4a9f-8a19-571ab14ed40e", "value": "T13B23F18FEBDF0779C61EC3B274B8E7565C19AB6867102A98C2CC483D4C85FE45E28A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500129, "uuid": "e2ee8de3-4070-43ca-8790-e4abf9f1d431", "value": "768:wF5cHOiG9r9JJt5ccnVNIeJFg4VDUJX087nrRdSMujg7Uude79aJnbcuyD7UHQRT:wcHOiG9JvzcAfjg4lUT7rXbRCaJnouyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500129, "uuid": "d61844cd-7f73-4609-9b27-f5877b4d99b9", "value": 49088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500129, "uuid": "a3cd182d-2ff7-464d-8311-e783fee01e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500129, "uuid": "b60549dd-a409-4cdb-aed8-4b8a866d8acb", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ed52fb-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493256, "uuid": "0926dd4c-45f5-4f56-bd51-958b49b5ea74", "comment": "Malware payload (Vidar)", "value": "2a0c2ed95964cb00a0f7f7f8e01c573b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493256, "uuid": "2a35d572-1f36-4c5b-b4ea-ab20b4009a58", "comment": "Malware payload (Vidar)", "value": "be83ebe9f3cd0d2a84f92fba0ed2f7d5810369b5c1c9ef672edfd4f09aea3b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493256, "uuid": "e402c340-ed3a-41ed-9af1-1ed51670be42", "comment": "Malware payload (Vidar)", "value": "bfb817c34b00ac778b90b4bb3890a5c34f2cfb82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493256, "uuid": "4de1d2d0-bc0d-4e4b-adf4-9a32557b97fb", "comment": "Malware payload (Vidar)", "value": "624a3f384c08e9df57a2e3e9f87facb5585c9f107aedfed8d973f3ca69fd38afb6b7365966ec01105cfb447f1357ff59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493256, "uuid": "45a98fa6-dbd4-4110-806c-94096f282ef1", "value": "T1CCD59D076CD019E9C4AA973589B692867B70BC094F3633D72E90B7382FB67D09D3A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493256, "uuid": "f44cdd0b-69d7-4d80-905e-1a332757565a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493256, "uuid": "4b2ea7e7-ac5a-4de8-9d84-97dfce2bd579", "value": "49152:dWC4Pxm9Y8Jn4wkXbQ1y4BpxxzUm97gjGSy:dW9hfGVCmd8GSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493256, "uuid": "8182342e-d558-435c-8572-4fe008429469", "value": 3015504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493256, "uuid": "45c6cc35-f4af-4a87-a1a3-fb2d09205d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493256, "uuid": "d9842dbd-efb9-4668-a74d-ea1bf4286ed9", "value": "SecuriteInfo.com.Win64.Evo-gen.36453766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260fdcc8-7ace-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783516124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516124, "uuid": "00e75937-a00b-4b93-9d26-5385d75ea3a5", "comment": "Malware payload (Mirai)", "value": "66e234d4c0989d0a44c3664532caff4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516124, "uuid": "f77805ba-6d4f-4707-bba9-12d8958f3d6d", "comment": "Malware payload (Mirai)", "value": "c15f26291a17fe1c8464b1522302acb5c860cc50bbd6a7843f6c51c90f27cc36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516124, "uuid": "9ebb507d-f5dd-4cee-8c04-89fc7c5337ae", "comment": "Malware payload (Mirai)", "value": "cda3b028fb7bb6a4c8451ffa92b741fc9a10e2eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516124, "uuid": "6f647902-0d86-49fe-8651-60ddfc23576a", "comment": "Malware payload (Mirai)", "value": "2ca26a68bf7bfdd10733b995a433ba66e7ed94bfb19e25328c8884784903f842fc7bed679566c735568bebc62960809c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516124, "uuid": "59a6659e-3253-4b7b-a6b2-092192b1ae46", "value": "T10CF3F805BB610EF7E85FCC3706E9270128CDA51622B97B36B534D958F64B28B26E3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516124, "uuid": "e8d4f8f5-b7cc-4e88-9a9b-5889c85984d9", "value": "3072:ldrx+vzsw8TONAdQLty5l6Gm7UxbiuyZ6RlPP4FQQm8DrfIHR:lJx+vzXUONAdQLtKlTm7UxbiuyZ6RlPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783516124, "uuid": "c429989e-4b3b-42f2-8e0b-c32598bf4d59", "value": 161084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783516124, "uuid": "ff531ec9-de63-4e7c-a682-9e55ce921b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516124, "uuid": "9b0bde8d-b752-4f88-8b88-feb1deb51477", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadc9fd8-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783473102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473102, "uuid": "c7109334-daac-4e30-9f57-7e4752a9f5e2", "comment": "Malware payload (Mirai)", "value": "accbdfd3ef6223ea852cc6ae6bd76e85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473102, "uuid": "b990c921-1f33-4c68-ba9c-4cbb5e16e817", "comment": "Malware payload (Mirai)", "value": "c18a7f266c4e1ad9447389bb6911539cda1b59a03d795c7932070aee5fc27ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473102, "uuid": "f510d8c9-79fc-488e-a6eb-fcc298a008e0", "comment": "Malware payload (Mirai)", "value": "17d5663ecb7440b165af6652967a6c904ca94a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783473102, "uuid": "8c179d8c-bae5-4bd0-92d5-fe0b11a63eef", "comment": "Malware payload (Mirai)", "value": "16176812c642d713ef20b8f87fd75882b8109f4ca71706d1ef9539da66e91759c86cdbba264efa7d6a571d0b9f904e9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473102, "uuid": "2d38dc93-a09f-43c7-832e-2c2ce1b1efe6", "value": "T16223F12811F66E65B21B86F7195EFB1E2B2471052721D5C735E0E070D6E3B3A0F2C7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473102, "uuid": "cc1fb739-4679-41d2-9670-e910e4cd15fe", "value": "768:mYcUTiSFnR+ZW54r03UK12jc8/xCrNhRQeccxdk05pHFFGxhUWVuA5pMuMwcnbcY:mYcUTiMnR+1rKm9gTRRcyplFGxn3563N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783473102, "uuid": "0586a4b1-3161-43b7-b179-1e36dd3fdc9a", "value": 49092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783473102, "uuid": "b5f9ee42-647f-459c-ba3b-f86651dc991c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783473102, "uuid": "5ece457c-4706-499e-9151-bf1325476118", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfeded33-7a90-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783489807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489807, "uuid": "1b108383-957e-4a3f-b3ea-0555235fd5fa", "comment": "Malware payload (njrat)", "value": "9adc8a42c4a0b4ba87d3e3c73692df99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489807, "uuid": "462acefc-1949-4beb-95b9-97852ecfbb34", "comment": "Malware payload (njrat)", "value": "c271ef84a99a459a81178e5ce6ebaef8a4b29dd4ce3e8703ba34795945c97394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489807, "uuid": "c888133c-a5aa-4db0-8493-e1ab363a2df0", "comment": "Malware payload (njrat)", "value": "18cd5b6bf236f9895d98b650def1e5107b9efb5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489807, "uuid": "3b3661ac-d1c6-40bc-b8cd-823daab33107", "comment": "Malware payload (njrat)", "value": "f5b6b4d4d55c2360b94a22bf79050361a84943c09ca89bf876317aeba6d94d51de716330fc1a3494f0785790bbcfc239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489807, "uuid": "9a69c182-c9e5-4af1-a23d-913973a9b7d6", "value": "T105431744BFEA4A05E2BD8F3468F649150634BA63F532EB1E48D568DB17327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489807, "uuid": "32885811-6634-4b98-a7d9-872e62df491a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489807, "uuid": "de47a4a5-d3fb-4796-a2f5-2804ef5285d2", "value": "1536:4QxyoDns0NSiS36YDOwsNMDdXExI3pmam:LkoDngXKYDOwsNMDdXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783489807, "uuid": "fc9e41f9-6b53-4084-9019-a222a67221aa", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783489807, "uuid": "be143a93-3eaa-4ba9-adb9-9f4045f36577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489807, "uuid": "68f0f449-a52d-442e-982d-f5b00a6fc8a3", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4a9df4-7ab8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1783506823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506823, "uuid": "4433394b-8a3a-42b4-9e78-a01e2c558628", "comment": "Malware payload (RustyStealer)", "value": "7761acb48be1cd42e4264db306e25d48", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506823, "uuid": "efa221b5-1faf-4d6f-85f9-70e70d469942", "comment": "Malware payload (RustyStealer)", "value": "c30b085c645353e953ac7a2d68a64e88267699d19acad84fb402a332e6a23de9", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506823, "uuid": "d81de3f9-5a19-4b98-be4d-dac8be54c787", "comment": "Malware payload (RustyStealer)", "value": "bd6babd3e84e68625a0dcb985d35a5561397d0e2", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506823, "uuid": "b26a2c79-7710-4169-a3d2-8d1032149f7f", "comment": "Malware payload (RustyStealer)", "value": "7afb010068c150fe93400c402aede515c288fae9a4ff39f248e8a270d2207bc3c2e9559ba2aba7eab23d2c88f6c02637", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506823, "uuid": "dddd675f-e2a3-41a2-b692-b147afd40e7d", "value": "T189150112FA8448F9DC67C0F88B3505269632B8850B3166FF0AE496356F37AE19F3D359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506823, "uuid": "01f5e7f7-2110-449b-b488-ee06c1bbedf8", "value": "77bef53250975500e8f81d28146652c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506823, "uuid": "b5f5e7cc-e71b-451c-9da3-463e69bf5665", "value": "12288:2id7vUz8F5QnkshBsSr4RWCK5a0s5Qrd4qYz/UC4HZ5fe8b45iC3rd+H1wAPGZ6:2Ca8nQnkcD3tfbrdmabaf3RqTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506823, "uuid": "2fbdaf4d-4c3b-4d88-a5e8-a40691b35f99", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506823, "uuid": "1ca1e8e5-157c-490e-b074-6b84f709d439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506823, "uuid": "37ba9cf7-09c5-42d9-a3fe-8401b9064e44", "value": "c30b085c645353e953ac7a2d68a64e88267699d19acad84fb402a332e6a23de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96e7a76-7b0f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783544262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544262, "uuid": "35ce8193-c905-4388-b3c7-6f2993faa371", "comment": "Malware payload", "value": "0f30a03c6c64abd41e39c0d8a1ffb82d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544262, "uuid": "79100060-1522-4ccb-afc2-d90c11cd85aa", "comment": "Malware payload", "value": "c42efce06828bad12c8cdd0bec51780d3b2504216d50b49498de63333678661e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544262, "uuid": "2bd48673-09f3-4899-ade1-95ad1befad28", "comment": "Malware payload", "value": "1cb28b3bca8a41920c1ddbf297cccf03b5846a28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544262, "uuid": "04499147-8937-4167-91e3-d7d04cccab27", "comment": "Malware payload", "value": "ff10817605eac260fa427f38f6ebab13654fce5f863b7bdc5025bd80d6d56bcae08a04d0e38cb70a14445eb5c0254024", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544262, "uuid": "385b2c1a-04ec-499d-a3bd-053ee09e4645", "value": "T1EED61863E8D62698C4EE8570C672817BBA713C491B3823E71790F7246B37BD0D6B6B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544262, "uuid": "7ffa4895-e3a3-403a-980b-e663af99ebe7", "value": "98304:7CWzcWloZNzCOL93U2HuP1PeaCoKFOREndhck3NGIQNeBE:7lToZNzC23rQ1PeaCo3cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783544262, "uuid": "29837abd-2d5d-40ad-a05a-0a345fa88c68", "value": 13134112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783544262, "uuid": "2488990a-c578-4ecd-ba1c-7293e2a01461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544262, "uuid": "c3388082-7b78-44b5-998b-50fff27113b8", "value": "kokuryu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37c0f0-7a96-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783492111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492111, "uuid": "10f11136-8fa3-4f79-99ff-209cdfacd3da", "comment": "Malware payload (NetSupport)", "value": "ee972bd36e37c1e0ab5e09b18b0d75aa", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "eglowpe-com", "colour": "#F4FBCE", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "marshaamallow-com", "colour": "#473AEB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492111, "uuid": "c3f84e3a-b4eb-4b3c-9a4d-c0b9c7b059c2", "comment": "Malware payload (NetSupport)", "value": "c46684753c0e86e0fc5aabf24fa2d9d02b26f957027938767c3cfa5545c1cd44", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "eglowpe-com", "colour": "#F4FBCE", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "marshaamallow-com", "colour": "#473AEB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492111, "uuid": "0719ca6b-3400-489f-9df1-a8f3984a68e5", "comment": "Malware payload (NetSupport)", "value": "a22c8b3078a62b754d8da0ce395cce83fce3a7fc", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "eglowpe-com", "colour": "#F4FBCE", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "marshaamallow-com", "colour": "#473AEB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783492111, "uuid": "768a27cd-577f-406e-9772-f9daa346c6a6", "comment": "Malware payload (NetSupport)", "value": "966f36019e5fd5506bd8f84924cdcdd42798555e9ced4d75bd2b0e39628c345411d39a45be1beb86d2caee998f438662", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "eglowpe-com", "colour": "#F4FBCE", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "marshaamallow-com", "colour": "#473AEB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492111, "uuid": "2cf43bc7-819a-4789-a655-05b9cfb46b06", "value": "T1CCF5335B5E09058BCD9B4DB8D05E1B24E37D3981F25DB142B2B28253CADCFEB47A431A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492111, "uuid": "7fa79387-394b-4ab2-8579-78067fb31078", "value": "98304:pw8MZE6J4oquNtsShGy/VYj3b2+30/wB4Vm:GZnTgSdQy/2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783492111, "uuid": "8b802948-997c-4f8c-9bd9-463faa235e9b", "value": 3389262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783492111, "uuid": "13e8e2a0-23a0-435b-ac40-cd3b53e0199d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783492111, "uuid": "12868928-5d04-4401-bb0b-efe55997f1b2", "value": "ColorsPaletteMeta_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a07a36c-7ad4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783518735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518735, "uuid": "be925b51-547d-4e50-8718-55529c532250", "comment": "Malware payload (Stealc)", "value": "fe2226cdeb007a5b1f5aa13e042d9b11", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518735, "uuid": "a70a1396-e5f0-41ce-896e-ab3d78d10037", "comment": "Malware payload (Stealc)", "value": "c4ce7dd05a3865b7d16a33adc9fa57d15a221abb83cb57fad43e947bc0a17eb1", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518735, "uuid": "87656fab-c797-4222-a86f-d8c0892cbedc", "comment": "Malware payload (Stealc)", "value": "f5088b617e231c7ea495c78deb83813dd5f98ef6", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518735, "uuid": "52c23ec9-5bde-45a7-a22f-88e9a196a26c", "comment": "Malware payload (Stealc)", "value": "1bb7ed134c0e26db2abdb84d1c864b75d7b01db06de71d4adea0cdd38358446dba42e1abfa6ff062939fe1bfc8c34c56", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518735, "uuid": "d5079944-db5c-47d0-99b7-82c695202865", "value": "T12DA5235A23D550D6E4B5C730909302E66A317CB153AAA6EB7184EEFD0FB3ED0E131B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518735, "uuid": "fb8ee7c3-2840-459c-9777-71d992d7ab27", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518735, "uuid": "dfb11da5-3e60-426a-8ed5-7cc69adf1966", "value": "49152:UrnjtZ17DLFVZUJ5aj0EIZqBfSDblvTsHXtAJSy:UrnjtvlIajSZWfSXlsXtAJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783518735, "uuid": "a6612e0f-80c4-439e-87b1-932b61fa1dba", "value": 2174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783518735, "uuid": "008d9cdb-9a50-4733-b5cf-87cf42d2719f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518735, "uuid": "ec81e286-d239-4286-8582-1af3540ffba0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d6bb86-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493219, "uuid": "d0579cac-d63e-45bd-b15e-b2ea43fa08ae", "comment": "Malware payload (ArkeiStealer)", "value": "a82ed90563d4d0f6c74ac397088bffe3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493219, "uuid": "f0d81188-ca02-4806-be59-33d3999c7981", "comment": "Malware payload (ArkeiStealer)", "value": "c5f481f7023a4b9ee28b83be862286264195ab77e353d999dbf6debee05daa09", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493219, "uuid": "56fac1e0-842c-4ef0-9bcf-c2121f8901d4", "comment": "Malware payload (ArkeiStealer)", "value": "978bdbfbacea25894e669e53883abd30e235927e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493219, "uuid": "604a4885-ffb6-42bb-9d5e-f6cc84864660", "comment": "Malware payload (ArkeiStealer)", "value": "e76f0b65aaf3da1d91c08a05cc1d94c32b0c5c0bb1103e710dfe39fbc285d7a945de851f231c00f8edc439654d3ef618", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493219, "uuid": "19afcc91-6eed-4052-b880-f63bf7326239", "value": "T1C1D59D077DA449E5D8A9A33288B652567F70BC494F3267D32E90B3382FB27D09C39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493219, "uuid": "c2e865bb-0195-4512-8c31-740176066611", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493219, "uuid": "0fdbe3bc-956f-43f9-9152-e9a2d793bacf", "value": "49152:7EWnMeJn6YJKSFQVI2oM1Ea2xQFpc6p4:7E3hSWI2p1EaqQFDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493219, "uuid": "a230ac90-796b-40a1-a48f-3810443cfd1b", "value": 2980200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493219, "uuid": "6de14eb2-e21c-4544-8a64-3f76b07cf338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493219, "uuid": "467c5b0b-73f7-445c-9e16-e35ec07d0f9f", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40330.7434.25360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cae1b1-7aaa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500767, "uuid": "9603447d-24f5-41e2-8dec-f7de116f1d77", "comment": "Malware payload (Mirai)", "value": "789c54a8b557d32e7dca881d06de3ab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500767, "uuid": "96e29b34-6f87-4dd3-9542-79df43173b2c", "comment": "Malware payload (Mirai)", "value": "c7f1d6bbcd6e90be086547b367b5a612535d235fb83f6dbc9aff049494db2238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500767, "uuid": "48e615d4-9477-4d71-ba30-7033f71e5bc0", "comment": "Malware payload (Mirai)", "value": "b9ac5162b8621df99769da261d6330b584df5691", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500767, "uuid": "88ce8bef-91f4-4922-85d2-3d813a64b2c3", "comment": "Malware payload (Mirai)", "value": "5a6dad3039e976518ccbf4c22aae20f1772b7f0d2c18811b4d1ef4bbcc34d00af92e9d33f173f2b6d8c605c14d999454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500767, "uuid": "7aaf9978-af19-41b5-81d9-1500a8f04b72", "value": "T123B35CC5E243D0F5EC560534213AFB379E72E4BB222DDA43D7B49AA26C56AC1C80679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500767, "uuid": "81e5d7fa-f06b-4012-91b3-4e6c50297db2", "value": "3072:z9dZKG+EwOmjx6D9242XWE2tRhC5bRHo3Hc+M:7ZKG+Eajx6DYYEC4ho3Hc+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500767, "uuid": "54fbbd21-bc48-49b6-99e7-1839c8d90693", "value": 108116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500767, "uuid": "b2934d21-8da1-4872-a586-1138aa645d6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500767, "uuid": "9fdcb860-6d21-47f9-a97a-d5cbaa5adb12", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a97349-7a72-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783476692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476692, "uuid": "3dd39e37-8ac4-4ac9-9ed4-080b6eafc87d", "comment": "Malware payload (CoinMiner)", "value": "92b274e8cc85fe15f8ddf066725bcc69", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476692, "uuid": "7a445d38-bc20-484a-af66-af4c324f6636", "comment": "Malware payload (CoinMiner)", "value": "c8415587863d57e1cc4aa543ee9c0cb04ec486f031b49f2d7448631c4a5b29da", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476692, "uuid": "79a0a3ca-c036-4452-b2af-3ef55c0b7324", "comment": "Malware payload (CoinMiner)", "value": "4e0d350ebb2ab380db1b1fbf4d5f99a3d4559436", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476692, "uuid": "7adacaee-90bf-44cf-b8df-c18872a092f9", "comment": "Malware payload (CoinMiner)", "value": "f3f0b747998755d55db8aaeb6b7abff528cae1a2f2d9fe63dca46fa7d1bf09382e3bbf985755d64964716ba22d7d8303", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476692, "uuid": "6db29882-b4b3-4270-baff-5921a4d7dc5b", "value": "T1E5320729FF4A0331E3A489F45479828BA57D5623A397E3EBF333965E4E552448800E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476692, "uuid": "94b8c3e1-411e-4475-bdca-3118e38ffee8", "value": "d9cdc56d00b82d68dd1cc6a7338127bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476692, "uuid": "785a1f8c-8754-451a-8b86-e1099ac4b824", "value": "192:FM0o92WPrBxl+W4OX+PFJxTEZmFhvScP:FPoDf0lOX+PFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476692, "uuid": "3fbc0797-c241-4d7b-9ce8-14a1a225478f", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476692, "uuid": "17db889c-7233-4ee7-9569-a11245a24173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476692, "uuid": "7a6dbfda-b160-442e-a6e8-b141ab6b90fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be76000-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517154, "uuid": "9d382083-9fad-4eb6-965f-69813895d69f", "comment": "Malware payload", "value": "2f1e4fd2937ccf825a555204b1741f89", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517154, "uuid": "dd48ea06-acb6-4b4c-92f0-ad1b0b5c17e7", "comment": "Malware payload", "value": "c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517154, "uuid": "b6f54db6-cd86-4b8a-8c1c-db82d96322a3", "comment": "Malware payload", "value": "e30f1c194b0c850eb79b4bc39084c75b6aea423b", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517154, "uuid": "4976957f-eed2-431e-b8f2-d86bc822dcab", "comment": "Malware payload", "value": "800f0be5d125975232293f97a91012c08e94c84b6b7d9167ef560de29af0aada6bbbe7ec2eea957a0144ad892525d2ca", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517154, "uuid": "0c849892-7463-4c02-be95-26ca66b5e311", "value": "T1F2D1630267F94616F1FA5B382EB253659B35BD529E31CF4E0654011E6D32B808AA2F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517154, "uuid": "77eb92eb-7855-4540-9122-5d41f0184d35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517154, "uuid": "a17d4662-63d0-41c5-97b7-5998a5751f66", "value": "96:8xhSA3Tp1zNTSKnat79fUX23h3uZ8979UL6kw3JBTfosKzNzNt:8xhSA3TPzRVnal9RBuZ8979UjFzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517154, "uuid": "bc6f61bd-62b0-4e00-b57f-949a3ace3270", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517154, "uuid": "de91d4fa-4879-4aa7-8919-c06a377e6dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517154, "uuid": "ed05c276-66fc-4330-bf16-c4531c31665f", "value": "NYbiLtvO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d0a9b1-7a9d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783495422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495422, "uuid": "47f1919f-1efd-4fd4-9134-cbd77d8a79fb", "comment": "Malware payload", "value": "00eda3ec9f2674d2750b60e817b31b2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495422, "uuid": "ba4174f4-8c9e-47f4-8623-b5ba7e7062cd", "comment": "Malware payload", "value": "c96ddbdab5bbe445d8f3604daca62b80541ece02cc874c338146965e4820a595", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495422, "uuid": "83856a12-d34c-47a6-9909-7c1de01d083d", "comment": "Malware payload", "value": "2b07fda0ea0e7c9533b82aa8451f42a5267649ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495422, "uuid": "1f28e704-d237-4846-8d6a-113c1bf6f749", "comment": "Malware payload", "value": "4b7574cf37bc0b14b3befba23f40c34260b1848cada3597a470b6d493ea788578cd90095b4d37de3249ce98687f39d42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495422, "uuid": "149b7e15-3d39-4ab3-9bc6-253958d3233f", "value": "T1DBB296CC3FC1B0915233B0B76D2B65A5E17A6CD9B2CC9448F3A6B058FD68314E476B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495422, "uuid": "217d4767-4e32-44da-b0cf-f6482685a8a8", "value": "384:jtZVLnyrEPL65WXEc/88WNTUe5TG0W0YlrFuhDE:p3y4j0y/fde5T/W0orFuhDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783495422, "uuid": "cee1e876-fb6c-4561-88b1-854b248deec3", "value": 24370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783495422, "uuid": "73619022-49d0-4396-9e13-fc9a1a43ffca", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495422, "uuid": "b65835d0-3dd7-4283-8499-2640ee5824d0", "value": "QWPQX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb8e1bf-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493266, "uuid": "1377bfa2-8120-4af5-b146-33fdc9d093d1", "comment": "Malware payload (ArkeiStealer)", "value": "b0cd1f6c40ba8d19e894c3be083d2156", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493266, "uuid": "d8f8d861-bcde-40d8-acd3-d73d2a0b07f4", "comment": "Malware payload (ArkeiStealer)", "value": "ca8b44bf1765547ffb92d3dec240b3ec0c7f07f74128faf8436a87661c53ab4b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493266, "uuid": "94f76bef-4bc3-498f-9e19-e20a90d57e99", "comment": "Malware payload (ArkeiStealer)", "value": "f5e91e8655d8ad71c3789912c56f5cd49200b700", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493266, "uuid": "92912393-3f6c-49f9-a5c7-b8c2a4208187", "comment": "Malware payload (ArkeiStealer)", "value": "86cd9b157f9e5e3ffd11adc909102f5fd476cc5d27c5a5795938ab12260197c0509358e9429b55aa34509f4094f72c4f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493266, "uuid": "2190e819-a609-42a1-b679-ad079184cf73", "value": "T192D5AD0B7CD405E9C4A657398CBB51927B31B88A0F3227D72E9073782F72AE19D39794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493266, "uuid": "d824876d-d1a3-472e-be72-c14e11ab0a42", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493266, "uuid": "9957668e-4556-4b22-b87a-c9d09956d305", "value": "49152:rO4lGBu6WwKFw9FKwz676ei66t+yOYrtbT1zA0D4c0IowXVT4u3:rxnAnrz7660WrVDn5TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493266, "uuid": "15473dd6-b540-4513-8341-a5a1c21d67e4", "value": 2936176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493266, "uuid": "a4892035-f57a-46d1-b041-9b9dffef4dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493266, "uuid": "b840c5e4-0482-4aee-9dab-ce998317ab6b", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40302.18191.13000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce1d45f-7ab4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783505049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505049, "uuid": "77c7f7a6-c440-498f-813f-b768ea0436ba", "comment": "Malware payload (AgentTesla)", "value": "cfe3cfc9e135487749e84178fbd7ae89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505049, "uuid": "9911414e-46fa-40da-93e7-6824d14bfcb2", "comment": "Malware payload (AgentTesla)", "value": "caaca14a1ff21717a19942fb835eac7756b86f6902d3feb5f7dfbeda153cc3b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505049, "uuid": "b6715a3d-0c09-459a-9b9f-2a923fa01b89", "comment": "Malware payload (AgentTesla)", "value": "c11017c4a6f6bcb74c0adba360526c0fe81a6cce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783505049, "uuid": "15cb09b3-992f-457d-80d0-f32eb22b7ffb", "comment": "Malware payload (AgentTesla)", "value": "3927c103992b41e0bf19e5b4382ef4776534b048c01feef0312ac7f2af7bdd9ef145b6c7cca69fb0da4113e6cb580153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505049, "uuid": "6e2416d4-9c6d-4071-a93e-ab5cf68e8205", "value": "T185252388AE19CC12C4D20B315EA1F7B4A2741E6CFD14C7139BF9AED7BC3591E6D20A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505049, "uuid": "a96e1f88-7a65-48e3-85e1-7c50426550a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505049, "uuid": "2525403e-f31d-4480-a63e-ea54597f0cd3", "value": "24576:QpnkJu96Y/TN7TMQ45KcF5mXZt8+r2DZCXATvpbkQRl:QpkMbTN7+3mJq+r2FEATvpgQRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783505049, "uuid": "c3806f5e-e580-4bc7-a0c2-e6b5346388ab", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783505049, "uuid": "58558d01-58fe-4dce-a1f5-8b14103ad023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783505049, "uuid": "f62dbd7b-3e6a-4e84-a8b8-a7d2e8f96b88", "value": "ReiNQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45aef048-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474086, "uuid": "f287890b-d999-404d-8e20-cad54d219e91", "comment": "Malware payload (Mirai)", "value": "b9b5e7d3b7cee282d18e8426b06d4c1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474086, "uuid": "e18b1ed0-a6d8-41d3-a1ac-b515547baf66", "comment": "Malware payload (Mirai)", "value": "cab38a319673fd9b4c336423781b32cc9128250e2acc1cd0a5bc06ade673e40a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474086, "uuid": "83c6e969-3efb-4569-a1fa-ebf1fa4b498d", "comment": "Malware payload (Mirai)", "value": "620da0b7576e0177006f5f9709d7bef86c68087c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474086, "uuid": "a2df60ae-4a80-4f84-8912-47c4b349d156", "comment": "Malware payload (Mirai)", "value": "c1ffdcf4fa915af85456d07b2925b3b0a3d66ecc6ff8457617c4730c372b0a550e59b8a85f8a291fb067d7bafbb32b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474086, "uuid": "d447dfa9-845b-4d8e-9761-8635ab02bd84", "value": "T1EB348D67ED329F86C022A8F5B1F2CF780F16BD3A49471E999576E9B08183DD8B601374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474086, "uuid": "f8cf6fcb-4af3-47a0-8476-5ca7dbb38b50", "value": "6144:+w678vQLz7EpN6eG9LPYejb6Ki7i+1uv:+wdvQv7EpN6eTejb6viVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474086, "uuid": "4dd7e4e5-f67b-4e82-bbad-1816024355ad", "value": 241888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474086, "uuid": "a7d0bfb4-7ce0-4202-9b26-2e54048cf6ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474086, "uuid": "696a41a2-6fc9-4bd6-b61d-ba15c934a6db", "value": "kworkerd-crypto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec19867f-7ab7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783506578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506578, "uuid": "3b62681b-8521-48a9-b17f-47960472678c", "comment": "Malware payload", "value": "86793178b9a4cff10a32de07d94bb8d6", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506578, "uuid": "00822a48-0d16-43bf-a546-cf202cf1c024", "comment": "Malware payload", "value": "caca180ea242e844002609fcf3c9a5b5d05e33c8b630b7cfc323cf1cbb82a3ed", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506578, "uuid": "102eeacc-efe1-4185-a654-18ef4bea10ff", "comment": "Malware payload", "value": "d792fe5bc4f549c389213a76fa7eda7613a00eb3", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783506578, "uuid": "e3467e9c-f8bf-432d-ab45-b55498b40660", "comment": "Malware payload", "value": "ea054fd6740b1d07547be62420705d1f36791f19700ad3e6b0fdb9b8996c5ebf06c9d50a9aedb9abb3bbb4b384107f5c", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506578, "uuid": "a6a1ebb4-a777-4d2b-8619-c098c0561813", "value": "T1C6B01209A53FCF5D385FD1C0021795049FB1FFB020394C275B50C549F2D85442317143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506578, "uuid": "50be9231-b690-4312-bb74-f69088425e9f", "value": "3:j+qAHmFEm8nhcDQB8XZkREYmJBMXlHJF9pv:j+q9Nqhn8GLmJBMVpFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783506578, "uuid": "b4883ed8-291e-490f-a83b-5b26790d3faa", "value": 107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783506578, "uuid": "94abaa7a-7604-4408-9e6c-5b9a621a08a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783506578, "uuid": "b8b75580-172b-46bd-9386-357e8c7d31b2", "value": "Kbp.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a414dc1f-7afb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783535663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783535663, "uuid": "01c2eb5e-eb31-4a73-94d9-eda60d7ed22d", "comment": "Malware payload", "value": "2398ba3b7daab6c803748ca331bfe2a3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783535663, "uuid": "57ec4b5f-414f-4e2f-b83d-956e5d2abd13", "comment": "Malware payload", "value": "cafa5753b4471a613cb44cd88fc36b9acef511509bf85f76940a2813808fc691", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783535663, "uuid": "c7065f00-c62f-4122-9cbd-d81a909661e6", "comment": "Malware payload", "value": "49d261e25dfddfce154627523da56387e80d0775", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783535663, "uuid": "73c0a6fc-f01c-4916-99dd-f12b131a3dd7", "comment": "Malware payload", "value": "020efa7c7996d082ad9fa4631f767aff2145586c7c94cd798f8f37ca39cf0531aa603cea3a96902ae0a064d89085b887", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783535663, "uuid": "6573d1e1-c1f8-44a2-bb02-2a539b0429f9", "value": "T10151C8AF808BDA48DE48B6799D4E44E73F307495740A725C9410B9232DF1F5057627F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783535663, "uuid": "b4b6a036-337f-4022-8ee3-db386db30457", "value": "48:GUJO/kMz/9eWgMBjhxPX2ffCJO/kMz/9eWgMBjhxPGjfS:PALz/9epchxPFALz/9epchxPGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783535663, "uuid": "676069c4-ead4-4d58-a435-e85f1cb05863", "value": 2732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783535663, "uuid": "9028ea87-fd0f-4c26-a3c5-2236413d72dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783535663, "uuid": "12b61fa5-1e34-4b77-a428-50e8288b9ad2", "value": "Ho so du an 275.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596eb93a-7aaa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783500748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500748, "uuid": "e11370e4-7708-4cc7-b61c-ba325afa365d", "comment": "Malware payload (Efimer)", "value": "f878cbefe4a0645431a402864c12a2c9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500748, "uuid": "30e6ac36-e366-446f-b16e-4e1f4acb1be8", "comment": "Malware payload (Efimer)", "value": "cc515b0e55bb4bf4e871004e2f3f4de25cdc7259db8fdd45e7088d869733078d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500748, "uuid": "2135333b-e34d-434c-a719-2bae5025e772", "comment": "Malware payload (Efimer)", "value": "5632ca9f5e6c637bd0421ebdb34bf0ef46d72cb8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500748, "uuid": "fdba830a-7fe4-4b16-9cfa-8a50ddf5f82c", "comment": "Malware payload (Efimer)", "value": "2ecd8176447139806e129af35dc418716df3026b465ade3f642eb4d476988f35f44e9b39c322ec963708c39d71ec770e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500748, "uuid": "90f488dd-f647-4a75-b7cc-18ba5c19a4d7", "value": "T16DE633246AC221FDE573403DADD116A9F868B4B54372C9CF1B6496B07E971F08E3E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500748, "uuid": "3aea7700-7ae4-4637-9cac-379da4b7399b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500748, "uuid": "8f0565be-ad73-485b-8e87-7783700770f4", "value": "393216:IFxT6E9s2xzTLdGT4I1XMCHWUjXAcuI3/PGTAI:Ijx/9Ut1XMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500748, "uuid": "bd15111c-7f90-4b74-9449-03c8023c5b8b", "value": 14262767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500748, "uuid": "f77068fc-8109-4ba2-9c9d-d179a25cde6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500748, "uuid": "c7abbebe-3050-4468-b628-9caa6ed11660", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e331165-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517185, "uuid": "0b02689a-4301-461d-8915-3a3dab927bfd", "comment": "Malware payload", "value": "8f0c5e1a711e84daeab775ec46774358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517185, "uuid": "fc4c9d6b-7973-4436-ab72-f12fde22728b", "comment": "Malware payload", "value": "ce76960356d592936b550688e9bb58552416c7fb5daf76678042f0fd89130a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517185, "uuid": "3075fe01-fbd2-4e05-bbfe-ecbc1e0a7008", "comment": "Malware payload", "value": "c9a69a6727b00e36b2b0479f9d6f902e543e5c93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517185, "uuid": "9196fff0-58e8-453c-bf79-de9a879143ae", "comment": "Malware payload", "value": "4c236d70318645a5aabf01bb80d186884a43834cd82441354c25ea85900b96d9c850d82cc4788ee6fc79800244035f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517185, "uuid": "60c17a67-57b6-4a53-afe6-ca8a1b5b319a", "value": "T10908332C86F5A26FDD7E9CFC12A0D633EE1464295E2C74976BE83862713300D477968B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517185, "uuid": "c2933dae-ecee-4efc-bbc6-1e1d4087bed1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517185, "uuid": "a13fcc70-8328-49ae-a9fe-fbef961a547c", "value": "1572864:bt9IKPw8gq6eGYdeTqowzKYypCPRfYLgRLlPBnU6InslAY3AR7:bUKY35VYHoyKYyuB/5PU6Insr3AR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517185, "uuid": "f9979d27-c92b-4710-a120-31728f3472cb", "value": 77264403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517185, "uuid": "9290ce1f-24b6-4f56-a0bf-a66847704b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517185, "uuid": "63aee299-6356-4b07-bc55-8d5d4cc7eb76", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba2cdbf-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475331, "uuid": "f30c4eab-4560-4544-b4ff-a2a2db4035ca", "comment": "Malware payload (Mirai)", "value": "719937afdeed9c98fa8eee8f667115e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475331, "uuid": "00e7e5f0-997e-43e3-aa6c-53f8b45843c1", "comment": "Malware payload (Mirai)", "value": "ce9d2c70b2ce2eb27ba7f39b374f4529a3c27e8e1ad450c9697d066a88ad28fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475331, "uuid": "5ac6f1ea-9c93-4873-8ee7-394df61ce30d", "comment": "Malware payload (Mirai)", "value": "8f5f33bd7dd7a68974d5d65d5616ccfec078ffa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475331, "uuid": "e68fb3dc-474a-4aac-93f9-8052956e47d3", "comment": "Malware payload (Mirai)", "value": "9371877adf7dcdf353202c489aac902f8848d20595136bd1a47f9b4583bc2b0ceccfd63454574a40b6008d06c3255015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475331, "uuid": "feedba92-8ffd-4a05-a008-bd539cb72be7", "value": "T153B31907BDC18DFDC089C038477F753ED822F0ED0239B2AB67D4AE262D5DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475331, "uuid": "bf70bb68-1446-4323-87ad-76c02d7a45e3", "value": "3072:gHoE9uzAHZeQ9eAT9kkzyQtJGCvR0MeITI8IunXYUxre:gIE4zAHZeQ9XT9kKjGMeKIIXYUxre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475331, "uuid": "ea72cfca-aade-440f-9020-54ed1121c34f", "value": 117744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475331, "uuid": "a6408f37-eef1-48c9-b6cc-dc902b438b84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475331, "uuid": "a3c51b32-f8c3-48ad-aefc-8a45074f51ce", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7c481f-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537210, "uuid": "e1918346-70e8-4ce4-be90-e7114ca0dd76", "comment": "Malware payload (Mirai)", "value": "a5122aa74a4e715e762e667009ee78de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537210, "uuid": "6a592401-f215-4913-8b36-4c8469d7bd33", "comment": "Malware payload (Mirai)", "value": "cfa38f49fe074831b13faa8b95662767f5108f55c57de98512e08eed67b3b17b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537210, "uuid": "9ad3fcea-0787-4879-afbd-be6ed5969b7e", "comment": "Malware payload (Mirai)", "value": "16153a64148a25392e88e5ca60f32dadd7133421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537210, "uuid": "61b58daa-97c3-4949-b89c-c62ae74b16a6", "comment": "Malware payload (Mirai)", "value": "8f29b4eedf94c0f5825fd3d97ef5e0bf76bda5aaf2781754e70549615bd2acd693f1fd7889f3989c7ab74212999156b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537210, "uuid": "7ee956de-3695-468c-8390-96b49d901bfc", "value": "T17023F861B8918A1BD1E063B6FB5E928D336327E8D2DE7253D8210B15378E51F4E73B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537210, "uuid": "3abdb21a-6582-410d-99d6-a7aeacb9818e", "value": "768:QUXOe9QS7Hn5Y3vzdSKNLDEd15Wtd0Hyrm/tL+G25TGNtccxY4fiMnDT2/N:t9Rnu3nUd1qO/tyTMtdfid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537210, "uuid": "1ac0c834-852f-4584-ae72-09154440a621", "value": 46380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537210, "uuid": "bf810eb4-9163-46eb-b3ac-8783bcbdb42f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537210, "uuid": "86be3143-1e7f-46ab-9916-73fac205b087", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cc0f94-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493271, "uuid": "605b1bb6-f5d0-4379-a8c1-636bf6053840", "comment": "Malware payload (Vidar)", "value": "a97a5f130d82f40ccdaea86a0ac0b7f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493271, "uuid": "d6113107-486c-4635-be7a-d31b86495da1", "comment": "Malware payload (Vidar)", "value": "d0cbfa367dd44966ca3646fc28c613c152704bd145e4ac99212782600e96eb52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493271, "uuid": "7df6c399-e22d-4e4c-9cbd-2d739f21b06e", "comment": "Malware payload (Vidar)", "value": "2cb2eff0d41c703c442fca61c53b0a5a472d833a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493271, "uuid": "6de2b61f-4a68-44a3-b054-a3492ea37676", "comment": "Malware payload (Vidar)", "value": "eeec5ac45e96e49687c421b07e293cc095e9288bf7db8c484d98674a457bdef85e70e7828fdc9c971088c2d3dbd726b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493271, "uuid": "7884278c-7ab2-4a2a-8b46-1e51c98c152d", "value": "T134E57B077CD109EAD4AA927289B661927B75BC180F3A23DB2E50B3393F72BD15C35784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493271, "uuid": "f561853a-db45-403e-ba04-97928bfe949a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493271, "uuid": "e09b3d3f-ae3a-403a-889a-67dced5cc299", "value": "49152:i312Vezcq11seSMmIG9hcvamA8GRzPAS9zKWP7gJ:i3IJVIPTBhUla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493271, "uuid": "9b8aac0b-1fed-44f0-9687-d1e62cba7f48", "value": 3091304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493271, "uuid": "2536842b-1cb6-4f2f-8920-b86db6db8264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493271, "uuid": "8c2820d5-3dbe-4c85-85cf-c01bd5a12934", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40323.20886.17844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df03852-7a92-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783490529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490529, "uuid": "da08af7e-dd71-4427-8ad0-85f27761c98f", "comment": "Malware payload", "value": "788c4f0ca8a7d408c5836135bb3190fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490529, "uuid": "24f60510-9222-4e23-9d83-efb9dfd6ca0f", "comment": "Malware payload", "value": "d11d2e36d17dc323dbafc5e361eb51eb8e0ab078c2f50ec5bc98e5a87190aefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490529, "uuid": "0a40ca08-6bfd-4cbe-af41-cd1808006740", "comment": "Malware payload", "value": "0f5706072b069f8faa53effffb86df1b4257dff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490529, "uuid": "4f8d3e3e-8ce9-462e-82a2-ea13c803af59", "comment": "Malware payload", "value": "3d4081f8653c546c5dd1e1b25436da7d9ac0c85ae3d53702b2d258a13df97cd517dd33b3fd3b4ee81ce05eb50ec2e4b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490529, "uuid": "f8df3d8f-fbe1-4e25-ba2f-4a5bb32e0bdb", "value": "T198B67C73945334D8E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490529, "uuid": "d36c4c2b-96d1-49ce-bc6e-48e5cfb14d40", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQH:cqYUQuVDt0TZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783490529, "uuid": "66403e04-db3a-4a1b-8e6d-b827e98840ba", "value": 11010048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783490529, "uuid": "c113a709-fbae-4c0d-827f-00c66485bd14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490529, "uuid": "ed5100cf-f85b-400c-8bab-59e2254f45f9", "value": "d11d2e36d17dc323dbafc5e361eb51eb8e0ab078c2f50ec5bc98e5a87190aefb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a597334-7af3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783532076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783532076, "uuid": "79fd91b1-9bf4-4c43-89aa-79d2db6665ed", "comment": "Malware payload (Mirai)", "value": "4897abb4a2f799c1e18f475c0ea01c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783532076, "uuid": "d72c4f31-ff8d-46c4-aa40-360f89f6ce20", "comment": "Malware payload (Mirai)", "value": "d164dd614f6909b649c0c8f5a9f8a2471fbf4f069fdb436938ed52d02c1a8815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783532076, "uuid": "beb0556c-0a32-449c-9a51-96cb62f38160", "comment": "Malware payload (Mirai)", "value": "0217d5724ff94827f7b05bfe2b844bd24caf8f38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783532076, "uuid": "af0b8d16-aeb0-449f-bc66-6292d0ee638b", "comment": "Malware payload (Mirai)", "value": "93a671175f16449fc302b1503ab325920c3ebd3add2750d783f072d245d6c2a51d09fc59803a2d04383ac9e3647c91a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783532076, "uuid": "3928efb2-ac16-4432-8666-d553cbb29f9b", "value": "T192852951FECB54F2E5171E3144ABA2AF27316D054F20EBC7E644BE6EE9376D20832219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783532076, "uuid": "e974597b-09c9-4df3-ac48-29f57e70f216", "value": "24576:HHTkJhb/CjCcy/H/gyNDHSVWnNIlzvD/e8NayMz6Q3UWvI2K859b1bVlrSMB/92B:HEx2u8H6DIa1ZJ41iYD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783532076, "uuid": "b2889a4b-f933-40d5-b784-42993ab31d30", "value": 1806336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783532076, "uuid": "a1ea4385-02dc-46a8-997b-37fae7b37778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783532076, "uuid": "9ee1123f-2bd5-4cad-93ba-caced4030df8", "value": "d164dd614f6909b649c0c8f5a9f8a2471fbf4f069fdb436938ed52d02c1a8815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7890208-7a88-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783486330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783486330, "uuid": "a95e1498-6abf-42de-bcf4-32badcff1277", "comment": "Malware payload (Efimer)", "value": "0cf1847dfdd29b8b51c87e5ed1360f88", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783486330, "uuid": "c22b81d0-3762-42ac-85eb-a0630db135d6", "comment": "Malware payload (Efimer)", "value": "d17c88b48d370d0b7360bd8987d2ca664a750d45d1bc51f2a269262592c5fff1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783486330, "uuid": "5a952fcd-7904-49a1-bec2-f23e03e5def7", "comment": "Malware payload (Efimer)", "value": "dd64e4dc7ae9dd5c5ed5710b0cf53af456576435", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783486330, "uuid": "1fa5560f-11a2-4fdd-bb67-c991b6689649", "comment": "Malware payload (Efimer)", "value": "30192d6e2f9866baf57ebb9526a859f850fd5f951758cafc15ba2e238a98af07b45e8ebc63de32a4488d2ead8b32d1c2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783486330, "uuid": "40ac75ee-c2bc-4408-905f-fd26a6e34058", "value": "T199E6330416E102DFEE63813DEAD39289D5A5BCB717B2C6DF1F6883602D2B1E04DB9653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783486330, "uuid": "ae2ca7fb-d430-4acb-82af-60d74c0669fd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783486330, "uuid": "027d7b37-db86-42bc-87c7-f25913f53cb2", "value": "393216:qod49o+cooU3ITnJQ6XMCHWUjXfcuI3/PGTAI:qot8IjJlXMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783486330, "uuid": "1110f911-bbdc-4c5f-a3e1-242f66331e9b", "value": 14290315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783486330, "uuid": "f38e975d-c759-4fd9-9d67-992135f5f68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783486330, "uuid": "d1785980-8261-4f82-b3df-f561389059e7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149e4a61-7aa7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783499344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499344, "uuid": "07758bb6-1e02-46ef-8eae-aceb26e84b60", "comment": "Malware payload", "value": "e0461b2896c6d506ae5c1171bbde5ed1", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499344, "uuid": "96939019-bd35-4ef0-851d-762afd4e9981", "comment": "Malware payload", "value": "d18b1ec968e94037112e6b25f12c111b4882878ea137c3ba4f25f4260638a63b", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499344, "uuid": "6599754f-b874-470c-88bd-547400698ac8", "comment": "Malware payload", "value": "9df612588345cc7f444f446451d54a41e16446e2", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499344, "uuid": "3751f03e-30e1-4c83-8dae-1dd9ba70b660", "comment": "Malware payload", "value": "662faaf7ac2cc9f27ea52850746f02047ef2768e1595732305db78757b0e6e66a8ed7f2e2c1c528234753a0c1f719267", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499344, "uuid": "9cba9bcb-dfe3-410b-aafd-ccfb966e418e", "value": "T1B104C652EC291816D383F6BC596680827724F8235A012C347FEC978C1F89E7BA5F569F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499344, "uuid": "def7ea51-5f69-4f0e-84f6-08eeb0abafc0", "value": "3072:nUupwujVk1qZQEi3ZqHSQhPYAP8S5Y3IFqjHytkZH:UBEGEi3ZqHJ1P8S52y2ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783499344, "uuid": "e47d3e8b-069f-4bb9-974a-e3609d1be131", "value": 184282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783499344, "uuid": "3bb0c188-b6e6-46f5-be45-8842d821b956", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499344, "uuid": "0b14bf04-5fad-4ebc-86bb-97ec13672a53", "value": "d18b1ec968e94037112e6b25f12c111b4882878ea137c3ba4f25f4260638a63b.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d7d77c-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493221, "uuid": "c80da833-72c4-4487-934f-4ebdd221d4ab", "comment": "Malware payload (ArkeiStealer)", "value": "81ba9b6b739937188f929a67ac018a34", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493221, "uuid": "dbdc617f-7967-4d53-b514-9e1030c85b1d", "comment": "Malware payload (ArkeiStealer)", "value": "d359681ebc98c73c45c803ee55d3b24aea94284cec4a961c79f0e528799febc3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493221, "uuid": "f7b6f002-e566-4065-8cd2-2a60d3bc8e65", "comment": "Malware payload (ArkeiStealer)", "value": "52ec31281f3b72ab9a5a8714ed6b7562a10d5b00", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493221, "uuid": "998eaaa6-dc29-4f02-baa6-346796a20f18", "comment": "Malware payload (ArkeiStealer)", "value": "7863d4d35c372c15c04694e214cdac203406d3be50651995eea4ba0f0ef6f656875039e9dbf99911011b1307c707b76f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493221, "uuid": "32bda721-3e9d-4239-9b11-86e31c9f3f2d", "value": "T121E58C06BCE148EAD4AE92328AB742927B71BC480F3663D76E40B7782F72BD04D71755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493221, "uuid": "0f6f6faf-42ba-48c1-99f5-ff67eef28f9b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493221, "uuid": "4ded86fb-f298-4972-a280-eb474c7aaee3", "value": "49152:uyw3No5rFYPI3YfJJCXuROVgn01XHPaPmg6gLTdu5gFrKEP7gf:u9u0JzROUm7g2YXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493221, "uuid": "2505c32a-eac0-4d2d-9084-7fa04b558524", "value": 3088232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493221, "uuid": "e3d6e5fb-cd3a-4b80-9412-7ec289f828d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493221, "uuid": "da970eea-6fa7-4c03-b7f7-a6f5d6cf7285", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40305.14758.22916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91fec65-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493232, "uuid": "a72e37bc-8701-4872-bdb1-aeb924bd8750", "comment": "Malware payload (ArkeiStealer)", "value": "254062f07870095b99bf4798688ab706", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493232, "uuid": "80cf2807-d5a7-4a7e-9a6b-ad87f01ca3fd", "comment": "Malware payload (ArkeiStealer)", "value": "d4123e8d75feffa620107a4a4ee69848a3011a4de9903b732e03e8a0e4e56f86", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493232, "uuid": "c8e2363f-6506-4ebe-b723-91164db647be", "comment": "Malware payload (ArkeiStealer)", "value": "cfbcbea9f01922200f7683c36572331466f675cf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493232, "uuid": "3d78ec9f-78a8-441a-8c9e-c99f4a6d4d00", "comment": "Malware payload (ArkeiStealer)", "value": "cf08991d52f068797eb7abbac9f7898b8a4f9e44472481256032c2b4bb70c12537fa426dac3438e3c53ce4c824b58fe8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493232, "uuid": "8c171cc3-6431-4760-8c23-62f3e982c779", "value": "T163D5AE4BACD009F6D8AA5335897651927B31BC464F3227D72E90B7382F767E08D39784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493232, "uuid": "38b95033-21cf-4da5-af31-706b5ae0d0b8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493232, "uuid": "7e95d3a1-4c0f-4d82-a0c5-d8127312f2b6", "value": "49152:q85yTbpY1BF8YgY8Qe51qmrm0Gy1apS62zS9EVaU4L4e:q8esy5AeqmK0Gy1Wl2z7Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493232, "uuid": "23dfae34-f0c1-459a-aec4-1d9bda01fd21", "value": 2939752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493232, "uuid": "dc422d10-9b5b-454c-8a87-92a47ab6cf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493232, "uuid": "398f2e26-23f5-4379-9727-bc889edac450", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40313.24610.31794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9940560-7b1f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783551134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783551134, "uuid": "4b97b851-6c8f-4848-abeb-d25522a01966", "comment": "Malware payload", "value": "cdfe1c68e56376b9e6a262e787aeafe2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783551134, "uuid": "a2df3d2d-da4c-4d98-bf61-4e33888b6a77", "comment": "Malware payload", "value": "d426f5143b2b2898493aa0018f1d9834654d028150c6ad9f1cf1822aca87594b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783551134, "uuid": "72c759ce-4da1-4b43-951c-e34ce6bb3329", "comment": "Malware payload", "value": "cc58d132433c470b4094e9878f55c72f8c91ddd2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783551134, "uuid": "d75ec01a-70e8-43b4-bb40-7c7ccaa728c9", "comment": "Malware payload", "value": "d8aed61900820f5900fe32f31683aa6f4fade013ec232bef769c83d3b06d0d84e70ede38b6a761ef832606d91510c2fa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783551134, "uuid": "448075a7-1f80-4118-b3f8-159ba49024ce", "value": "T196E63344A8D022EDE6734139EEE245D2E67738350FB2C94757BC93A23E631F14C3A666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783551134, "uuid": "a0eeb0af-2246-4265-a802-6a3675617451", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783551134, "uuid": "57e314a2-cdeb-46b7-a171-7b7419af504a", "value": "393216:eVmAizkl7c3EKOr4DKXMCHWUjXvcuI3/PGTAI:ebizS7c3EBMDKXMb8XkH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783551134, "uuid": "2569b999-39d8-4537-8236-6fa7f9ac98ed", "value": 14306827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783551134, "uuid": "8d130587-e66a-4f31-9f15-d0293225f4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783551134, "uuid": "36cb38ec-f3e4-46da-ad25-2b8d7415a2d5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30042dd6-7ae1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783524301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524301, "uuid": "29075da8-6fb9-4ee8-b738-5f3891623b61", "comment": "Malware payload (Mirai)", "value": "02b38c805715ff53fae4a769569f05eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524301, "uuid": "d9d53dc9-22c6-4f40-a7e7-113ae44ab44a", "comment": "Malware payload (Mirai)", "value": "d55baa678267b2d9a32c3c97557691165df326db9af5ff34c5292ab22b557ec1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524301, "uuid": "efaef412-923b-47bc-83ad-d7b4e1759ac7", "comment": "Malware payload (Mirai)", "value": "c810d0cc59ec68c10b62b6dfd0fbfec5b07b2a16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524301, "uuid": "57bd1b61-9d79-4179-be78-45ebe01de379", "comment": "Malware payload (Mirai)", "value": "0b57830aa4cfb0e60cbb7dcc46cde5b6f219dac9768436de10e1c94eaec41036c3fdc9d38c556d9505916097158f4e91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524301, "uuid": "e30a305e-0048-47ad-96a3-0c0b9d1f158c", "value": "T17433F1696C25DB70EB921D31DF19C7C72A1E6BB4106478E3066CCA38CBD8A6E1F85843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524301, "uuid": "669fc610-649b-4f07-913c-2c8897685bf1", "value": "1536:n7DfXSjDmI+ShaNHJG2obod5ZAv0RPvnLf:n7D6/mIlhaNRSq0sRP/Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524301, "uuid": "f93bd33a-cca5-4452-9a85-62ec8b46b93e", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524301, "uuid": "09ba05d2-54b5-4afb-bc51-f9cd0e5f1758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524301, "uuid": "e1e73304-3821-4d6c-8b73-f300af294bdf", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82380b6e-7ae1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783524439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524439, "uuid": "94603947-5969-40cd-ab3c-d43ecc32573b", "comment": "Malware payload (Phorpiex)", "value": "479397248429225464fa859798adeaed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524439, "uuid": "19c9d16c-cb3d-4dfc-95b9-5486f9e23ea6", "comment": "Malware payload (Phorpiex)", "value": "d648e7278d8211bdc3162182169c780e22de6c7a9f5d650fbf31d033fd9d9d70", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524439, "uuid": "c2458961-1e6d-4276-892e-0dc1ceeee80a", "comment": "Malware payload (Phorpiex)", "value": "8078ca21bc56e6bb5ac8bbfb79dce72fcd18c284", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524439, "uuid": "fdb50847-1fb9-4a6f-ac52-de0077783735", "comment": "Malware payload (Phorpiex)", "value": "95001fe9ffd1b54a76e8e715660e085800d080b566e9e6124c49ee012507f2cc5695fb8d5b469d88d5db7ac643bb9372", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524439, "uuid": "9adee4ae-f038-48b7-b919-440b60f4b579", "value": "T1F2825B0FB941472AC0E100749676877BDAB96871338414DFFB948AED0A686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524439, "uuid": "87d16b57-8ce8-4443-8c00-ebaf7848f50d", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524439, "uuid": "8e73442c-f731-4d2a-80a7-e70ddb3603cf", "value": "192:saISCngTBvqQVzVaFXwYHppqxolgZK6o/fKUSiu9zw+gj5tBOgbOBqmEdEFmEo/a:sIqQ1VaFuxoSZuu9JgFtfURav8U9cpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524439, "uuid": "bec3c168-e6a8-47ee-ad6b-e62681a34910", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524439, "uuid": "31e0a108-2de2-46c2-b7b3-081c40361814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524439, "uuid": "242e19fd-d067-498b-b7b2-8ab7144677b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec95852-7b06-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783540539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540539, "uuid": "f8b8765d-7d50-45d2-aeab-aceca1a48d72", "comment": "Malware payload", "value": "c1241642ab08985f1f165d1072304928", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540539, "uuid": "485de014-d5ea-4f21-ba9b-2a46fc5d5c4f", "comment": "Malware payload", "value": "d656afa3e992aff80b8ff0fcb92b9785afcf14a1f4807e7ae24a361d95e5bec1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540539, "uuid": "bf0055bb-ee17-44e6-ab5f-63f3b24b93a9", "comment": "Malware payload", "value": "d215e9dc45349060b73db7de71f930f2c6836d9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783540539, "uuid": "04383a60-48fc-4359-bc88-101d0b1a623a", "comment": "Malware payload", "value": "f7dede06a654088c758a5047f3b4ff9c50edf8b6bed2fdc9ac52c92f1c8bb470120ef823da12c8e13c1779cf0cb4b26d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540539, "uuid": "9a80c140-f19b-47fa-ac8f-7acb9c553df0", "value": "T1834199D4630234326C739D2B75B9580A329051E5BCC65FC9EEE974B980CEF5E384F652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540539, "uuid": "9b59db1c-6fa5-4f57-99ec-e46d9ede2b35", "value": "24:vgULmXmJ51ULVa0VlpVoUReUPUqZURUVULbdaUUCn:vrLmXmJgLo0NdRRMN+CLbdNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783540539, "uuid": "c76cc8f5-a9d9-4af8-b9ab-c6b0ac7cc253", "value": 1883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783540539, "uuid": "2d7af3ef-899d-413c-97c9-e9336de0be25", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783540539, "uuid": "176e9d38-a7cb-461a-a42b-5aa1a01d61eb", "value": "d656afa3e992aff80b8ff0fcb92b9785afcf14a1f4807e7ae24a361d95e5bec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6e9648-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493236, "uuid": "20e64b34-8bc6-4bf2-b358-19d48fbf3420", "comment": "Malware payload (ArkeiStealer)", "value": "f75f1f36e225a4cab02b5b4c47159faa", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493236, "uuid": "b6c819a3-6cdc-46f4-8eee-4e84e249e8b2", "comment": "Malware payload (ArkeiStealer)", "value": "d6b74a926002e9d018073eed697c1b75250deab3945c8388532ad1711984f1bb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493236, "uuid": "00c3eb00-7a4f-4efe-940f-f6abcf5b2ad6", "comment": "Malware payload (ArkeiStealer)", "value": "018bf9ebebe9fa0e5bd5ece51627f662c765ba4c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493236, "uuid": "490f876d-a0eb-492f-9f8b-0bf5e8a1f3c5", "comment": "Malware payload (ArkeiStealer)", "value": "b03ef1ede0165c0e2b72a2e3fe9170164be3970c38f249c82008ce69e29298412700306652f78e2f26dbcef10d1c9b86", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493236, "uuid": "b0b0bbcf-dba1-4ebb-b992-91ff742ce845", "value": "T169D59D0BACD009E9C8A9973689B652927B74FC464F3127D72EC0B3782E736E18D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493236, "uuid": "765f9cdf-0c1e-45ca-8b52-fecd2e76be03", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493236, "uuid": "f8d4b97f-e68a-482f-9f22-dced6feb91e0", "value": "49152:wT8Nxs1As0yl8AidWwy9+4fdcX9AvfDtY+InrM4zB:wTOEKjS++OXS7tY+InY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493236, "uuid": "44daa88f-fa59-4d8b-aded-34fe9df0227f", "value": 2939248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493236, "uuid": "242ad57a-f927-442d-8cf3-501a19ab8c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493236, "uuid": "745c75b2-bf96-4cec-975d-0ea904ced3db", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40300.14231.18173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62df1c5-7ad2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783518057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518057, "uuid": "8c104c04-937f-4e41-b1d7-579e0066499c", "comment": "Malware payload", "value": "de1da43a43ebe96eba13799a9b6e4006", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518057, "uuid": "7d216719-0df7-4976-b928-5f2c85762292", "comment": "Malware payload", "value": "d7c4f4f6b3cb4255775b4a29a10ed7d51dc641bda7a375c7a05d4f5681fe2758", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518057, "uuid": "e4f2de33-1a2a-4a3c-9720-9cbeccdd361e", "comment": "Malware payload", "value": "4b047ff2508a8cacd1a4e318153f84179502afc6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783518057, "uuid": "db35881a-9840-46a7-a733-c65e79855c72", "comment": "Malware payload", "value": "435f5c25bc822ce8e7f4752b439aeb8abb3baddf10438707208222f06591be7042b9560609d33371bece62832c979999", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518057, "uuid": "4566b682-8774-404f-8904-27091287ede1", "value": "T117662385EF05D92EC4BB84374E9243322626DD1ECA97938384EC3A685C7B7D41FD9AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518057, "uuid": "26684c61-1329-4e14-a4d3-e0f02d072d0f", "value": "98304:GTp3/8AQlyPhPrNF9b8Cufnyy5dt1zJ5nzEv05PG9EgrJ5a+b0wisNUIT+qu8zo:GTpP8yPFJGtdt3xENrJLbysNGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783518057, "uuid": "bcf53ae4-af26-4e04-9c0d-0673caac86d4", "value": 6561449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783518057, "uuid": "65d24bb6-94e7-46d7-8d65-6ea52fd00950", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783518057, "uuid": "e0db25ca-d212-408e-8fd8-dc905f5ddb45", "value": "T\u0438k\u04220\u043a20.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e41725f-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475336, "uuid": "7df3f0a2-83ff-41aa-8a4a-903790fccf69", "comment": "Malware payload (Mirai)", "value": "9f97fc35cbaf1c6beec8f4403300e801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475336, "uuid": "f715ad8f-c790-4743-b2a9-dfe14586956e", "comment": "Malware payload (Mirai)", "value": "d7eb9ab28d047c28fb5310415c8fd29b37498c855f8a3ea446248e7f5fd08a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475336, "uuid": "c57b4a53-b67c-4c1d-815f-cb4c1cdc0b07", "comment": "Malware payload (Mirai)", "value": "49998af94add4f04829dd6249b3c8630c44208ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475336, "uuid": "29de2692-d36f-4477-a90c-add2dd3fad9c", "comment": "Malware payload (Mirai)", "value": "048e3b5dbfeafce910c3494d3deef609ea3c511aab2d690b6f4b9fad847d90118196a28de6a417f658050bf44134076b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475336, "uuid": "3f7a5eb0-5519-4680-bb12-8c220bad6638", "value": "T13BC34B0273180B47C5A319B02E3E3BE687FFE5E021E4BB89251E8B564575EB75849FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475336, "uuid": "313c9733-5f50-44e0-8826-08b204e78f12", "value": "1536:KqL5Jj5lED60/rhmvQ+f2evxDNScNGPuFZ+1mWdHKyELsHsI:KqL5JjQ2w5qbDPfFUmLGHsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475336, "uuid": "e0b5c3b5-91cd-4051-8d98-efef26fe36df", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475336, "uuid": "8afe5362-371b-4133-ab95-905d97e88017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475336, "uuid": "80d8ac9e-d2fc-4c67-931e-82720152e1a4", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360da7d7-7a9f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783495965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495965, "uuid": "6f9694a3-57ac-42a1-a52d-57bf130c32dd", "comment": "Malware payload (ArkeiStealer)", "value": "4db8e85743a1ae8b1d26a3bccbffb6d1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495965, "uuid": "ab3d103b-c9c7-4c80-9d14-6bac43b4226d", "comment": "Malware payload (ArkeiStealer)", "value": "d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495965, "uuid": "47a742bb-1c53-413b-b056-ec725dd01fda", "comment": "Malware payload (ArkeiStealer)", "value": "57659b0847aef1d3f7539a4d31697de8c94f782e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495965, "uuid": "2c7225de-f314-4244-b392-9751246f4437", "comment": "Malware payload (ArkeiStealer)", "value": "6103835e6e46333663b271a5c36e1b2fb1dee39bd05af5b0ca05845e3c32766690f44e51457e90080383a24c35275ee6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495965, "uuid": "077b27c8-4fff-485c-a9c5-be4954e4d972", "value": "T13ED59D0B7CD488EAC4AA973689B652417771FC1A4F3127D72E90B2782F72BE19C76740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495965, "uuid": "431394d2-fe8d-49fb-ae27-776d1a833083", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495965, "uuid": "586be526-0529-4de8-80d6-b741ce538faa", "value": "49152:DDGvk+nJmHrQm++AOtV4djxbD9bsow5zmwC4vHsrX2:DDkmHAEadjx3q7hlBsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783495965, "uuid": "118effb7-3c71-4540-82c7-6df92b694a82", "value": 2893704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783495965, "uuid": "9b9f7f9f-4769-4147-ad06-abd78416f057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495965, "uuid": "f839f596-48a8-41c1-ae93-750125e8be4b", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0f0509-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493233, "uuid": "cb84153a-3900-423e-9410-19fc7654d7ec", "comment": "Malware payload (ArkeiStealer)", "value": "0b8944ac66c79484cc10a68e833e33e2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493233, "uuid": "76aa8dc1-12b5-4a76-bcf0-606f3970e516", "comment": "Malware payload (ArkeiStealer)", "value": "d9013fa366c2460da14ac377b986dc54acaf08633bf4b436157ea74ae15f991d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493233, "uuid": "c14bcf8a-dea8-4bc6-acb5-c1555dcc71c1", "comment": "Malware payload (ArkeiStealer)", "value": "a57b53161ab4a9c1ba00484d6708c67805719c3c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493233, "uuid": "ce681c4f-181c-46b8-b077-dfeb58ebb5ed", "comment": "Malware payload (ArkeiStealer)", "value": "ec2bffb0a8e16f4cdd5c5beaf59f3a9471e57cb67a78e89d896bf63737e149e9c835b247ba0e488b588a3e3676eae116", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493233, "uuid": "360539d5-2ee4-44dd-bdb5-21fe790f0d09", "value": "T1C5D59D0B7CE148EAD8AA623259B75182BB75BC054F3233D32E90B7382E767D09E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493233, "uuid": "4a842440-45df-4118-a6e8-2162c3e4936a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493233, "uuid": "d613f530-0eef-417c-9960-310cd1fc7376", "value": "49152:ChW6diw7wMEgr0zDwsWnyLVsq0wY5M3mRzq10dH6dsw4YSWh5Fl9V8zUt:ChpBr8eyD8v951wBSCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493233, "uuid": "8afc60a0-adde-46d7-84bb-0f5c09399856", "value": 2999144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493233, "uuid": "ce00ce54-4334-4b15-8167-afcf810490c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493233, "uuid": "fe6eec11-6acb-4c13-982c-1db84740a972", "value": "SecuriteInfo.com.Win64.Evo-gen.54284519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72cb443-7ad8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783520743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "c197e0de-c650-406d-a541-90b7d5feb5be", "comment": "Malware payload (RemusStealer)", "value": "55b80c0bb297e1cdbd85530c30c6d723", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "a278ce41-ba07-49fa-af4d-c0f7ee9553c6", "comment": "Malware payload (RemusStealer)", "value": "da483f0d56aabc55d45b170c4f605c97c722b3c2400cc6a5643a45f116121258", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "45dc1ae6-770c-439b-91dc-d6cc886b9025", "comment": "Malware payload (RemusStealer)", "value": "8c148fad9feaa0b196989b83eeaed9334083e221", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783520743, "uuid": "ef518744-53ac-47ca-9bbc-2b602184a394", "comment": "Malware payload (RemusStealer)", "value": "b9d05f5c0550e00390bb07d26af701b994c3308ccd2c397a86c49bf7371151e7ebb00a610ebeecbc498d3c8905da8853", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "b76d3060-bbca-4a44-93b7-427467d862d0", "value": "T156546D59F7A509FAEE77813CCD524506EA72BC164760DACB03A04EA71F236E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "40e029e8-aa2f-4fa0-845f-09be37e1ea8b", "value": "67f6728bb9c2c56c262f6da70935d9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "00167291-5ff4-4f08-884b-12d801f8af25", "value": "3072:P7lSfLEa0yLMEleSiC8ii2AcF+P8fVvgXNBTYco599WyG7/jY5x6wrmxoKv7kK/F:D05CNNQ59kjcGOJYNLROhBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783520743, "uuid": "c4acb20e-c304-4977-b8af-bcbeb3813bea", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783520743, "uuid": "399332ce-a367-4d83-9610-9b3426b8c941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783520743, "uuid": "8ce76d0f-a929-4132-aa07-1ff4952de0f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096a76e2-7ace-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783516076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516076, "uuid": "c799bb71-6e64-42d3-aa77-2888c3f5b54c", "comment": "Malware payload (Mirai)", "value": "446077f14e83cc2b2e6536dd0aea11ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516076, "uuid": "328f98e3-46cf-4f18-9e79-8d1f8624fb79", "comment": "Malware payload (Mirai)", "value": "da90570cc6af294568c456d988a4fa5966c362e16288254ec799f94c210ce220", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516076, "uuid": "4872ddcf-93e5-422b-a062-99914bcc9fe6", "comment": "Malware payload (Mirai)", "value": "eef9a21dc07c1e69fd96fd58e04325b32197666e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516076, "uuid": "ebcf89eb-8b0f-47c0-8e93-6e2b7960b6cf", "comment": "Malware payload (Mirai)", "value": "ae65f8aaee13ec75ec6e6404bd6bc61b9f1f01c8341e99e0e68a15639b4748b9eff7888e0efd297aecc5001e3b256959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516076, "uuid": "fc961f24-26bb-4fd6-868d-d7172afcb0ae", "value": "T14C33F1EBE91B78C1C6BC897D91DD6B795B4260F1B237935CC7A12C8C531A7F92A4A00C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516076, "uuid": "ec4706fb-16df-484f-ab0c-b847a0fd9147", "value": "768:O4MsSKFz9Q3V71gRjZ6G7wxPiix0RGuoFhrzwexQa0fvIY0JjKE67PMHN15wi/Vu:xFFOh157E81u+Wex5MX0J+E6AxzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783516076, "uuid": "4c946c9c-851a-4c7b-acc3-487c3ffaa9bc", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783516076, "uuid": "c450042d-1643-4285-a56e-07b8ef17ebf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516076, "uuid": "38de3058-037c-49c4-809d-10f606bdd6a4", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1a335d-7b04-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783539275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539275, "uuid": "6590d5d8-41c6-478f-b7f2-4015701f3b6e", "comment": "Malware payload (Mirai)", "value": "2c49b1a2fcfd78250e267399bd5fec62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539275, "uuid": "d08afeed-a196-4cfd-a654-7c6a7ea27c24", "comment": "Malware payload (Mirai)", "value": "dada8dd2ba9735c18d83595c23a44e2d31117af5d90380235d193eb8b7be75bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539275, "uuid": "852ad82d-6f38-470c-a1ae-ee7d13d07d63", "comment": "Malware payload (Mirai)", "value": "82eafcd2b35b8932ef96a94cd1b9caef637ffd63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539275, "uuid": "c5799943-255a-4b85-8b60-57a7fb58e3d6", "comment": "Malware payload (Mirai)", "value": "e7b2cdc3adea1bfacef303a95a33bb7aebe34a5f45f1f02afbc08ac509ecb350e6ae0bef3e10890d8a8d833004d26950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539275, "uuid": "ab34a37e-ef49-4d1b-8bbc-271f1f52ab0f", "value": "T12FE3E80E7E218F7CF795823447B7DE1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539275, "uuid": "23bef6ba-bcf9-4422-96a0-f6cd71e0399f", "value": "3072:ZhdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpURzrnPcH+14tTI7V7mFM7mYQrO:ndK+SE7ktsNOT8wR41M7qlkoKrMh8XQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783539275, "uuid": "f466ec7c-1d46-40d4-8124-2a19ddb138b5", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783539275, "uuid": "38ad4202-ba88-4d13-9780-c8fd05ec0cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539275, "uuid": "1926a31f-c9e6-44a1-aa42-620fbdeeb4a7", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a614e1-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493224, "uuid": "b0570f4a-315c-47fa-b1cb-6609510b6f7a", "comment": "Malware payload (ArkeiStealer)", "value": "bac3885f3dcafb834a25e6f90742e52f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493224, "uuid": "65e35630-1ebd-4853-aa0e-a2c72c579d4d", "comment": "Malware payload (ArkeiStealer)", "value": "dc1cbd35e7de92b10f9d5f63bf34610c2ca78e855cd7b9eac1d540e89c9d9a94", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493224, "uuid": "d5255fe4-579e-41d8-9658-a98ff12f7a3d", "comment": "Malware payload (ArkeiStealer)", "value": "eaf4bceee607b0f8123d2c1e2a5e82e7d3495f51", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493224, "uuid": "e9b5a390-912d-400d-8003-15d73e49dd0a", "comment": "Malware payload (ArkeiStealer)", "value": "cffd5c943c20fd4f7b169d490fb41af52769ede6fccfba5e7997653ae76928f41aba8b58cde26d6793e12fb4af6d635c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493224, "uuid": "0aba7215-9dfe-4af0-8cb0-16aef15a93da", "value": "T1FAD58C076CE149EAC8A9A33289B312927F70BC594F3567E71E4472782F32BD09D79790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493224, "uuid": "a88f72d3-820e-4fcf-b60c-dd88af5f6595", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493224, "uuid": "4dd558b2-9f24-49b4-9dd9-959350d16471", "value": "49152:6qEAYG39C1r+1F95hvgzWi8c84U0PEsnDG:6qQkbvMN4eEsnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493224, "uuid": "b695662c-ee9c-401c-8882-ce39e0ef1bd2", "value": 2987896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493224, "uuid": "8cf573e2-ada6-4197-9b79-f1e0a0770bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493224, "uuid": "8a80922b-0516-4112-800a-b71d9e0b165a", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40290.9093.18729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8839af4d-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517148, "uuid": "165d4bee-ae43-4d30-a500-d3fcedc9b485", "comment": "Malware payload (ConnectWise)", "value": "b62119f0ae9ad41612f252dd703799d4", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517148, "uuid": "abcc8425-8211-430a-ae31-e2ced3c8763c", "comment": "Malware payload (ConnectWise)", "value": "dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517148, "uuid": "c654fb57-4b73-4162-80a7-e16db9e3dd93", "comment": "Malware payload (ConnectWise)", "value": "a54e21752a34a4663cef87b75efe74be139a2c8e", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517148, "uuid": "b8805427-25ee-4b1d-8bd5-2c6411f57121", "comment": "Malware payload (ConnectWise)", "value": "347b6f5ff5c8b97b0fcb81627f43c14f77eb2c4df7657a11551a148d6da35327b2f66485933d933c125afffbd7700168", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517148, "uuid": "f1ceb52b-ee1d-467d-a884-37110b05f52e", "value": "T15546F111B3D995BAD47F0538D87A426A9A74BC045712CBEF53D4BD2D2E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517148, "uuid": "0ac48761-09a4-4bf5-b08d-b25cd0e51349", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517148, "uuid": "4bec751b-dc1d-4561-877d-14aab78573f2", "value": "49152:gEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:JEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517148, "uuid": "ff682b3e-2f05-49c1-a566-66cca6fd5c1f", "value": 5657864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517148, "uuid": "c0f8ccb8-2ebc-4afb-95bc-4c8b0538c255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517148, "uuid": "e7f9cc50-fb63-4d9d-8b3a-c5727925f76f", "value": "Document-Viewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698689ce-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783517096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517096, "uuid": "5ee50712-db86-424f-b22c-edee942f3551", "comment": "Malware payload (ConnectWise)", "value": "b09c029c6f88a6dad8ef690f9c42f2a5", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517096, "uuid": "d1a4ef8d-0d12-4878-9f4f-8fd004a2f47a", "comment": "Malware payload (ConnectWise)", "value": "dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517096, "uuid": "0b826377-bfd2-47da-a38f-f7e2f11614ae", "comment": "Malware payload (ConnectWise)", "value": "2d8faea3e5170802ff2212f862fd5ef1528289ae", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517096, "uuid": "26254930-60e5-42e7-be44-208ad2731ed6", "comment": "Malware payload (ConnectWise)", "value": "b681caa8b563878f587f7ede63c09d9d56bf8249e3fa499f263e14869ad824eb34da9cbe0b83d4b852ef4f8ee51cfdb4", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517096, "uuid": "9f33749f-456d-49cb-876d-6c86ed6fbc9c", "value": "T169D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517096, "uuid": "3bcb5595-5a41-400e-baad-e8b464f98155", "value": "196608:mHxcp9ym3nltDUJVLHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3dHW:0GplpYGpPGpjGpeGpOGpPGpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517096, "uuid": "eb7ab754-1f31-428a-af20-8da192d0fb6b", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517096, "uuid": "121901dd-ae84-4de1-9261-d357cc043d24", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517096, "uuid": "4671fb12-923a-494b-80c8-c2f807642d1d", "value": "Zoomupdateinstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b9ec5-7a9f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783495967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495967, "uuid": "dc4e23cb-e801-46d0-bcb2-864506b4bddd", "comment": "Malware payload (ArkeiStealer)", "value": "6a685b5aa7f1fe94b05137e90ac7837f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495967, "uuid": "b08da403-b1ec-490f-81cb-c91332917d72", "comment": "Malware payload (ArkeiStealer)", "value": "dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495967, "uuid": "b06f88fe-7445-4da3-b8f0-99e5cce00614", "comment": "Malware payload (ArkeiStealer)", "value": "363e201e6e7f43839f62b67ab7cce1e7f528db2d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783495967, "uuid": "2b03b709-967a-4445-9713-daef4b182f37", "comment": "Malware payload (ArkeiStealer)", "value": "fd71e93863c78c3132999b080a4e5fe45a87a5f071d493889c13e908a369a5a2c792dc136f90e741be3fb84d1492604c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495967, "uuid": "1d2671ab-54d8-4332-9c20-a7db94d804b6", "value": "T18925508ED9C213B5B396EBB3835EE2265DF535058072CA31CF8569358F02FA86418EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495967, "uuid": "111739ff-1505-4e04-b972-a98c91b3b72e", "value": "12288:cxmEXICq1zcLgURH1lcVQyNvKhT0xNhbPl5NUD7:cxNswLgURH1eN92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783495967, "uuid": "c1469598-3fbf-4f51-821b-63a11d3b64ad", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783495967, "uuid": "23b0a662-8021-4cc9-b18f-3c5b3799948c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783495967, "uuid": "5fb09834-7968-4fba-b922-571a60e65ece", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05039c59-7ac4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783511774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511774, "uuid": "8ae01a15-b7ff-441e-899c-7ff009eb60e7", "comment": "Malware payload", "value": "100922a82a82645dabfa889a15680428", "object_relation": "md5", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511774, "uuid": "99cc0f9a-5364-4d5d-b29c-7e3b4a77fa05", "comment": "Malware payload", "value": "dd3caefe5832fc0bda5b643bca1cda738c3e5a5794913b14c1fca8bf5f6e5acf", "object_relation": "sha256", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511774, "uuid": "12a7da75-c77e-46b6-9e03-b6149a009a33", "comment": "Malware payload", "value": "31b2202205211bca5deef6d196c0bb0bbfd5df41", "object_relation": "sha1", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511774, "uuid": "b0333553-83e8-4adf-8d1b-d5ea4519a7be", "comment": "Malware payload", "value": "5ddb97da67a618c12fb85b984b9997b1d23ed45529e2173171a8229bfbfe085d83f1c853e566d8a046708b84224057fd", "object_relation": "sha3-384", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511774, "uuid": "bdf6dbf1-4072-4481-b51d-60d2f40939b3", "value": "T15B7423F109C21E5C2BC442358E817913FC59F6845E5E1B6BB2E2827D30B5B1A9F83ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511774, "uuid": "a4fb0309-7279-405f-829b-af0a6899ac77", "value": "6144:QBOJe8Z+9jhhijphmJJSUd84YQF9Z6zdO/o0QCQqxTpdZlgXQZq/KKQ:QB8+9ujphmX8TQF9Z6hO/VeqxldzgAk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783511774, "uuid": "0b9947f8-4cef-4b4b-9a8a-42037cce3954", "value": 363619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783511774, "uuid": "7817baa5-7db4-40c4-a67d-046549e73b91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511774, "uuid": "c6338705-e6ba-4e5f-bb3d-f698eecd8697", "value": "\u041f\u0440\u0435\u0442\u0435\u043d\u0437\u0438\u044f 8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317502f3-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517002, "uuid": "c8700860-8d92-44ad-b101-eafdb248c476", "comment": "Malware payload", "value": "3a3c802acfd08f55c2e1402d0b07c07e", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517002, "uuid": "8b0782ec-0b98-421a-9a8b-805298196c7e", "comment": "Malware payload", "value": "deec5be598c015bb4d1bf5ac5941266bc0251a6051969c6e188a864f6bf551db", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517002, "uuid": "5310dbeb-b317-4bd4-b679-4c2c2fafcfbf", "comment": "Malware payload", "value": "cf45e6d642f2e0ab12762f21dd7c86e850d41282", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517002, "uuid": "5e7b7715-93d3-4633-b1d8-ff1441044f7d", "comment": "Malware payload", "value": "4b428802bc6d94826dbd73927c1a68359c8c1c33d01801984ab09c179fd35970b9a4636504114541f80afa2ee3c0cb80", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517002, "uuid": "c4431d12-93b1-4125-8570-654916a66c1d", "value": "T18711C05BD81E8664033842A281745D69CD97D45712675422BC08CC1FCFE98ECA9701EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517002, "uuid": "17aa170c-aa21-46b8-8ef4-e0d6dc3b298f", "value": "24:9A+HWkQFKQZvn+1n2DOIRdc9qsN/dQPfa:ee8FvnMCOknsN/dQPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517002, "uuid": "dba14947-3e05-4fd0-af35-4e9e1bc5fdd6", "value": 900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517002, "uuid": "a7d18989-3735-4f51-b349-0c45500a8e49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517002, "uuid": "4e5a271d-08d2-4dca-83ac-cc1d37d9e8da", "value": "ywnbTvfe.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f3f992-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493248, "uuid": "d3fc6912-9223-4ff4-a529-e4472b46515a", "comment": "Malware payload (ArkeiStealer)", "value": "cb5182a0497ca7f4ca955c38226a9375", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493248, "uuid": "8c1aa264-ea32-4be6-bb8d-bcfec17ca92e", "comment": "Malware payload (ArkeiStealer)", "value": "e13563d62d614eedee6768e235be05eca67e86d0329b604bd26de5f929622851", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493248, "uuid": "5eb36eee-88d9-446c-8f20-34a25164b570", "comment": "Malware payload (ArkeiStealer)", "value": "0ea2b1895dabb844729b37a4a5b9543aa1db972a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493248, "uuid": "85db4535-1911-46f4-b48f-387b42f9bb3c", "comment": "Malware payload (ArkeiStealer)", "value": "45a29ed40a1cbd36fcf0c9e8ac1ab45b4fb14b597a184350ced6e130ac510ebc37c2c3b4bbae06d600eb6ea0e72b22f3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493248, "uuid": "3e9a5777-021d-43fc-a0b3-f6cd2d408432", "value": "T1F0E57B467CA148E9C4AE92728DB652927B71BC080F3623D72F50B7782F72BD19E39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493248, "uuid": "6b9cb3cd-0fc5-468d-8b65-5bf0fa7c0e7e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493248, "uuid": "6dafb1a8-0101-43f8-a2c1-6b9281be51e4", "value": "49152:ZsI9bZ+KcMY3KP6NyTfRriWACVtNq3723W6m0o5i92KsP7gX:ZsUnN9r1ACVnq3mW6mz5c2Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493248, "uuid": "ec206dc3-95d8-4dcc-b0a5-33b12965fc38", "value": 3089776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493248, "uuid": "0ae6baa0-a18e-48a1-9af7-38bcd5ba3e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493248, "uuid": "3c351dae-df57-4b93-9e0b-25b963f0bf38", "value": "SecuriteInfo.com.Win64.Evo-gen.16882619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d14e6ed-7ae1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783524350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524350, "uuid": "30f47e14-317f-4f94-8e74-5d406dc07e5c", "comment": "Malware payload (Mirai)", "value": "7c8de5f7f49467f66573a04c09abb5d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524350, "uuid": "96f6016c-a89e-45f5-aa81-648a683d605b", "comment": "Malware payload (Mirai)", "value": "e165c696292658e145bcb7909d535e45972852c5b7f183c2b8751c74f2740004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524350, "uuid": "d2c514eb-76ec-4b6e-bb89-ce3a1f770f70", "comment": "Malware payload (Mirai)", "value": "649af1c0a05749a08aacfef78ab5658e6d6edb01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783524350, "uuid": "ade67b19-1c35-4051-b8cb-c5712ed1935a", "comment": "Malware payload (Mirai)", "value": "5cc0a8bec29c4718455b32121bb82f8ae51d3fa1bde5078457a1c68abd6dd0051e4bd1a85eb22830bc55f3412338c814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524350, "uuid": "0c472063-3eb9-4b54-86a5-64b2ceaf7208", "value": "T1F4D32946F8824A22C5D722BEF92D218E331317B8E3DE32129E245F6137C659B0D7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524350, "uuid": "5f808392-917a-47cc-a641-1a3475bb7a6e", "value": "3072:whnw1dzzJI8WseDYgd7IafuDKxyCqiR/oHvr:+nAJI8F7gdMaEtCqUoHvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783524350, "uuid": "75606669-7fde-4e7c-8701-c8290abb6253", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783524350, "uuid": "926179da-52dd-4d44-993b-f460fbb0f3a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783524350, "uuid": "f84d341e-dce2-4964-9831-fd7550ea3b0b", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5782d166-7a6d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474546, "uuid": "c29c9186-ea25-4e3e-9fed-1a03d4953372", "comment": "Malware payload (Mirai)", "value": "f1e05ecbc76b7deaf290e6d93fce272d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474546, "uuid": "ba5774a1-c6e6-43c5-9333-5a985ba13e11", "comment": "Malware payload (Mirai)", "value": "e232ea3c0d93fb985c774ac8dcb41cc6c2301ab7f06a5054fbf25c14d839ac1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474546, "uuid": "1197e809-8546-4272-b27f-196e96b92c55", "comment": "Malware payload (Mirai)", "value": "b4c377d4ba45bacca077015a2cdbdb44b9992295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474546, "uuid": "ad7de163-1d87-4f07-9c92-15706253a8a7", "comment": "Malware payload (Mirai)", "value": "7566ba080fffbedee986fa4f25ed29e49e84230b93be7a6abe9e1d42a4f7cd7cfa7f3eab5f4631c9daa4d0aeffe3c38b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474546, "uuid": "f16c6841-2444-49f9-a98a-de339e469b64", "value": "T134A2CF50BA662F91DFFA39F4C8A8EAC037916F8C77C5CEA33C9517211F04412261ABD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474546, "uuid": "d3b994f3-652d-433c-95ec-f8fd09862232", "value": "384:gZb1DeKoPW9YaOBlu1sCZDEcsFNeLdkEtCzJTtZjSigcOpbxHSM4uVcqgw05VxJ7:8bsK39YaO/axo3GyEtC5fSigNxHJ4uVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474546, "uuid": "181f8aa1-e2e1-4608-b8a2-a46c065fc6e8", "value": 21484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474546, "uuid": "1562fa61-0c6d-4245-90e7-3a276474b319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474546, "uuid": "d363da0e-5663-484e-86f7-b8576703b16a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7e9dbd-7ad1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783517742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517742, "uuid": "47d37243-0c31-4fcc-b5a7-93bc9dca15e0", "comment": "Malware payload (AgentTesla)", "value": "93c36f0c1b9d6d90f98a8203b7b0edfa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517742, "uuid": "ce0a97a4-e618-408e-90f4-a2a24eea903c", "comment": "Malware payload (AgentTesla)", "value": "e2f1b0f3f9b185022fd7b52107642aa6ea88ecd8ecf446836f18bcd76ed6d479", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517742, "uuid": "530cacde-beaf-4d62-8ca6-7775b8922d39", "comment": "Malware payload (AgentTesla)", "value": "02992dac2784babb646a39b27e3e81caa5e0aea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517742, "uuid": "28a0eeca-2729-4452-b5b0-064a7b8102c2", "comment": "Malware payload (AgentTesla)", "value": "dca85ca99c2ae46153541a551dae2995206c28d198fdcddc1ec4b50a454631ac57babb2f67a0a48bbc3ed8a7f0954b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517742, "uuid": "df5c455a-1266-405d-bad6-a92650bae102", "value": "T19474B0A1F2E9C8CAEC12127558B7EC332567BE6D6471551E316F3229ADB3393006BD0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517742, "uuid": "8bbfe87d-7b43-42ce-aaa8-b602d2813f61", "value": "6144:ogORaspjQelDUXTZkXcwi5L+9kMkbJ3uFi5Kb4IaD49K:ogyjzIFkXcwY+qMK3uF3bdaD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517742, "uuid": "8b067560-b70d-426f-b82f-41da6444c8a2", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517742, "uuid": "69dd4803-b1ef-4d54-a0f1-f09d071193d4", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517742, "uuid": "a5b735b8-2eed-4457-9604-a4affda20ae5", "value": "000999090776544009.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e462aefa-7b0e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783543931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543931, "uuid": "d2823579-cc5c-4dfa-86da-65637941a3aa", "comment": "Malware payload", "value": "bff03448cae885edccf909736cc38731", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543931, "uuid": "52f03bd3-5406-486a-8a85-31a4a87b1c22", "comment": "Malware payload", "value": "e30e9845752501617a284f8b48d1b79b51cccbbfe04cfa513955c1e755320806", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543931, "uuid": "08a899b1-e889-46b6-8d21-26971594f8de", "comment": "Malware payload", "value": "19170697590827ea6e5344967673149162873aee", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543931, "uuid": "029aca1f-0996-4d94-912c-51ced7537d4c", "comment": "Malware payload", "value": "7419946b36cb67508d913f0ad7cd0305fb4597cdd764004a381182edc30af153d9163dda2b3eed11e95b10a5cb239f6d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543931, "uuid": "dd6b36c9-ba30-4e12-aa85-3db1f5d65e31", "value": "T177E6331C56E421EED6B3103DFEE1A2A2B274347A0776C9CF03A4C7A1AD171E08D7E956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543931, "uuid": "51a05d5d-2e36-4d55-ab71-9741f9f3b6d7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543931, "uuid": "dd1c0296-593b-4d64-9302-86bbe7cfbdee", "value": "393216:sGYF+arpSRBQSUknbLcM0aKF0RhXMCHWUjXpcuI3/PGTAI:srlNMjUkbSqXMb8XeH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543931, "uuid": "6f4a3128-4add-4eb2-9b2c-451f0013fad2", "value": 14260128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543931, "uuid": "03d5165e-1189-4de7-8e25-2a6249fc4ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543931, "uuid": "c06a56f5-0bc4-4453-ac57-2bffba9df602", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc99851-7b00-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537615, "uuid": "9f3be6df-894d-4134-82c5-ee19f8829320", "comment": "Malware payload (Mirai)", "value": "c72aeb1e7b7e8df2a9635cdf4ddfbe78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537615, "uuid": "e70e70b1-47d2-4ec9-8652-3112796c2b6a", "comment": "Malware payload (Mirai)", "value": "e3d5a0c97327eb83b2674aac333131cb1030f4256f12b4ea31244f4fe112d874", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537615, "uuid": "598b52ac-cb55-46bc-86d2-2a22869b9f37", "comment": "Malware payload (Mirai)", "value": "4793352d8edf60a47bdd16a8fef37472b9294d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537615, "uuid": "ae93abf5-3e4f-4c16-911e-994cf5338c60", "comment": "Malware payload (Mirai)", "value": "1dc4aa3569b39a6a8498715e9bdcf29def2e061ffa20a0e056168ebcb04c2d4e763c7adaf780e0dbef265f0cdf5f9f0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537615, "uuid": "6f4fb15f-f81f-4e6c-a699-e77b2bcb37e5", "value": "T12DD39EA7B34F10A1C82506F40BCB5B9D2E6325815E2B97E77D6E323E1E321DB5801BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537615, "uuid": "57c9fd92-fd63-45dc-8b6c-7bf37d470f73", "value": "3072:RKUM9VYzM0L2oQ7YRSiZBvVqihw4gVCtKe+//W/q:RMVCLW7YwYEiOXCtKe+W/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537615, "uuid": "41c21a57-7a57-4097-b7d4-4f17527010fb", "value": 140748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537615, "uuid": "39be0570-7b22-4342-94c3-bdec1514c4fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537615, "uuid": "66852e00-ab50-444f-8d51-644c5ea8c929", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7dcf9a-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493239, "uuid": "a766608e-41e1-4a31-b260-2929e0ff69db", "comment": "Malware payload (ArkeiStealer)", "value": "8667f77f9c233c62f52d9f1d9a1e04ef", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493239, "uuid": "f077d63f-b7d0-4cbb-b69e-138230c1ae97", "comment": "Malware payload (ArkeiStealer)", "value": "e4556f7a0e2356a4e6816987bd8b4d9b408c7aa8609bc22cba1e6e968097ad20", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493239, "uuid": "ee374674-995f-4fe6-822c-f045e10b6bc2", "comment": "Malware payload (ArkeiStealer)", "value": "dc5112824598a39e2592a5c42cefb65d55e907e8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493239, "uuid": "a5b985b9-b2be-4479-ac36-0d5e008860dd", "comment": "Malware payload (ArkeiStealer)", "value": "14c611a18df8dc7bf446399d389f4192f17da8f198cadbbb9e50a3dd6fe3de0ef233288364a63e5a20a46d2d16fa125b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493239, "uuid": "5a747445-b0fb-4d8a-8915-fa9eefb2b95e", "value": "T1CFD59D0B7CD049E9C46997358AB65281BB74FC4A0F3227C72E90B3382EB6BE18D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493239, "uuid": "c8196185-14c1-4d20-b18c-11bb6115c9e0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493239, "uuid": "24f4f67b-fbbc-4da3-9189-6a813835323d", "value": "49152:5l90oGJXq19uNBsaUnTedjVfwkwgB+qOeVFLPo4mid4Cr:5lvt902dqV1w5KfLAVQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493239, "uuid": "8af77132-8904-40a3-b0d5-804e0690953a", "value": 2936680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493239, "uuid": "8205d8d9-f846-41e2-b698-6a01606afe8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493239, "uuid": "3eafeb40-2802-448b-bdaf-bdd8a6af9814", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40308.16415.18375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef53e331-7a71-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783476519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476519, "uuid": "63aa8299-83de-4785-ae26-84b2e35d987a", "comment": "Malware payload (Mirai)", "value": "52aabad745746d348248cbe3059355f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476519, "uuid": "1257c4ae-9910-4780-93f4-4ba31a565095", "comment": "Malware payload (Mirai)", "value": "e4897305c584eb9c2dee7fbf0cea9f454a2aadf83736edfa497b610d60e6aa3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476519, "uuid": "a84f8f4b-215d-4d31-86a4-ae2350c83148", "comment": "Malware payload (Mirai)", "value": "e59a9ae26fb769a6809d9c9da760465edca1ffab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783476519, "uuid": "b0a19465-e355-4f7e-97ff-1e8bdd0bde0f", "comment": "Malware payload (Mirai)", "value": "711c72647c009324b5483a3f7df9d009f69ce46646530af7b0ec4a7ff0ffbe22c4980e111e98ca8fdd5883246750804b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476519, "uuid": "c03a0fb7-c2b2-43a7-84e8-99f16ca59813", "value": "T13A93F781B8824A6AC6E02379E66E718E33A0B3F5D2CF3127DD615B12779518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476519, "uuid": "9b3ae2bb-8b11-4d81-98b9-e19a315e65f0", "value": "1536:9m0L9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthSDH8ku8oeIH:9rBq1BtD6wq5UIORIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783476519, "uuid": "dd7d0cf5-2ac8-4b37-a306-180a05998c1e", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783476519, "uuid": "dddadc3c-7604-457f-ad45-fa342b3d1a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783476519, "uuid": "f82d590f-620a-4480-a6fd-99d83d6cedd2", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed4c6c6-7ad6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783519682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519682, "uuid": "07361cb5-9152-4f89-b6cc-29d2f577a8ea", "comment": "Malware payload", "value": "929988872ed24b6d8f0d3995c549897f", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519682, "uuid": "51b235c3-448d-4143-b5d6-0a1bb10c2a47", "comment": "Malware payload", "value": "e5356b14ce24b2e193053edd0989a318b12154401e0de8190fdeec0eb946cf58", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519682, "uuid": "8f830a26-714b-4aa1-9e63-3b99f2aa2ff4", "comment": "Malware payload", "value": "855a012899f695c489af3d194bcef3ac17bcf9d5", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519682, "uuid": "c7ba5526-aa23-4005-a943-5aa10b834263", "comment": "Malware payload", "value": "64933c6ce912dc981e4b5f14698f13966b7622e5479ae4b3ee4a437c3fb81cc325a707affcb8252e520aff47d4ec0645", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519682, "uuid": "c1c31759-426c-4a95-83bf-441f5261572a", "value": "T130A5E1670E6E8FACF5CB12B3D2044A1744AF75A48C1599DFA4B4FC4A66C3D89B00C3B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519682, "uuid": "2655c283-87c9-44df-b719-e51c4928831a", "value": "24576:R9ZTpR6swMp7S9yfhpE8O5qyWfFdDHIcd28nE+kx1XEaBsc1GzujgIMs1WDPAzPZ:db7So50yrocAPzfyg+ucDPBYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783519682, "uuid": "a9cfda13-1bec-40d8-945e-4b0e125625ec", "value": 2090720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783519682, "uuid": "5200d3b9-0e6f-478f-9e78-a45475998e60", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519682, "uuid": "ff8722d9-0a01-4b73-a92d-0733d32ea66c", "value": "Finder-555549446e876cd97cf23c9984f014a9df80e377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fa3494-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493250, "uuid": "0fe63cf5-e9a8-45de-bd12-968aeba2ffb8", "comment": "Malware payload (ArkeiStealer)", "value": "709ea5e762388795e210275ef38f885a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493250, "uuid": "27518659-c581-4957-87a8-e60e6fae02b1", "comment": "Malware payload (ArkeiStealer)", "value": "e5ad234bb8d0205dbc2fd60e220fb4fe879fb2d252f716cff78eb309c30c7421", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493250, "uuid": "a58b5c90-8bb2-4d65-8ca0-1bea088181c7", "comment": "Malware payload (ArkeiStealer)", "value": "4b79a89fca4c74c201988a6a84eb20ea3da29ef7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493250, "uuid": "d32392d6-8c36-41b8-931d-20be44b4552b", "comment": "Malware payload (ArkeiStealer)", "value": "2c986ee51771c71b31935392af152b2130a408f185d232ec7ffe0c8c37dd066a4ac021a0fe21d6f56b644ee218bcc53e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493250, "uuid": "dcaa7867-890b-4b20-9154-e34975d17faf", "value": "T139E59C07BCE149EAC8A9973248B742957B35B8150F3663D72EA0B2783E777D09D39390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493250, "uuid": "f5f15ca7-5a98-4033-a02e-fadc75512630", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493250, "uuid": "eb6df62d-12d9-44bf-97f1-f2bc908f8176", "value": "49152:8AI1HysX8Mlui6N+30xHQQqB217ViIEqiZ5v7cXI846c:8AEyf03Tlw8fLCIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493250, "uuid": "945d3153-bf1f-4b7f-9944-c5cd9e899138", "value": 3043696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493250, "uuid": "5fd349d6-d59e-4687-b8eb-7ecdeb85399e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493250, "uuid": "c97e77b6-564f-4319-a9bc-427499f6a525", "value": "SecuriteInfo.com.Win64.Evo-gen.32876437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778303c7-7b03-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783539024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539024, "uuid": "bc1f8adb-dd63-4840-9885-301779eb4e1e", "comment": "Malware payload (Mirai)", "value": "e2f33d6045968e0d21538faa04ed434b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539024, "uuid": "58b01141-aeae-4dec-9700-dfc61af852c3", "comment": "Malware payload (Mirai)", "value": "e61f59605f09686fcc8fde4e1d20fdd6069d02841708ecd5b6866f05f300f6ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539024, "uuid": "15506800-e932-4815-835e-ecb5d7cfbf2e", "comment": "Malware payload (Mirai)", "value": "f7e849cc98f8a2c5195b5e9379154b5251b3f2d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539024, "uuid": "1b0865ff-792a-4d5a-ad40-1e40a7fc5d78", "comment": "Malware payload (Mirai)", "value": "033a64508b7699095200581ee7314b71f0aae8b7a6d06abbfee61e189785988352eeeaabf05d1cd7fbfa5f5ac580ce51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539024, "uuid": "7b0c4036-57c3-4d59-8113-2454a4808a0c", "value": "T17DC2E122916ADA10D7B86777EC4D5F8A1B8A0FF8B0F9502162159D045EDF01EDFEC28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539024, "uuid": "68988c62-d683-456c-bf87-bb06d111c6e6", "value": "768:GBH1MTjpfC2arfKFdqeb4y1QJyoRZ/p75o+89q3UELKn3:oCpajC34zf7/p75o8Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783539024, "uuid": "39626c13-1f93-4c51-ba2e-8913c68d0e6f", "value": 27288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783539024, "uuid": "f31d75fa-704e-4a81-a7b2-77d8e0cd56b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539024, "uuid": "53444792-f504-4365-8392-ae0bd0d9dd3b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a99128-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475294, "uuid": "d74920fa-4170-4948-a95d-c7d72a983706", "comment": "Malware payload (Mirai)", "value": "f921edf399e0d4c6c28aa4fe7836e17f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475294, "uuid": "35deff4a-2841-4a24-afd2-04ef265146f5", "comment": "Malware payload (Mirai)", "value": "e67901d60d2dfbfc71154b1aa0aeb10a828a346910869d75629ebbdb2b89bd8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475294, "uuid": "a35de561-a5be-42a5-af8f-c949d85af348", "comment": "Malware payload (Mirai)", "value": "0337c5129da90d9f305182ded5347a560929a009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475294, "uuid": "73062a3b-bbbd-4f64-a5bf-cde90b9b59d7", "comment": "Malware payload (Mirai)", "value": "880636a31d48d674a201d06c1c7c900b7403c7f0bba644ef533b0ff56e58662e4140d6f23fd93ee4f21ebb4747bd56ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475294, "uuid": "eb0e4fbe-3304-4faa-a865-9be39b20c84b", "value": "T16B23F1D351BFAA3DC552DA76408F9250EA3EC80E2955C3877AF812ED4FABD5B5C21E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475294, "uuid": "795ecad0-fd2d-4d77-9ff2-60f58733ec8e", "value": "768:a+an3RY7qKS4o2SeAgPBOAcLorb6T8/s/hOMBtE47fJmfHq2BwyNIriUudGpWoIO:y3+7k4oZCAonl/aTE47BmApgdGp/IBxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475294, "uuid": "f765f5a1-0b62-4887-8d54-e2ff434ffa7a", "value": 49500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475294, "uuid": "caefb17c-8d27-42cf-be5b-60629e387f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475294, "uuid": "ba48dec4-2a11-4003-b391-a1694a73a942", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dbc340-7abc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783508465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508465, "uuid": "878e60c6-dcfb-42ac-871f-c008a2ebde36", "comment": "Malware payload", "value": "7835bd8867f2875cf2c1146ff1e432d9", "object_relation": "md5", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508465, "uuid": "a666991e-581c-4892-9ea9-d354015210af", "comment": "Malware payload", "value": "e6b1a9539e90c37f1c13daddf36d1e699e793459db8b1c82189a49bc4818108e", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508465, "uuid": "54375509-1799-4244-94c5-f1c04dcc4999", "comment": "Malware payload", "value": "6752d152b93cab068f9ac3e9e700b4ea6c968b80", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783508465, "uuid": "ff6733a7-d523-40dc-8ab9-fba34636ab9c", "comment": "Malware payload", "value": "65451b021c80c8b902bff6291052c4ac021584679d4e2a2dd106c5b5538578be0ac5265983c8d360bb5f5f640ac2b1c3", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-29", "colour": "#EF51CA", "exportable": true, "hide_tag": false }, { "name": "104-249-10-191", "colour": "#569875", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uiutils-com", "colour": "#92F4A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508465, "uuid": "92e5bb0d-5187-4fdc-abdd-9cdaa825570a", "value": "T1D0317833138BB2E0D19098F6B9A8D20587B55A38708284D7F6F99542F5520DDBB3C258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508465, "uuid": "f9f7aff9-62b8-4158-8949-4c3edffa68d8", "value": "48:w3b0Xj/wxHEqHTiOtM90G6+gYfN+pEciSTQ:wrkj/KHvR+9l62fNfcisQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783508465, "uuid": "872b7ff8-f04c-4f99-9989-752958cb0d74", "value": 1694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783508465, "uuid": "0f4330e6-4783-4584-bb3b-09e9685789cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783508465, "uuid": "8170bc1f-4393-4b67-bdd6-68aaa7c803d5", "value": "clifix.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76105bb-7aa8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783500128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500128, "uuid": "bda06818-b2b8-448d-b0ff-73a25e7654a8", "comment": "Malware payload (Mirai)", "value": "caa1805f6fa60a0663ac31a9d11f067c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500128, "uuid": "4cbb16be-24f7-425b-a19e-d39dcac54b10", "comment": "Malware payload (Mirai)", "value": "e7e8f630c7902ebdfb13164b4d1a5d9f220997c96b90b46148c863e2d46fe96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500128, "uuid": "f6109448-ea62-4f41-b033-6000d63e0bde", "comment": "Malware payload (Mirai)", "value": "4f03f03634260c820d681e17932bb8761f4b69e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783500128, "uuid": "88432b22-ead6-4861-9beb-cd1f8c5aeb0f", "comment": "Malware payload (Mirai)", "value": "c0d43817c4ed324713e2e30fef6edd0757346e1c47dd7659bdea5cc1820d1c1b5c66ef2c01aaf8c0e036a29f687b94b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500128, "uuid": "f94893ce-e83f-464a-b8da-a99e97773c47", "value": "T1EC23F114C2F49FEADFCB52761588E1971390DFEB9267CC8330CEE6A03595D02B5A96E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500128, "uuid": "1062df42-4c29-4c87-89db-1262d52a4f0a", "value": "768:8mBrN1oPOSI35TzozdYvuP+3zx8QnjL5JnK+08vKOfdx/IA/k6xt6/NC/fmY/Q49:8CrN1oPO5KzdYvuCNPnjLvnKxoKmXIA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783500128, "uuid": "6090f2ac-09b1-4ba3-97be-4516a4ff8d9e", "value": 46952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783500128, "uuid": "7eef8b39-cb6b-40a3-88ec-1e0ee1f29354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783500128, "uuid": "54952ccc-17ca-47b4-874f-af8a27a49f0f", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f814c7-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493253, "uuid": "0e52d4d7-5f8d-40d6-9e7d-4d3b156d5fb5", "comment": "Malware payload (Vidar)", "value": "c2d0a102f5ed91744b9724d6deace10b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493253, "uuid": "3f4e333a-c1eb-4aba-b912-bf2ef815b613", "comment": "Malware payload (Vidar)", "value": "e8f15d19c9c20108530850a8addb4a013eef0b4f96687519a5cacc3e90c9169e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493253, "uuid": "077a161d-7aff-4f1f-948c-dbc70f600c8c", "comment": "Malware payload (Vidar)", "value": "8dbef332d0a1a51aa71c24f27d05f6590a56bf4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493253, "uuid": "5271635c-997f-41c1-b08c-d276abfa1685", "comment": "Malware payload (Vidar)", "value": "ae2652ad9004ceec919d06d204f22d10ec420e14055569d692be42f913dc25d54acae679d728401e4c6dc3b1b8e87366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493253, "uuid": "0e9848ab-3890-44f2-8c03-a9c790b4161e", "value": "T1DBD58C077DE048E9D8A9A33249B652527B31BC094F3567D72E90B3B82F727D09D39B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493253, "uuid": "2cc9d45e-28d7-413c-9b4b-ad5587451dd4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493253, "uuid": "1da2fc86-4374-4a11-921f-154e98922d57", "value": "49152:1KfnrkEusOeqwlqKb+4tmLkxoo2ycXmlndAGnS92b9GDC:1KDlJoZyuKeGn4I4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493253, "uuid": "11dddf79-ce58-477c-9c42-eb9efdac9ee3", "value": 2983784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493253, "uuid": "8bcc86ad-21c5-490a-87ee-814c09708d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493253, "uuid": "92c50689-5c02-4541-a831-6b9802c9039f", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40274.22144.9245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aed607-7a90-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783489787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489787, "uuid": "b8ec9ed6-df36-4048-9bcb-36e35504c83d", "comment": "Malware payload", "value": "4cb129c701fbc94a93318dbb18aae194", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489787, "uuid": "1e778f29-05be-49db-8193-d614d8ef925c", "comment": "Malware payload", "value": "e9554b920a4a65df1dd5809afcf5e9d0c5cd448528a03c7a232f83abcc565cd5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489787, "uuid": "c40ba901-8866-4740-8ecc-91ac073b3cea", "comment": "Malware payload", "value": "c76136af8f8b2aa1818067d7ae3632b2a7f6627e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783489787, "uuid": "d3596f7f-6ebb-4a47-863b-edba5645d6bc", "comment": "Malware payload", "value": "1440d072e644ff8a502b46d599690b62e71532ca788d408b75b58a408b49cdf2c06fb855c2490f3a81a8992addbbd2c0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489787, "uuid": "8230fe0b-f75e-484f-ba1e-006b49f85ebc", "value": "T15E357B53F383C075DEA100F3E4B662365A74B969572858CBF2DC966ECB74AC09237B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489787, "uuid": "f5b1aa50-5242-40fe-a219-48f3522bdf17", "value": "fb40ad72cb65f1767a2e06fa73fcbc83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489787, "uuid": "b5017295-aca8-4109-b700-9b572e290521", "value": "12288:bZG2BGJTZMbd4QfTbrRstnKCLIcRtgczRJaFABI2/EKxn/Pa9lTcBDhU/l3:Y2B4TZMbd4QynKCccso/TNx/GlTShUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783489787, "uuid": "ecd5dffa-4cd5-4df4-bb8d-5a1a8dd7eb03", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783489787, "uuid": "1d908458-398b-4225-935c-55f233785be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783489787, "uuid": "cbe49d17-e193-44b5-8d5d-32d88f64ca98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16187bb3-7aa1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783496770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496770, "uuid": "37ec49d7-bb46-456b-b533-d13be85bbaa1", "comment": "Malware payload (Mirai)", "value": "9229f59b8afcd9d4d186d18160f341e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496770, "uuid": "ab9b1992-0c28-440f-a367-06ca57fa9315", "comment": "Malware payload (Mirai)", "value": "e97e92cd7f069edb07be58a78c2747d458256a120b0635a0b3ad4d159fcf3d92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496770, "uuid": "17f4c46c-83f4-4bde-a522-2873b07a485a", "comment": "Malware payload (Mirai)", "value": "413fc28be4d66357ef4448a765b7baabe35d0d9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496770, "uuid": "5b6d3b47-a4aa-46df-a2c6-71bb1135e84e", "comment": "Malware payload (Mirai)", "value": "a63c7a913b9a42c4c5f40460f9d8aeffc1cd08578b45cf119392b22c367c8d6c7139c6e97a10b189fceac6ae48571e12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496770, "uuid": "59196bc5-5d79-42df-b948-e93d1bd9bce8", "value": "T14E33F19C1F8884AAE1CAE1B7DDB7CFB01E320365F583AE91B8495AC74A91C847DC3584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496770, "uuid": "8e91aa30-8d6c-4128-9e61-4fbbf564f9c5", "value": "768:xsq/h788rVWM1m+UcwUf8FkHBkcvATyba/05VSI3Hk590Wt9dcjcgVcggBywJgGK:Gq5QM1ttR8Ttybz5rI97POAgaggpVJux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783496770, "uuid": "b986b1fd-60de-4985-ad0f-44778c792997", "value": 50524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783496770, "uuid": "adab38da-c910-46fe-abb3-428f50233c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496770, "uuid": "1ba8f607-951b-473a-ba04-63a9279b28c8", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfda8d33-7aa5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783498773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498773, "uuid": "220737fd-f5b3-4877-9725-ec92402008aa", "comment": "Malware payload", "value": "7f154f8b6d073a3a8408c8067f26625c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498773, "uuid": "b4ae9662-77bd-4e57-895c-44d1adfc700a", "comment": "Malware payload", "value": "eac04f0b42e94aebdd60b151b3868ecba53376563ad3c5ff9cdb1e1dab947c4a", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498773, "uuid": "a9523305-47dc-4edd-9657-9647b997872f", "comment": "Malware payload", "value": "64cb4240c0442ff9d38e5e572a1288389f1fe009", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498773, "uuid": "07132893-e7f3-47dd-843d-1c441686b4d5", "comment": "Malware payload", "value": "641a70f51959dc854fe52f088df4d962647331097d4045eeec84fb95d852cd29f93d679b4465354a89ff2d400ef7e48c", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498773, "uuid": "1d40a254-ed15-4d62-923c-00770b8f7c6c", "value": "T1B6F17279880F71ABE356404F0C4AC51E5E509857A98A78263FEC12C01FDEB28F1BA7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498773, "uuid": "b5ea337c-67a5-4599-b177-6e036ed55ef7", "value": "192:ILyQOUA+O1JTbX9t8+dygH7dcK07sTwTPUxLR5:IeQOUA+O1JTT9ttsWK1yD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783498773, "uuid": "3b495e84-ab2b-4c15-a156-7e4d83fb6646", "value": 7968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783498773, "uuid": "e2936115-e7a2-4168-9927-50189b83e45c", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498773, "uuid": "35fd7bba-b572-49c9-b1f4-1a5f66e94e64", "value": "DiscordStealer.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b80d8a-7b03-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783539051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539051, "uuid": "1cd28e25-f70d-4761-82e0-4248f732cac3", "comment": "Malware payload (Mirai)", "value": "01d1c79535790ab5605a8ca7a826ee10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539051, "uuid": "ae99a583-027a-4ed6-976f-f3fe1f21672a", "comment": "Malware payload (Mirai)", "value": "eb904cb0027b384ee4d64aad2d70669a6ddb1103acbd0a2c2334c87c055e75b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539051, "uuid": "50aea9fd-54d3-4239-8706-c9c6599ffe31", "comment": "Malware payload (Mirai)", "value": "13e6e0083f1ac5df03c642dda68e410aae8cb8ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783539051, "uuid": "8280e3ba-6b48-4966-9900-e70e403fc762", "comment": "Malware payload (Mirai)", "value": "630f76d4d7c363094b03fc38d9b69f25c2adeeb564310de1b91e36feb63a5beb6b0cdf41f5f8a995ea5a0aa96d6bf6cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539051, "uuid": "a87a99fe-d0e0-4046-ba0c-e4b69c28e0ee", "value": "T10663F956B8814E26C5D5027EF92D128E371227F9E2DFB2229E205F203BC652B0E77D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539051, "uuid": "f4d7dc4c-b14a-47f4-809b-dc67619f28f1", "value": "1536:qtniPB8O2icTkOmUktMNfakQbq0fWhvf83ffvQ7CcoIyi2AQ:5mO2rTQU0Oi9ffvQgAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783539051, "uuid": "65bd1c87-d4cf-477e-9bdb-9e0b3bb0ae21", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783539051, "uuid": "ec592110-9cde-4f61-ad50-9a910bb2bfa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783539051, "uuid": "7253d383-f06e-4d30-9048-ae81ba00b323", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a5392f-7a6c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783474091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474091, "uuid": "271047fb-e450-4d5e-bf93-8b5f20c6ad71", "comment": "Malware payload (Mirai)", "value": "16b728683d0995c97c9a0d05eae00733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474091, "uuid": "3cfb5e06-c165-4126-984b-6f2540213ad5", "comment": "Malware payload (Mirai)", "value": "ec184ac73eb461219a481eefff4b6406c88fde59b8074859ddb1a66ade533e33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474091, "uuid": "0a4049f8-da37-4666-bc05-27a61592393e", "comment": "Malware payload (Mirai)", "value": "7460387e55f888a8228401a876a8c9293b28a7d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783474091, "uuid": "87db07ae-2ab8-4287-94b2-fa1c2875f646", "comment": "Malware payload (Mirai)", "value": "f397655ca2b4989aae2a038b8762cfcdb9a2df0ea1e8873e9b4650dfcf528d9d4ca43b8a204603cf806e7d4852b8d8d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474091, "uuid": "3c4c23d1-c955-46c4-89a6-718ff0878b6b", "value": "T183A2E0BFF38D6B22F1D343304C62290DE5E2D753DBA63A0DA51A26D413ABD10E538561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474091, "uuid": "716270f8-5c4b-490f-9e59-8c82b48050ea", "value": "384:vwMGfqOYJvDbU4eL40GmRvqBjntatfpioB8XiHF8hn5l9Emm3C2cviFqcJO:vqfq3Q4PiMstf0oBOHN2m4Gsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783474091, "uuid": "2b174222-df87-453a-b9d0-b9565cf4328f", "value": 22388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783474091, "uuid": "25f06d1e-8a45-4c41-b490-3196da8dba67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783474091, "uuid": "51934e53-5555-4404-8943-a96c7084a22d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fff35c-7ad1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783517756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517756, "uuid": "cc097a55-a5e7-4376-9063-35f37333ba47", "comment": "Malware payload (AgentTesla)", "value": "6e9cd29d317d6f0251aba016f04ea281", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517756, "uuid": "0c2dabec-33d6-4025-af56-2b3d330ffa98", "comment": "Malware payload (AgentTesla)", "value": "ec8642b8f9d76743c3d9b65f2496f41ba136ff4f1ccfbe4069d494e6a3e579f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517756, "uuid": "ce58e206-5d75-41f2-827a-ae64c9850e4f", "comment": "Malware payload (AgentTesla)", "value": "0b64e89c66e5f0f93b164967c738949d7521002f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517756, "uuid": "5ce38e4d-cf61-4546-aa18-485ba66e466b", "comment": "Malware payload (AgentTesla)", "value": "47fc896ee41a59c4a2aa7ca712d99db690da61023a63fe5d8bd5d599bb9a26ac01b2e276287971b1c13eed98a8d412be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517756, "uuid": "ea3bfc37-8799-4706-a9ef-0fbda2f8a851", "value": "T10A64B0A1F2E9C8CAEC12127558B7EC332567BE6D6471551E316F3229ADB3393006BD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517756, "uuid": "e66c5bcf-5074-418f-ad91-6bba5651c7d9", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517756, "uuid": "177fe637-9f27-4018-bc41-1362ba9f7294", "value": "6144:TgORaspjQelDUXTZkXcwi5L+9kMkbJ3uFi5Kb4IaD49Kt:TgyjzIFkXcwY+qMK3uF3bdaD4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517756, "uuid": "adf9a02b-dcc3-4417-9f74-2661fde8cd57", "value": 334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517756, "uuid": "baddaa92-c9e5-4d6e-9d45-fdfce068abdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517756, "uuid": "4f5e9cd6-0671-4ddb-b363-4c8fd087b62e", "value": "000999090776544009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86884274-7a8a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783487080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487080, "uuid": "de32f85f-6965-472f-9793-7ef0925c0a31", "comment": "Malware payload (RemcosRAT)", "value": "c59af738f051e091367d9ebab115e1e1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487080, "uuid": "760d052b-e303-4746-a30a-36250f8dcaf5", "comment": "Malware payload (RemcosRAT)", "value": "ecf00732179f5ec70ebf55c50812a3520092f351926b89307d928f5b83601e72", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487080, "uuid": "abf3a1ac-e710-4517-acf1-86c90b97b87f", "comment": "Malware payload (RemcosRAT)", "value": "04cc9a1835b651559681d6b85fd535414cec1e5b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783487080, "uuid": "d36eeaa3-b24e-4126-9aa3-ed8cfd852a20", "comment": "Malware payload (RemcosRAT)", "value": "69d5febac7eecb11ba4b0f4e1e74f78ba2bb643755404cb42e7508e5974a70155ed855a1d3392af5ca7dae0a8e113150", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487080, "uuid": "9cf3280f-4d2e-4ce7-929c-0f5e57d6c207", "value": "T191434B11C9D50B7E4D4317ECBE046620D4FC4719813640ACEF9E732E601A6ACEF7B6A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487080, "uuid": "362e776f-c9c1-4927-98fb-27f33fd5b794", "value": "768:99Zm72CFcvEfxW/C8zUVGiWH8mAdt2GMEp7+cPVNcits/qEene+letNlit:3ZmSvgmlzBN8Bt2G7ptPVNw+lez+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783487080, "uuid": "72ba84a8-9bb6-4f1c-b13c-a1913db20eaa", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783487080, "uuid": "411588c2-440e-4906-adbd-0cab0632b9d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783487080, "uuid": "559aa38b-bb84-40f8-8aa4-57cfb19f481c", "value": "DRAFT DOCUMENTS_9477F.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2795d1b1-7b08-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783541037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541037, "uuid": "b436d334-b1ac-4776-8c48-bd7fd859efa9", "comment": "Malware payload (Mirai)", "value": "856642e16d3d098798603048f2dc5a3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541037, "uuid": "cde43993-ecd3-4a46-a04e-c0dca7a0c255", "comment": "Malware payload (Mirai)", "value": "ed9f708ab4be13822828d60e02d624faeaa81374ce214ba59b8f0cc21ff3e210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541037, "uuid": "6878e53f-d660-46d4-bc10-ff535e23fd4d", "comment": "Malware payload (Mirai)", "value": "13ca482993486859ad5690d1ee5e945cdb9f250c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783541037, "uuid": "51d2ebe9-7398-4cf1-a969-c99ae1912983", "comment": "Malware payload (Mirai)", "value": "3190e0044def65cf493315c96fd47877b0e167996630b25fdf7b7a46f2958a659454c3ea0666266090cbe69d9d53d907", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783541037, "uuid": "7171eb92-e49b-4ca6-abd9-2d47795acef1", "value": "T1ED43189AF8029E3DFD0FDABE54160E0DB92077C152830B2767ABFDE36D722955902D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783541037, "uuid": "70cda3ab-2db1-4f3c-81df-44476333011a", "value": "768:wmPURCSzOBccd+D4OTm8e5BoBvbkI2oSnvVnLwHmGf:jmcQD46m8ejo2I2oSvVnCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783541037, "uuid": "3137e2d3-de96-4874-8c10-0688fbcc234b", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783541037, "uuid": "d5f011b5-ca1a-4d13-89cc-19b2ba2fb0e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783541037, "uuid": "5885e9bf-a353-4cf2-a80c-d85ecd56c327", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09e5106-7a9b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783494452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494452, "uuid": "dc13325a-0d10-47e1-8468-a7964d0ce122", "comment": "Malware payload (AgentTesla)", "value": "33ea9c7009fb8abb1cdd63d461801da2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494452, "uuid": "7e85720a-5072-4b35-bf02-42ac818f1800", "comment": "Malware payload (AgentTesla)", "value": "edcc2ad793e6c3def42d16dfefaff86dd1dbbc479b3e406405960438432fc0cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494452, "uuid": "dc971b46-4c63-45d1-a3e2-10fab02b93e6", "comment": "Malware payload (AgentTesla)", "value": "06ce2abbfa07bd22c7d5d60700330818ed227976", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783494452, "uuid": "1cdb67dc-f81d-4610-ad52-0ef278bb2b76", "comment": "Malware payload (AgentTesla)", "value": "c141d8d39ca0af07a3044d3cf66943e65b28935fb2fef9fe568ca66bcd4df9ef850ac08e2dcf28c453b9d99c576cd445", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783494452, "uuid": "7c7de8e8-4c4e-4bee-9e99-888d3111bdea", "value": "T1D255F1455EC46FB4CF99562D50FE221FE3B04E8A9015E489FB23FD5AFFA7604422B188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783494452, "uuid": "ee2c02ef-7c97-41d7-9d58-e996fd082996", "value": "24576:W/khsKYICUewQakJSbz7WftW/MrPbmfaI7avX3/6/eEr:W/5KmlEzQW9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783494452, "uuid": "417d2a29-92f4-4c78-98d5-c284549431c8", "value": 1317024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783494452, "uuid": "10dc0f6e-979a-426b-9fdb-c6023ca9bd69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783494452, "uuid": "bb04b141-ce68-43de-8bdc-bd3202308cac", "value": "MV CHRYSANTHI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c699de10-7aa0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783496637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496637, "uuid": "7b7f3a78-13e6-4a3b-9492-591e7782755c", "comment": "Malware payload (Mirai)", "value": "26649a622a54e755fdc522b8a1be6f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496637, "uuid": "62820334-a5ca-474d-a6b2-8cc127b34a44", "comment": "Malware payload (Mirai)", "value": "ede4b155ce8f2c65614c0abda1797bfe3fec8bd78a2ff1a7031d28fbfd4b15ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496637, "uuid": "65d485cd-000b-415d-b847-e16c48b72ad7", "comment": "Malware payload (Mirai)", "value": "c2cfd3e9bc7dfb37ee387cfeeddcba4d31cf21d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496637, "uuid": "a94dfc99-4fd9-4f0f-bf42-3506de9e6f35", "comment": "Malware payload (Mirai)", "value": "1948ac85ef16310d342ec767d6f67aa09df3abb83310e9eb8a54b9acd83b590a15251fa70c70a82f161b5d395f504cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496637, "uuid": "bb2ce7d1-055b-4168-9069-9db9b0b0f445", "value": "T150B35BC5E247D0F9D8160A302276FB375E76E17B1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496637, "uuid": "a3a5e855-9571-4fb1-85ef-5deed416e63c", "value": "3072:vpe9zJgGmi+dkEF5nSMnuAhDb4ySUBNIHcC/BX:vpe9zRx+dkE5nfuzwIHcC/BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783496637, "uuid": "33f840c6-0d7f-4097-8325-88560d6d8dd6", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783496637, "uuid": "13f6e84f-0b88-41eb-bf5d-87304e4ec8cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496637, "uuid": "ad2bb786-4c2e-4676-beb9-5c3e49dbbd75", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a7a250-7aa5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783498751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498751, "uuid": "27335cca-dda3-41cc-b919-d6070fd8c5aa", "comment": "Malware payload", "value": "174b18a999ac7bbaf2f4cb3a85c38d94", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498751, "uuid": "53a5ae04-1fc6-4f61-8f0f-c73602bac4ca", "comment": "Malware payload", "value": "ee3f7e456ef297da1f5788edf46d0988bd12d0f086c75c7d62916adad761feb6", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498751, "uuid": "41415214-3c0a-4246-9017-06233f9c15ae", "comment": "Malware payload", "value": "481bdff744700952ec7ad97e8d890861e0ec0337", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498751, "uuid": "21ae13da-7162-40bc-8053-8f59716596f3", "comment": "Malware payload", "value": "cf1350928b287551b9716f029f1132665bcc32c9f79f0277dff3cc2110c9618fd9fc885c29f3e96df6cd749391fbb082", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498751, "uuid": "727259d7-b32a-43fb-9f8f-6c8ccd8fd6aa", "value": "T1B914E762EC691816D3C3E6A95C6780827324F8635A022C347FEC974C1F89E77A5F469F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498751, "uuid": "df5c4332-29f2-48f8-b397-bf3224214620", "value": "3072:nsMupwujVpZ1R8QEi378HsShPYAP8S51vIFqV3/tkZQyNc:dIZvvEi378Hb1P8S5H/GZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783498751, "uuid": "c6fc7b57-3dc5-4eef-8aae-1139d7dcadeb", "value": 197033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783498751, "uuid": "6fe18615-452e-4d23-b545-7a9a0622d42d", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498751, "uuid": "81d6f98c-433a-4793-a7c3-91eb07c422a1", "value": "eyocanstealer.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a02b04-7ace-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783516415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516415, "uuid": "343e6d9f-91a0-461d-b7c1-4f3b05d463e1", "comment": "Malware payload", "value": "69432d6bfcc188ae6698da064d6a9bfe", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516415, "uuid": "e98ae78c-1bca-4150-85e1-6ebe04768517", "comment": "Malware payload", "value": "eed4e61d43e75243ed7ab37753da8a86bd85f3fdc6bfd4e0af568ea2c8dfb942", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516415, "uuid": "725253e9-ce55-40d3-aa96-483672e806eb", "comment": "Malware payload", "value": "36f367f80c343d69e7617c1c11c3fd0e71a08e15", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783516415, "uuid": "e13cdf62-c22d-4255-81da-9d16117e4c53", "comment": "Malware payload", "value": "7e36f5adec611f639e50d786909b55451fe422a7d5c68172f778fb7cf4909a48b2f9a2a9e5aeadf0517eb6b8ea5ee575", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "verify-hashtopoils-org", "colour": "#46603A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516415, "uuid": "ab77446c-252e-416b-8984-b1515445b0ca", "value": "T127A63B647C1CF427EB8975B46F3623D836297C809BD28217211CBB6A9DF17F84B225B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516415, "uuid": "5899f52e-02c8-4c31-86d8-4556f25f689c", "value": "98304:Zenk9JcL1lIVhC/0spcfibmpGxGhVcbBT5v1oz0lb2NLrGrkWbMc:Zuk9JcLfIDEcfibmpGxGhVcbBT5v1on8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783516415, "uuid": "0ee3b9a4-9e83-479a-8e5e-6841187f14c4", "value": 10068258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783516415, "uuid": "1566124f-7b84-4a9c-b008-26f5dc820608", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783516415, "uuid": "8cd96def-d120-4f2e-be11-9fa1f1771a4f", "value": "eed4e61d43e75243ed7ab37753da8a86bd85f3fdc6bfd4e0af568ea2c8dfb942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0d6752-7b0f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783544239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544239, "uuid": "ee4ef5ed-26c5-4d5b-ba1c-4b768cd8c9c3", "comment": "Malware payload", "value": "1f20cc44056395c837cf9a7211b09c04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544239, "uuid": "47e44754-1271-4012-a41c-88945eb55e76", "comment": "Malware payload", "value": "f12c6b938993cd6dc4a793c209aabe140202164615acd82eec7a11ff390bc071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544239, "uuid": "da0de32c-c5fd-48fc-ae2e-5f36ac0b0473", "comment": "Malware payload", "value": "c8888b8024177e495f4324987305a31c3dfab9d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783544239, "uuid": "635bf2a1-a3f6-411b-9853-d15d9bbb2804", "comment": "Malware payload", "value": "ae7bafa816b073b60ba2205131818fde099ce982b199c3b931a802cbd5f3ce9b6ebbc7800671a1b16b40f32ce21e0bed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544239, "uuid": "578013f4-7c0c-4925-bbe6-41a3ac76c0b8", "value": "T1C50633C9914043D0A0FB40A8DFE3E8D850D65DB64D036672D99F0A6F57AF2A53239F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544239, "uuid": "3666eb8f-d9fe-42c7-9ad9-6cac033bc068", "value": "98304:7/8cuFHv0llO7db94r0EXHKDNuuZtrO4T4Iw/u7P/xVZ9:70cu9vml4pc0RhrOJIw/e/b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783544239, "uuid": "dea5dd92-5cab-4939-b180-7ed4d0faf16e", "value": 3928772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783544239, "uuid": "dc553316-49c7-4f6f-b2f4-a77d2d71b3b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783544239, "uuid": "2c558314-0136-4440-98ea-5bd32e0da92f", "value": "kokuryu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1220416-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493245, "uuid": "e8ebf495-b1d2-4357-8030-5d75752e961c", "comment": "Malware payload (ArkeiStealer)", "value": "0211bc14243adb794a5739b9044cf21d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493245, "uuid": "dab326de-df35-43c2-b049-2cad2bd343ca", "comment": "Malware payload (ArkeiStealer)", "value": "f18ecf8b4da6262bdc42efc531cc5302dc90720eb7744859be63f79627c34939", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493245, "uuid": "ad47c12f-3975-4c84-9c1a-5d4faa97a802", "comment": "Malware payload (ArkeiStealer)", "value": "3ee8a7f0238fba2d38558622dc72cb748829e4ec", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493245, "uuid": "6459ff40-7b00-41bf-b9a9-715de12a4744", "comment": "Malware payload (ArkeiStealer)", "value": "fdfd0a89d1396acb1a3ec9217abfa9ca25290d054bdbe271b7624e55261e9e957f048907d2798182cb823351ee9d611d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493245, "uuid": "acab46da-beae-4a8b-8559-6218aaef1c3d", "value": "T105D58D0BADD148E9D8AAA73689B716963B30FC480F3223D32E50B6782F727D45D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493245, "uuid": "21060f2d-8c59-4271-92dc-66f3790d613b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493245, "uuid": "7797c0c2-a24c-48b6-9387-16616c95b2b7", "value": "49152:LYJPSPt8PJzoJ0OVC/iBOHQd47YhpIKFhm4S:LYIyiVC/8OwdI8IChmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493245, "uuid": "0d493bb5-b707-431d-a5a4-06f0dd0757d8", "value": 2977120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493245, "uuid": "276ad719-3062-48c8-a679-59a0c204f114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493245, "uuid": "74f8e664-f4fb-499d-bf43-cc0c862c7753", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40328.26642.2408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f0660d-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493280, "uuid": "1b2a8a91-2ef1-4a99-8e7f-0acbbd44ee36", "comment": "Malware payload (Vidar)", "value": "1f61efd0a4206ef6f4d1ab879dfa4232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493280, "uuid": "63f1a9f9-5789-4446-af3c-99cab50fa63f", "comment": "Malware payload (Vidar)", "value": "f1e5b38ba51f3d5a333e21922335c07177338d65ba842d4b682bb6f9d1b6d02e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493280, "uuid": "f0a1d215-8f3e-4f13-a85f-5b49945f4672", "comment": "Malware payload (Vidar)", "value": "144bcc546033b39debf745183a50ed288ba49594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493280, "uuid": "6356e248-c9d5-4219-a838-0bfd8f53302a", "comment": "Malware payload (Vidar)", "value": "d0bd2bab807a1fa468744358f56286f3e4dfd2b58d7b3489eeb737ef7171a76269faf5cf102f0ac64af94dce3ec2b344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493280, "uuid": "c66a4736-9b21-474c-95de-3e315de80fab", "value": "T1F5D58C0B7CD049E5C8AA933289B642927B35FC084F3567D31E90B6782F367D09C7AB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493280, "uuid": "42981dd4-0e62-4426-9fff-e19073069ace", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493280, "uuid": "cabe4cd2-f09d-482a-95a1-3ff765e3f370", "value": "49152:pWHhRZyDiWsg0PSF/pHWTi+kuUpGsFYyUDd:pW7WbrnmyUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493280, "uuid": "182450c6-2923-4628-9ad3-82860229f8e8", "value": 2986840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493280, "uuid": "1d5b74bf-548e-4684-8374-a4269e076c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493280, "uuid": "ac15376e-bbf3-4817-8136-6367de3561fb", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40317.22871.22207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b009b2ce-7ab2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783504330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504330, "uuid": "4a7309cc-22ed-4f7b-80c4-25b632034826", "comment": "Malware payload (Efimer)", "value": "e570f4570a0a7bc6bdd529570edac3aa", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504330, "uuid": "b6269e54-ecb1-42de-9f25-987cc6c5aac2", "comment": "Malware payload (Efimer)", "value": "f25cbce1c8cb70394e3d453fcc3a7aaa5fa0d9c66c4717b29762f465f56a47f5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504330, "uuid": "b1824f6c-efbd-449c-8e7f-5c547bc2bc63", "comment": "Malware payload (Efimer)", "value": "9d88325bec9d71eaccf0a59d6997bd50ddf49063", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783504330, "uuid": "63d8b9cf-4a27-45e5-aa30-e023fcd3e9f0", "comment": "Malware payload (Efimer)", "value": "185559250c870793a999768ca7083eeb33785c42b87a9021087a894bd7dc00fdc12a39f8cea75da4041501e983bd77ba", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504330, "uuid": "b58aaf7d-98c5-45be-bdb0-f7a24d36b274", "value": "T19CE63318A1D401FFDA63423CFAE04495F668B4735732C8DB8B688BF55E170E08A7A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504330, "uuid": "f8586631-f6c4-4110-bec8-0deee1c1a83d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504330, "uuid": "f31ff0bf-fb33-4db0-819a-5ac05bc7e32f", "value": "393216:aMMmjN6mUtRLTevMQUVAdYXMCHWUjXkcuI3/PGTAI:aEjvUt1efYXMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783504330, "uuid": "ddb86fc1-a3f8-40e7-89de-a3622bac19e4", "value": 14295710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783504330, "uuid": "640f8e28-d1ce-49b5-9cea-bd3b4d91dcec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783504330, "uuid": "42bd452b-336e-429a-8ef3-ba5896168d03", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e507040f-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783493252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493252, "uuid": "f5168ea3-946d-44ed-9242-2da3cf30894a", "comment": "Malware payload (Vidar)", "value": "f8634cab0e0d17e9a5808532797efad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493252, "uuid": "017bb44b-feef-4e50-a857-99cc7f15d858", "comment": "Malware payload (Vidar)", "value": "f320cb93aca97694e2935d87576da8cda03d47659021c3f79e15dd164e894599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493252, "uuid": "afb25a42-91fd-4d3c-a882-8213e8be02b1", "comment": "Malware payload (Vidar)", "value": "39d6ab1e59dc2a3bbd320ffbd07a721753001eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493252, "uuid": "dcf19e09-fc04-4c93-b2ed-24f8aff4eb61", "comment": "Malware payload (Vidar)", "value": "f2470b7f7efcccb628d508a07f808af40ee026225e6a931ece52aac5954d34787d4e6accfb2442d66b018d4eeea90d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493252, "uuid": "f9f04d80-dbaf-4ca3-98be-927332b31f33", "value": "T100F57C07ECD158E6C0A9A231C9B7928A7735BC491F3227E72E90A7782F727D06C36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493252, "uuid": "92e97708-4bfa-40c3-9e56-17ce906a5d43", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493252, "uuid": "df81f0ef-d2c2-439b-a88a-d2817f8443db", "value": "49152:XmbCj+HFJfuFOMP+Xk5F8+eQA99+knYr:XPYMWX/+eQI+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493252, "uuid": "e1c1da62-f126-4633-88d3-8fbd1ffd9c0c", "value": 3544960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493252, "uuid": "6ba2197e-d67b-4e45-a95a-b44f71ca397e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493252, "uuid": "94951bcd-1443-424c-b943-c9326c6fbe1f", "value": "SecuriteInfo.com.Trojan.PWS.Steam.40322.370.32163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26efa34-7aab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1783501327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501327, "uuid": "19b3dc7c-a5b9-42b1-b41d-b53dd26f0aef", "comment": "Malware payload (OverlordRAT)", "value": "98b0409ff0ace3977e887cea396c8d21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501327, "uuid": "2481e498-f02c-4404-bed3-9e8b931d0c15", "comment": "Malware payload (OverlordRAT)", "value": "f34ccaabd453d1a48109ea8f96b224c845ff03da08059db5ae5c63b3bf21bc15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501327, "uuid": "85edb8e5-6445-4c21-b3c4-2ac0c2941728", "comment": "Malware payload (OverlordRAT)", "value": "96de64f7bad0a99047f8687eaaac7f012bc249c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783501327, "uuid": "d2dcb0d1-793a-49c0-8d25-3f725c2006f8", "comment": "Malware payload (OverlordRAT)", "value": "29120dfaa899ab5c44afff75fa01e46060b7ca876a937cf4a95475264f367884d5f33bf3b0f97e91cf5dce9a3b2eef2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501327, "uuid": "6b7babdb-fc4b-4df2-b2cb-c7711c98b6e0", "value": "T192A72B53F8E22984D9EEC574C772417BBB613869077823D706A0F3201F3ABE09AB6755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501327, "uuid": "6f830656-49bf-4ae7-acc6-2e38fb05c541", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501327, "uuid": "da120491-3948-4b5d-9def-109098b43fd0", "value": "196608:fmCOmpzWUe/pBi7aQGHUGFyKeFVWN20MKcPsi8QZiX33MyhdEjqp3heM6x+Ulf7U:ffOek/3n0Gfe0DCPsi/YX38QX6xbIBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783501327, "uuid": "d9af8918-4c6e-4848-9131-132bf970309d", "value": 44409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783501327, "uuid": "b8469aa3-0813-4295-b191-d1f8c64a82bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783501327, "uuid": "440cbb17-fd2e-4738-8e5a-6755c074603d", "value": "Prestige-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae87bf5a-7a68-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472544, "uuid": "6c3fc7c6-b2d4-404b-9f5f-a4db5fa1c852", "comment": "Malware payload (Mirai)", "value": "df51435006b01e5083f9ca5450452209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472544, "uuid": "0e483b6b-14d1-4241-b606-42a806d8bb65", "comment": "Malware payload (Mirai)", "value": "f4d8dc95bb1d731026ad139f3a25f338fc4879704e0afd38e91ccc416b06279e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472544, "uuid": "73481174-be26-405c-a576-0478a29df4af", "comment": "Malware payload (Mirai)", "value": "a87fce8c32c7d2255c141b4ed23de178f2ceeac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472544, "uuid": "a45428d9-40cc-433e-9391-4279845279a6", "comment": "Malware payload (Mirai)", "value": "834b01bdb21f57fd66963b5618379b45b4716698d4278388c2c2b11d459c508318d24dfab8d24cfd1db3ac2b6ade94d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472544, "uuid": "9563d291-9a38-4035-9345-550348dd646d", "value": "T131C2E07A195DFD21E3306C33D72846CBBA080FFAC1E73265348456CC69EA6039BB5792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472544, "uuid": "1bf11932-2f27-46c2-b5ac-e442c3564a57", "value": "768:i/ScWTELq+MOSuZKa1LxOq8goo9q3UELzzS:i4T+MUrLxODDLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472544, "uuid": "b4990615-1c83-4b2f-9d33-d4854f0c1906", "value": 26716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472544, "uuid": "5085df13-fe80-4296-abfb-a63111c24032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472544, "uuid": "ef56261b-da8b-40ac-a750-1858f22b332a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe0d5dc-7acd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783515684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515684, "uuid": "f2e8961c-5a9e-4617-98c6-7753137a6f9e", "comment": "Malware payload (Mirai)", "value": "6c3e6a9f4f9eb1d14f313841023595ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515684, "uuid": "ff963323-97dc-4d6c-b88c-476649a5a58c", "comment": "Malware payload (Mirai)", "value": "f505d0415eec56078d64b604c72e33c120c5c5f48153a7d8b4f4cf2542d14750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515684, "uuid": "a7a34943-b7b2-497c-84c6-0331c89d532c", "comment": "Malware payload (Mirai)", "value": "113eb921860a7c787733fff31497647f4dcd724e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515684, "uuid": "d1e54c9b-4bf2-46e1-bd49-4aa648d542c4", "comment": "Malware payload (Mirai)", "value": "e67b63a940878e6e4a93a3938a1039b6ac3ea79a88338316fc9466d033bb5589fd059ba312bcc71229f0ddc61a854e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515684, "uuid": "4a8affac-da0a-4fdb-a1c1-ef6ddd6cee48", "value": "T1D6C36D22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515684, "uuid": "fe894a5b-1a7a-4d37-94b7-f8915c04be27", "value": "1536:qZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnfAlQAQKC1D+tAlPYm5XLxgFxHX:n3IbE/HnQBKC1ySNYOX1FX/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515684, "uuid": "07fe7adc-9848-44dd-9a1a-206e43f8ceff", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515684, "uuid": "18c0dcd2-f40e-4a5a-a91b-fe395c9effcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515684, "uuid": "d3bbe045-e562-476b-a46f-1687875147bb", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bed160-7a62-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783469842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469842, "uuid": "6a842744-b766-446f-a45c-f279c9899c58", "comment": "Malware payload (Mirai)", "value": "dd1c1812702d4c5cb835d80dca5d5784", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469842, "uuid": "7e2591ae-1eee-4128-9a12-4e093198364b", "comment": "Malware payload (Mirai)", "value": "f56929affb830daae30c1be4d1864df512d48b9210a2976eb38260d54cb33149", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469842, "uuid": "7419aeb2-c749-4ecf-94f3-3d86d19747b5", "comment": "Malware payload (Mirai)", "value": "d4a08165a4f27bed3a4d64b6a7a358509dbf4ae8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783469842, "uuid": "573a5065-6df0-4998-a1b0-39cb362e9309", "comment": "Malware payload (Mirai)", "value": "f9b54a74641bc84a56f683f02b3f48d05aca9721693ffd2f47007dcaff7099b9dfaa2becfaadc2ac2d8ba09c3f8d3e20", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469842, "uuid": "205fdbb3-8097-42b2-8bc2-71283d7d1769", "value": "T17F33F87F6720C279C183E7740AEB52A09574B0F74B32B01F76045A766F52F88CE2EA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469842, "uuid": "6f7b1c96-cd6b-4541-bc4e-0d2f08ab19c6", "value": "768:uTdD8nKkhEu/njPgl5bnlviomR0j/Yo5inXNTm:QD8nK/+Evi5ownJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783469842, "uuid": "9c6c237d-0c97-488a-9404-2fc3db538531", "value": 53688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783469842, "uuid": "cf4a8410-d213-444d-ae9f-75cd3a5beafa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783469842, "uuid": "e70df92d-4aa8-44ae-bae2-8b59abf9d9ce", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5698c2bf-7ad5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783519212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519212, "uuid": "e69d59e8-9b02-4da9-9531-b490ba444cde", "comment": "Malware payload (njrat)", "value": "97960cb546365a3a320fd26dac47d10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519212, "uuid": "407a4d68-10e7-41a2-b107-e97be8a499b1", "comment": "Malware payload (njrat)", "value": "f5d8c56c2b66818eba0bacd35be33b2d2069ff3e28befe67dd4ca17b675b7b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519212, "uuid": "0c8705bb-04ec-48a5-82fe-f1e2d91d18fd", "comment": "Malware payload (njrat)", "value": "04ed410e130bba2e28e7fc5e921ee6820547c31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783519212, "uuid": "5b15c500-87b2-4a68-b15d-a9ab1cf14d26", "comment": "Malware payload (njrat)", "value": "97030b9f6d217cb44c1de30c574f7b09ef4e35d8d5a7891d4c41c8db127470cd74d71ee6250680645a5c7d9c838cf389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519212, "uuid": "984e0306-56fb-427b-af9a-d5f5f577beed", "value": "T16CB3C68DBFA81911D07E4B7A48745116037DBADF8911E78C0FE288C917F73C68E966A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519212, "uuid": "7dcd86d1-d1ba-4e5f-a636-c6b016d85b5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519212, "uuid": "33e72106-4efd-4f1f-ac1f-a9162642623c", "value": "3072:fLra8HP4/X/fTB2FXP6zx/73v3EmddXlf:fLGEP4PjQVP6FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783519212, "uuid": "64cd4b0c-af4a-44af-b5d3-5bc53d4aa66e", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783519212, "uuid": "a99bf5db-681f-4e0e-838d-3d59c45113d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783519212, "uuid": "de98b625-27b1-44f0-8627-a7c2a528a5b6", "value": "Patch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c6d390-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493273, "uuid": "a02322f1-a840-4715-8b6e-668cf13f5a00", "comment": "Malware payload (ArkeiStealer)", "value": "5fae4c26ab953667c4fcc5886ce15687", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493273, "uuid": "f2f7751d-6ced-46d1-b2c1-196f764c4098", "comment": "Malware payload (ArkeiStealer)", "value": "f6126eefa85ebab83ec702eaf0871350409b526a579ea9086aa3daddc09e46d7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493273, "uuid": "f77ce2d7-bea3-42c1-ab1e-7990d984debe", "comment": "Malware payload (ArkeiStealer)", "value": "2ab42fe19fa6a34893a39cb81de4abfa9872e13d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493273, "uuid": "689b72fd-beee-4bcf-a421-a7b6296948af", "comment": "Malware payload (ArkeiStealer)", "value": "5cfa01c3c3751e0f09f57e28f2f405c27dbb69142a15392dfad3f28cbf72c9bec84e3f2f5cec53ca9d7cc0b7004a1f0c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493273, "uuid": "adb57ba8-9be2-42b9-b709-fcd011a48ea2", "value": "T1B3D58C0B3CA019E9C4A9973289B65282BB35FC494F3123E76E80B6783F72BE15D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493273, "uuid": "8ee230c0-5b05-4cf5-a6d7-ff0cf96b900b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493273, "uuid": "ef8cd956-717b-47ca-82ef-94fe703beed7", "value": "49152:YYuQXwPW2+sE0xPFufWW9ssw7GPP3LjWgE:Yz59xYfWW9ssw7IfWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493273, "uuid": "66c0ee54-7b41-4914-9712-858bd1f5eba0", "value": 2992496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493273, "uuid": "e6ae80fc-ecd9-4ddc-8912-e2bc11f61af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493273, "uuid": "68e92c77-448f-40a6-a5fc-5e5a37eb31f6", "value": "SecuriteInfo.com.Win64.Evo-gen.77683326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a48df3-7a6f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783475296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475296, "uuid": "86745a4a-1757-4d73-88d3-873ba39cf0d8", "comment": "Malware payload (Mirai)", "value": "48b795ccab412fcda689d5f333e4e26f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475296, "uuid": "3f8ebc18-9579-496d-aee5-a512a898a26c", "comment": "Malware payload (Mirai)", "value": "f687804910db04e241f6f734522ab8af7ae2135d173a98173c17b11b3a65824f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475296, "uuid": "f5282e11-09c8-4f63-b55a-fe9dbdfb0696", "comment": "Malware payload (Mirai)", "value": "d19f767c46a5bf0125d5d0cfeb3440c08c9f24e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783475296, "uuid": "061b617a-45ff-4c2a-9237-3947a78b4566", "comment": "Malware payload (Mirai)", "value": "2101c6dbc92d4b34e6e0fd1ee045ba42b7f389e586014d8a1f25d53cfe706855b89709bb861bb1c4f461e6742e07d885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475296, "uuid": "5556b159-6504-4ae7-b4c7-0994f42521e1", "value": "T16D23E118D2F45FAADFCB51B2158891A22361DBEB9367CD8230CEF5603195D12B8EDB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475296, "uuid": "811a665f-a298-4c45-b69e-9847c1dca90f", "value": "768:fmBrN1oPOSI35TzozdYvuP+3zx8QnjL5JnK+08vKOfdx/IA/k6xt6/NC/ngcnTgV:fCrN1oPO5KzdYvuCNPnjLvnKxoKmXIAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783475296, "uuid": "b03bcf4d-b81b-430c-a503-453eedfcac2c", "value": 46952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783475296, "uuid": "f102cb10-e6ac-4cb3-b51b-5d30690d7d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783475296, "uuid": "4290508a-b0f1-4cc2-9cdd-3020fd15f6ba", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fc86b7-7ad0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783517008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517008, "uuid": "59c42cd6-32d5-470b-96d5-db7262b2bfce", "comment": "Malware payload", "value": "ca9c7225f5e75c4c4cb233a1e5e235a6", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517008, "uuid": "d03653a2-efed-45e0-9e50-32f00a27248e", "comment": "Malware payload", "value": "f6d988e38386ad2cca898769cf7dc7fba6226ac7a173126e180e29e8c88d8c9a", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517008, "uuid": "c80f8e7d-c59e-496e-9c74-367bf00bf9a0", "comment": "Malware payload", "value": "43c1ad8ab68ad0321034d3fff199689d8b34b63e", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783517008, "uuid": "96410f61-961c-41d5-8269-3552cf83b0c1", "comment": "Malware payload", "value": "b2b25b81c91bbfb11f08aabf1a4d3252ec6dbdeaf62ebc29140f64194b8c8c280def2d01dba73e01edd89426b4b06d6d", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517008, "uuid": "7abadb48-70a1-4447-a25b-802db3171160", "value": "T19E11C05FD81E8664033842B681749D29CD879557552B5422BD08CC1F8BA98ECA8741E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517008, "uuid": "f429d0e0-13b9-4048-b55d-2d42682e0f1b", "value": "12:9vWd+xBhYhqQvDzEyeGK1PaUvnH3jvNRB2DOexWb2Rdcsy41BiYHUZDown/dMo3B:9A+HWkQFKvvnT1n2DOIRdc9qsN/dQPfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783517008, "uuid": "aaf8942d-208e-45d4-a457-e4ddc803c349", "value": 900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783517008, "uuid": "24c6a771-c9ad-4bc5-804b-8068341b5ebb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783517008, "uuid": "267fdf71-14d6-489b-8fa7-bfe38ce1bc21", "value": "QzYuCjLR.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee36b5e-7aa6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783499308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499308, "uuid": "ba324310-9cc8-42b0-a033-818c994acc3f", "comment": "Malware payload", "value": "9b8378fead91a3faf744b748a1b829a9", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499308, "uuid": "ba39f5f8-ebcf-4018-b7e0-23c5a7d8e425", "comment": "Malware payload", "value": "f76a5ef4b7adee7a1310cf62cf00cfcbeaf33375a95e33cbbf28d706a47dc5c9", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499308, "uuid": "690424fb-6848-486d-b746-712787c9fa09", "comment": "Malware payload", "value": "03e2710a2352f021481a97c430af48c87798b00e", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783499308, "uuid": "418280e9-8dd7-4d4f-a69f-7d0337a0110a", "comment": "Malware payload", "value": "a0e9baff774430420ad10d5cc80f44ce1563026c2f7b1926cf5bf4ec89ba109b4dc9dd611eb088e6c8d0ea57f768206d", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "STEAMKEYkey_440D7F4D810EF9298D25EDDF37C1F902", "colour": "#D15E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499308, "uuid": "40dce2f3-2160-4575-8b44-92618756b6ba", "value": "T18504C656EC291812D383F6BC596680827724F8235A012C347FEC978C1F89E7BA5F569F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499308, "uuid": "e48340d1-77bb-416c-8599-5df8d8042b33", "value": "3072:n2upwujVk1qZQEi3ZqHSQhPYAP8S5Y3IFqjHytkZf:2BEGEi3ZqHJ1P8S52y2Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783499308, "uuid": "e341a310-ba4a-45ab-8820-b6a4653f1c26", "value": 184542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783499308, "uuid": "e6567f2e-a0da-4f14-9dee-2e322ac8a368", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783499308, "uuid": "e8fb10a7-c62f-492e-85cf-d9f9516ad120", "value": "f76a5ef4b7adee7a1310cf62cf00cfcbeaf33375a95e33cbbf28d706a47dc5c9.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af755d47-7a7d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783481565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783481565, "uuid": "384d39cd-719e-45cc-9255-7ee59f08913d", "comment": "Malware payload (Vidar)", "value": "78039a133fe132a8d1bfe231649ae463", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783481565, "uuid": "bcd0ce0e-d656-464b-b40b-ac159c7f60c2", "comment": "Malware payload (Vidar)", "value": "f8c56b8a1ecfa06186f0d1dc3e566223aba52e282dcce895d493cbe78d9db512", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783481565, "uuid": "e5e63ee5-b155-4b35-a13c-c27ba509e0e0", "comment": "Malware payload (Vidar)", "value": "9f4aa0f7bd9dfb8ae72a6e108b7fec2a434ed91e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783481565, "uuid": "c5fb069f-b171-4c69-aae1-8cba0fd4178b", "comment": "Malware payload (Vidar)", "value": "d154895a15e3b1c415c0ce9118a90a4bfb09195924985c7c91ab98971b81466349fd9e14a815809bf5783d41cf19175f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783481565, "uuid": "29ae5bd5-b4b1-470c-8d87-134bf443c4b2", "value": "T184D58D0B6CE409EAC4AA533189B651917B70BC594F3227D72E90B7783F72BE1AD36740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783481565, "uuid": "531d8042-4590-429b-8faa-160c84e891fa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783481565, "uuid": "a3fb7897-af84-4393-b7ec-ba3f8d5da9ab", "value": "49152:WRXjM09Hv/i4NFvvqy5a+PEHT/BMAsO3rHMh4XVL8lTdgXFA:WRzM7I1vk+PEHlMAsO3rHE4VolTdgVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783481565, "uuid": "8ec11489-23f8-412c-85f1-8af16dc348ee", "value": 2936704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783481565, "uuid": "62f04a49-b83b-414b-9999-59c9e3ec0e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783481565, "uuid": "ec54c937-b460-48b8-99df-93b6c0732b64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050488a0-7a78-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783479132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479132, "uuid": "18b711b1-eae5-4529-a7c2-2899d07ba0ce", "comment": "Malware payload (Efimer)", "value": "91ba383b15c069fb8d8147fc8c4f6cc4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479132, "uuid": "c6985a3f-0599-47b5-8e1c-c25b1245162a", "comment": "Malware payload (Efimer)", "value": "f8d9727dcae3e07980899001689724c3b0d71f446ded7344bb0550df9f4e157e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479132, "uuid": "5ca6ed90-f1ff-4330-a86f-cff351cdc5cb", "comment": "Malware payload (Efimer)", "value": "46a4786fe79dac1a4df8716c4c406871749f5ea5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783479132, "uuid": "f8c9aa6a-e570-4ec0-9056-fcf5b3763598", "comment": "Malware payload (Efimer)", "value": "9497f853eb5485e11df821ef5adc0220ee532df461c8aeba8416de8cd749e97e94774d31a68208fbfc6d1e782437cbda", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479132, "uuid": "d1cd5045-0905-49c2-9664-0d6b8cb567f9", "value": "T1B1E6334CEAD522FEE6F3507CAEB096D2D17578B10731C5DB27A882E09E471918C3E627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479132, "uuid": "b545b8f6-3afb-4862-8223-0d58f237fe7a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479132, "uuid": "a9545a0e-244f-412c-a796-6b66c633ce2f", "value": "393216:9Me8SpmNPxX7CwXMCHWUjXrcuI3/PGTAI:9bt+5rCwXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783479132, "uuid": "7cbaef26-0efa-4584-9161-a4b62a757daa", "value": 14271393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783479132, "uuid": "7bc6ff1e-723b-4ddb-8b25-79962367bf5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783479132, "uuid": "63ec5b30-4bee-4b80-86b6-a7b0f2e575b0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35578ee-7aa0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783496577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496577, "uuid": "bb8bcafc-aad5-4622-bfcb-4a72be54b013", "comment": "Malware payload (Mirai)", "value": "139eae425d45bbbed2493367dfbfcb70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496577, "uuid": "7f576db6-dceb-4d05-93b2-0975075a1d89", "comment": "Malware payload (Mirai)", "value": "f9c6900e015c0e9f5b4d57ff7fa3cd936f1fbf2a5fb08c2ab1a76723538bf692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496577, "uuid": "4f014f5b-507a-4b42-8db4-aa12f0089481", "comment": "Malware payload (Mirai)", "value": "afddba35dc65ed428d77b2ef43af0d3fcfa211b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783496577, "uuid": "dde1499a-6bcf-41e1-87f4-f6b18988032d", "comment": "Malware payload (Mirai)", "value": "09aeb76d41404bf72ed939bb176c3621bbda68cbfe53f0551ee63889df3952f6957819beb50d15263a274636a2311eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496577, "uuid": "0e9b9fff-d027-4e50-993a-f2f8ad9745c3", "value": "T13D23F16664DB890DFC390373C5DF2F1FFC40E35268559EFA23C8602AA551D297E16B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496577, "uuid": "519dbcf6-f4cf-41f7-b111-5db8ed480c8c", "value": "768:A5SFVzSlajq4M5tMbf8Ksm3CzFB9ix3DZkpae6wCawrbei3Glr2suLCXEnbcuyDl:A4i2BIFmypB9Av2grbeCu4sEnouy8HyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783496577, "uuid": "c0541238-ea6a-48c1-a29a-bbf47cdc11c2", "value": 49832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783496577, "uuid": "46da3c64-e208-458a-a652-f39571ae9f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783496577, "uuid": "941acb7f-ad26-4cc7-91ba-cf687df4fe04", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7367dbf4-7a91-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783490055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490055, "uuid": "c823a987-06f7-4de2-ac9c-6c26d851e449", "comment": "Malware payload", "value": "5e330ef70232e598ae5a098c5be2d307", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490055, "uuid": "6b17f6f4-503a-4821-b8f3-f3d19ad813d5", "comment": "Malware payload", "value": "fa18dae1e794d1844f897cb2bf22e7fd436e9a49eed07bf4471589226f951e7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490055, "uuid": "8616ee47-2530-4d11-a615-512a9c319d11", "comment": "Malware payload", "value": "b6b9fba004a57d331f1a1cbaefab3f50d8f0e06d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783490055, "uuid": "066fe3b0-2ca3-4461-8ff5-5b05ef67d05b", "comment": "Malware payload", "value": "e4eb4a0265fcbcaf893e0f5be526198dcaee34cef88c42adf45da5cc6b2c1005aa03c55d50b99433d17c861c68575293", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490055, "uuid": "dc6e252b-ab0b-47bc-bbc9-28e3cd27c512", "value": "T110335C5516817C24EA99C8361C7E2F0CB9AD43E6324452EE7FCB3CF28C4AA9DD11971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490055, "uuid": "9b91f992-d4e8-4641-bd7e-a0f78e6e861d", "value": "768:/+r9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:/+ccK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783490055, "uuid": "f5bfc759-8090-4a85-847f-b8d679fec5a1", "value": 50366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783490055, "uuid": "6cc532f4-1d9b-41ec-a752-0b6912dcf314", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783490055, "uuid": "339aed17-31df-4574-b42c-5310d17f8e82", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba162a2-7aff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783537206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537206, "uuid": "022a5bc3-993d-4306-9358-c4bc5a8586de", "comment": "Malware payload (Mirai)", "value": "bfdb33109cd29f1eae074f7953ccd2e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537206, "uuid": "aa20673c-1666-4599-a41a-9fe29bce3ddb", "comment": "Malware payload (Mirai)", "value": "fb8afadcb109f815b834768b1242515dabcdf209cd7973fd1be1360f2480d18b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537206, "uuid": "f3e46e64-e337-4206-8eba-5b8678a1c8ce", "comment": "Malware payload (Mirai)", "value": "c9da0335553d7e16a956f9c4b091fd0e60ae2c6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783537206, "uuid": "f1d4e6cb-31b6-45d0-8eb8-dcc6b062ed3a", "comment": "Malware payload (Mirai)", "value": "89f49d31f47400229e4166ceba88bc92fe4c6654aa21e759ad6aa778265f95e0be8af6fcbbf37b8941ea630bb0c2ec33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537206, "uuid": "0528757b-bf33-4f1f-9415-34241e3fc21a", "value": "T1AD23F1495B43A892E4D5207EAE1DD1D331A76FD130FF2533B5E90048644AB9B79E901E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537206, "uuid": "64e00d55-ca75-4a7e-9f76-7bdeb4cea2a7", "value": "768:enwmFxh70zViXU2Ha0vGRLrI+wosx/LxgAnQMMucAtf99q3UELti6KPugCxuZ2xr:BZiEnySLrIusxtpnQ3ucSILtNKPud+2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783537206, "uuid": "aaf9a7d2-9682-4100-8781-5caa65d4fe02", "value": 47320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783537206, "uuid": "5714757d-009e-401f-8d0e-a0768660473f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783537206, "uuid": "1e36428c-a613-4c99-9935-18d6465d5c86", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38df1d1a-7acc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783515297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515297, "uuid": "d5907735-d862-479c-9c7e-2a33b8acfbbe", "comment": "Malware payload (Mirai)", "value": "c5241fe6ca4027ad81a8c712ae99a510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515297, "uuid": "4d0a0f31-01e8-48ff-80d6-30a0f0bef620", "comment": "Malware payload (Mirai)", "value": "fcdb16c573bf762cb4b6c390811c9768d13dfbcc99c11053189d393d1ddf9412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515297, "uuid": "87a019aa-743c-4c5b-b36a-a5c54970df80", "comment": "Malware payload (Mirai)", "value": "a823e4ff570df1b549359e52923b00c5f2f84f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783515297, "uuid": "24f8754d-7b0c-4b80-9b62-ca5df357e2a6", "comment": "Malware payload (Mirai)", "value": "bcae70946b0c9ac4bffc9cead35663b3a02fb87367a777cd35995e17675d7d074307ac2d24ac9f0e3287501bcef87014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515297, "uuid": "d4ef75d8-3b16-48b8-8c57-ee652a03ea26", "value": "T154C34B9AB4019D3DF94FD57B48632D1ABD21A3925183272A639BFD93AC321F47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515297, "uuid": "0a1abdc7-d1f6-41b3-b177-96da48bb9a26", "value": "3072:1jXiHbPZI6ORe0rV75wjcn5JqQeX8+zFBxa8:lSHbRI6OR7Oonrqo+zFBxa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783515297, "uuid": "032b874a-8963-45be-adae-3276814ea493", "value": 125920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783515297, "uuid": "5e629d1e-4faf-4445-971a-f84c541a408f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783515297, "uuid": "d4f507c0-adbc-4450-a70c-a5975a3494e5", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd2a581-7ac9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783514147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514147, "uuid": "72db22a2-0b99-444f-b897-87d4b072d724", "comment": "Malware payload (Mirai)", "value": "6c6d052b5b72705041da411fdc925306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514147, "uuid": "7ec91a7f-21c6-4878-9bfd-5b85fdbafb28", "comment": "Malware payload (Mirai)", "value": "fcfa6d9310b01996d7f123542600ef9e63857784d545e1d40d49c6855a103957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514147, "uuid": "05ae9146-d79f-4a56-a2ee-255b46378250", "comment": "Malware payload (Mirai)", "value": "04e4c48913dd66cdfe6dedc4df54b4b4d9cadd7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783514147, "uuid": "460d678f-520a-4421-bdba-1e3ceb578424", "comment": "Malware payload (Mirai)", "value": "9ce141b56b775724d8ac8c0e5172e5798f78f73363d858490b4d2a85ad1080a89b2d070728d9bab83101d6d44c9d8535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514147, "uuid": "37363e82-bf23-43d7-9b10-53521c4692af", "value": "T191E2E19224C41EB0C771C431EBF591C7B6831A3C8197A15F76498FF8A6FA9CC09B8A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514147, "uuid": "8e9ab36f-6c88-44c7-8903-c978724a5cb0", "value": "768:CCZ+6GyLuOzsD5AwQhe4ljYaDTTqu79rXE4VMos3UozLj:lKawDq3he4ljYaHTqu79rUldz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783514147, "uuid": "02e1a5c8-1cb1-4667-b3a5-78afc263cd8c", "value": 32900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783514147, "uuid": "5d569afe-9d45-4fad-93ec-b10a24bfb1c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783514147, "uuid": "af54e5d3-5933-4f6e-b193-b25b5fd4f57e", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace07859-7b0d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783543409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543409, "uuid": "e356f65f-e931-4353-b585-b84601531dd9", "comment": "Malware payload (Mirai)", "value": "e2b976864a06d20ca13a7a426d13a1e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543409, "uuid": "d66423b4-cbc0-4206-a3fa-e3bf1b4d06b3", "comment": "Malware payload (Mirai)", "value": "fd16598a8119bc7ee24ea59e7d308dd3e07a394e9b027524de3b44ce8cb86505", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543409, "uuid": "d2e24629-dc08-42b0-8a36-dadb288375f5", "comment": "Malware payload (Mirai)", "value": "cfd7e88c5aeef687e9b246755d35f39546a9505b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783543409, "uuid": "0e993c5d-c66a-4ac4-a1b4-3959b5355bc7", "comment": "Malware payload (Mirai)", "value": "f82984a095833e4f3eb5279ff116962bc4a0a4561ff067a83642e684c9eae10a5a3793b462e86ad860ddde6d79d2c52c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543409, "uuid": "c8d6abb0-259f-4902-8221-6cfd964e1244", "value": "T1FE73831B7E639FBDFABA863C47BB8E11564833D613E2C145E16CD7111DA024E601BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543409, "uuid": "6e0c3724-d11f-4b42-a6cc-1b8dbacba56c", "value": "1536:5ZCLjrfhuHfZw/CpYLDKAz1CjUde4YJZydz1Syw0zPk16VGUIM/uSQY:ejrfhuHfZw/CpYLDKAz1CjUde4YJOZff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783543409, "uuid": "27fef100-a032-4b16-a71d-59b96c4cd20c", "value": 77440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783543409, "uuid": "be365c15-b67e-461e-baaa-62083a068426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783543409, "uuid": "ee9084bc-01fd-4fa5-815b-fcce86d90f39", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e759a9-7b12-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783545603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545603, "uuid": "86350c12-4ec4-4a0e-808c-47b6fcc434f4", "comment": "Malware payload (Mirai)", "value": "dbf88103eb31422c8d0b794e75927209", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545603, "uuid": "26177799-2d72-4f92-b19c-ca0c0f73545c", "comment": "Malware payload (Mirai)", "value": "fd3fed774b2a870e178ee21f299e93d95c33b13dbbe3922e697d72de32f5f5ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545603, "uuid": "9fd5409f-609b-4091-b059-636f99126819", "comment": "Malware payload (Mirai)", "value": "faaae4e9c103e6c499c11b8d574c558f3ea8906c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783545603, "uuid": "7e59974b-058a-4c73-9deb-729d3a190b5f", "comment": "Malware payload (Mirai)", "value": "346259cc994c258466764d36594bc770cf9d713b9f4e2a5630d736f2bbe53db84effe53445dd29417739f50604ceec41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545603, "uuid": "bf89172d-6227-4eee-b4a6-3e085182ca71", "value": "T1F711BDA6EC440C253A57892F84963590268F461F44DDBB28742ED07A1F1C241F3DD62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545603, "uuid": "4e2cc276-aef2-4a50-a32b-e0b7bfc860c2", "value": "12:Ihw4SjaDxTFFuTBFqljHFVQtTaNu/iffWy/NL0FA8dH0AAjUA7DWBymncZQ/:IhLSQ5k7qljHFg/MfWyVQK8dH5WuByO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783545603, "uuid": "6e518870-c0ce-49c0-aed8-11bada1d3f2c", "value": 861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783545603, "uuid": "a338073b-51b5-4781-8ab1-f970f56f0b55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783545603, "uuid": "44c321c3-33c2-4b39-a526-169b2ea27d79", "value": "fd3fed774b2a870e178ee21f299e93d95c33b13dbbe3922e697d72de32f5f5ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c55329-7b02-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783538558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538558, "uuid": "9c14d5d9-4f0e-4570-beab-8648cfe6424f", "comment": "Malware payload (Mirai)", "value": "81c988374cef54abb931cb365b95e3dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538558, "uuid": "08b6b4c7-2d61-4b9e-8f8b-25b665e225ca", "comment": "Malware payload (Mirai)", "value": "fd73e3f227166fccd7631c22caa6364daa87cc1baacec0c875179cfc39cb3015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538558, "uuid": "9de5f3bd-0867-419e-b1f7-3d5bc0bcc794", "comment": "Malware payload (Mirai)", "value": "773e99cb5aaebbff2a281824a045f7bdb830e590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783538558, "uuid": "fa60da9d-c00d-4984-8cb1-ba274d21236b", "comment": "Malware payload (Mirai)", "value": "44c31b9a8a38de46214e39734f7f7afc8093a00a22dde57eb4b11eace14484532d356ed815661c40393123d3aa36371f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538558, "uuid": "366da70e-efec-4613-80db-47b4d3c20439", "value": "T1D6B2D1BD969E7A47CC9D0DFC34CD4311CBA99181366AC7DD6B339E8AB91210B340E86C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538558, "uuid": "cf6d3f05-f73f-49bb-b203-ad703fd1f12d", "value": "384:2ERb50EZx/fIRpHZmPD2XhgBTh8qzIg5KKu4Zt8cjuOA7B2UB8G6nGFRWGVCz0Nw:9F0Enn2HZEDi0V8qzJKk8JFZ6iWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783538558, "uuid": "f3700ea4-a24e-49fe-aba3-6e572e8e0c21", "value": 25424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783538558, "uuid": "f0406117-ed1f-4d5d-b8b6-ca98ecd4d576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783538558, "uuid": "c21c78bd-fae2-42c1-bbac-79333e269834", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44380df-7aa5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783498807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498807, "uuid": "6e0733d6-34aa-406c-9428-f4519ea7bd15", "comment": "Malware payload", "value": "6b6d860d3d1053adc695aad1b34b3a4c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498807, "uuid": "e5f428d2-ee37-4026-9eeb-38f4da19cf1f", "comment": "Malware payload", "value": "fdb264fc48c98e4897658a4f69a9903ed7e7d81d361a30a97609fbe760d70976", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498807, "uuid": "43a4e918-8878-41dc-bd93-e2255182ae53", "comment": "Malware payload", "value": "9a2c1286ee88004d16421cce8c08728bcbe3c60c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783498807, "uuid": "69598572-1a45-4428-be7c-d65a057bcdab", "comment": "Malware payload", "value": "77a4fa745909c63da6e9fa9bcda52948fc8092612b154da0ebda0832cf7e52cc92f6a7d3ed73c62639897e0ce2a44c68", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498807, "uuid": "1304002b-afc7-43bc-a152-1c9050b1d8d3", "value": "T143E28D3C87345D10E0D76EB77E605051F315FEA0A8718A138C9B6AE644AF81B9A833DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498807, "uuid": "4e5faa86-88c6-4414-a5a0-1712da8945b9", "value": "384:Ncjl6Z/XgYC+CpPBRvzz+CG+FagCXYfzZppD1yGRw53T1lD12V5TF6MRF6PF8mj5:NK93pPnvuCl0RYNOTv1K1LT6SgEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783498807, "uuid": "b785fe1b-0b0f-45e4-b9a4-436f81a9cd71", "value": 34143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783498807, "uuid": "292353ea-de29-4dcb-a043-78294a1cb646", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783498807, "uuid": "00652875-8d93-4d80-9b8e-6a94a1842d5c", "value": "fdb264fc48c98e4897658a4f69a9903ed7e7d81d361a30a97609fbe760d70976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d26d195-7a69-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783472784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472784, "uuid": "b4c6e0cc-2342-4440-b47e-de27f37b83c9", "comment": "Malware payload (Mirai)", "value": "5cd6b827eb268d135153bfc6d11a56fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472784, "uuid": "5b33ee88-7e4c-451d-b97a-55c40069661d", "comment": "Malware payload (Mirai)", "value": "fdef885dbd4fe4d9a38821c0eac2d3ea77702ab890debb47c9957908d9398e81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472784, "uuid": "22dbf997-af2f-45d3-9e55-7a5c7345f6ff", "comment": "Malware payload (Mirai)", "value": "667199bfe223fa94af699662bb8d426ea7c12ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783472784, "uuid": "4f16cdf6-6e0c-4270-a143-9ac68b0663ee", "comment": "Malware payload (Mirai)", "value": "c4e010fb71ec7c211960fc0acc4a58d59e5780f9c3418dbf3217c952a5b17bdc4f65db74cf0d7c8b59c1e8bd93ad7368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472784, "uuid": "d99c34fd-68bf-4201-a105-43b144d54e3a", "value": "T1AA23F880F40B86F6D41B487050A7FA3FDF31E4EA51B0D5AEEF999F35DE675029102A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472784, "uuid": "dc8c6cd8-f098-4668-877b-3a3c61e106b9", "value": "768:j5vBkpOrWJyMG2oZpi27BvPIRAz0/EYrQq7og0M6mFm8d8BWY5q6nMspYmLCs:jkUrnMGBZpi0tIRAw/Elhg0JkdeWY5s4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783472784, "uuid": "8c238bb4-c7b6-467d-b49d-12d45fc19346", "value": 47440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783472784, "uuid": "7fc2b7e9-4548-4c2f-875e-376410302986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783472784, "uuid": "74e38450-6eb2-4bb8-9c08-6a92d6b9ad4e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e6fdb0-7ac3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783511530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511530, "uuid": "584123a0-b3ed-4013-b637-70f30de94369", "comment": "Malware payload (Efimer)", "value": "84e114db07c2fbe9225d08bc856ed52f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511530, "uuid": "34ee611c-774e-4ca5-ad17-51348c5365e4", "comment": "Malware payload (Efimer)", "value": "fdf03609a12b2535488e008293cd89d596f967af96d7763b880ee1ffd8702630", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511530, "uuid": "89914cf4-3ab7-4554-bdcf-e357308c0202", "comment": "Malware payload (Efimer)", "value": "9c8c0b26c1ac72688e0f1a5d43ddcf16cb2726e2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783511530, "uuid": "d5145cb4-e56c-405b-8c16-3096876c4700", "comment": "Malware payload (Efimer)", "value": "4a0d8b761291441fcc08751f04a639fe8c297d23da256b12a31507799f571bdacc86fd5333be99427a016efe83639cab", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511530, "uuid": "bb29dc93-ec5f-42e2-85fa-0e5af97ee740", "value": "T104E63358A3E912EFEBB3213C9DC2466AE5B8F0765772C5D71398D326AD031D08879363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511530, "uuid": "8549ae8b-1dc5-41ac-90db-dc9a0d24d817", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511530, "uuid": "44402dc5-feab-4b93-89b8-f529a94870d5", "value": "393216:eErawAJJKPuIc9JK1rMBMXMCHWUjXwcuI3/PGTAI:eEOHJguH9JmtXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783511530, "uuid": "802430a4-1128-478f-ae9e-5eaa17a61829", "value": 14319065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783511530, "uuid": "eb37af75-c26e-49d9-bbb8-a9737098cb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783511530, "uuid": "de1085e9-fce2-412d-be52-a1b0b3b8f27d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99305cf-7ae3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783525391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525391, "uuid": "72657ea3-8a05-4dd7-ab1d-0bb943793fba", "comment": "Malware payload (Phorpiex)", "value": "de7c0dc328815b4e7ed256c95186b944", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525391, "uuid": "28db50c6-3d0c-4cf4-a3aa-86d09df724c3", "comment": "Malware payload (Phorpiex)", "value": "fe6487adabe8edcbbbf0bbbfcfddabca7975a33c73549555cbd1b19b4385bbf0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525391, "uuid": "3fd247ca-8e00-48a6-bccf-4bf6902bea78", "comment": "Malware payload (Phorpiex)", "value": "8750a5eb17a317e9808de2074a3841b649f95926", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783525391, "uuid": "465329c8-d759-409e-87b8-066b511ca1cc", "comment": "Malware payload (Phorpiex)", "value": "2bafe735b4d296e83aa067f998ef2256db3f0ffbe753effe941f1367d67f194af16b9e441b63bb23dfb9d7cd7fcbbee5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525391, "uuid": "6cdc6f78-029c-4b80-af08-6842df4d78ab", "value": "T155825C0FB9424726C0E110B49676873BDA786872338854DBFB944AED0B686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525391, "uuid": "9a00c1c5-dfc2-463f-90c5-433c287e6d0a", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525391, "uuid": "0046558d-d3c0-4fe2-9e3e-6453424feeed", "value": "192:yaISCngTBvqQ1jV6lXwIXZ5qh4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdEFWEo/Gk:GIqQlV6lOh40uu9JgFtfUhav8U9c0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783525391, "uuid": "0d8beec2-4093-4007-9c8c-d3181fb1f97c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783525391, "uuid": "e06e855f-8e75-4695-809d-d2c4fc667d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783525391, "uuid": "10a96cf3-5787-4288-a4da-454e8e52d6bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf348456-7a98-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783493215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493215, "uuid": "e0f190bd-0b15-4b15-8947-4bbcc38d00d4", "comment": "Malware payload (ArkeiStealer)", "value": "9174f344878fc20e565af0ca8a146997", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493215, "uuid": "b37e3e08-0b1b-4c8c-bdef-a23391cf15ae", "comment": "Malware payload (ArkeiStealer)", "value": "ffb8bafc3c18814a68f791dec5f38b721e4b1918f387568bc57a873d069b19f5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493215, "uuid": "3a5ff3db-9deb-4257-9837-6925bfac550a", "comment": "Malware payload (ArkeiStealer)", "value": "2aa533793308d2b2eafa235a92c16aad9e2ba5a9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783493215, "uuid": "18415c78-79e0-40fd-8c66-9d4f6dd590b2", "comment": "Malware payload (ArkeiStealer)", "value": "ac3b9afa90dfc1f6e464930945e48080604855cec367f142ecd8b698632b8155497c4ca32fd5217916bccbcc919a74c0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493215, "uuid": "38086824-ea75-4f9f-a603-abcc92eb19c0", "value": "T10DE59D0B7DD009EDC49A923289B651A27B75BC480F3227D32E90B7382F76BD19D36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493215, "uuid": "f127027f-b275-4842-9a0f-57409e5d14fe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493215, "uuid": "5e8b9661-0131-45a3-96af-8f5156add4d6", "value": "49152:wSHliMoMwTg8nbGsO1w82KIOzzyclLjnpgl3p:wSHhiMD3SI9m3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783493215, "uuid": "3c43f94a-9a91-4028-8211-04dd8e6d2e93", "value": 3019632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783493215, "uuid": "d5888eb4-ebd8-4256-9fae-095d57ad4d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783493215, "uuid": "769d4d80-85a5-48fd-b101-0393176fb725", "value": "SecuriteInfo.com.Win64.Evo-gen.59213764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }