{ "Event": { "published": true, "date": "2023-08-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-06", "timestamp": 1691366581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "526a840c-5dff-482c-bf21-7aa64f2d3f66", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed015f31-3435-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691311670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311670, "uuid": "47db5a9d-9d99-4d88-9f33-eb04958ffcfa", "comment": "Malware payload (AgentTesla)", "value": "44725494ec63132ef376f6ff5d118957", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311670, "uuid": "9409e6f4-b7fd-4834-b1d5-bc7bdf075fbe", "comment": "Malware payload (AgentTesla)", "value": "004ad4b8d03c06098e99e6ad78e188832d40548e9cf9d9e54a2723f00dcdce41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311670, "uuid": "e96f3650-1d19-4fce-a1ef-78c810b8329c", "comment": "Malware payload (AgentTesla)", "value": "c4cecf6d4e8e60d0eb5fe5b6aeb24bbe45c1b4a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311670, "uuid": "8f1f5b3f-3b9c-4c15-961c-99bd8d0b2a7b", "comment": "Malware payload (AgentTesla)", "value": "9497eab1a8845510692eeadf8fe55fc08b93fad2d96be3130c3ad893a9e84b9b967b957d59766ebe144e447d3cd564ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311670, "uuid": "923c4866-8f2f-43fe-b857-0c4cf9844aa6", "value": "T126559203BA8799A3C1491777C2DB543443A4F7A13333D60E798F2366990B7AA8B4D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311670, "uuid": "6d779eb8-8da4-4a40-a356-f655ae315238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311670, "uuid": "030f95e8-3612-4119-a837-89b84ecbebfe", "value": "24576:l8nFR2JcgTDxvQjZBQKkw4kT8hCrLRSFvCflHoVpdosBXzuBx5:lSf8hVVVuBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311670, "uuid": "8ce85e4b-2d9c-42e8-91d2-1a204bc0842c", "value": 1314376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311670, "uuid": "521b3e13-29c9-4e75-b0c8-8e8cf9fc18e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311670, "uuid": "81be9421-a5b7-4acb-9e4a-78215cf55e7f", "value": "Doc78531798155SVT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c50bb33-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329547, "uuid": "e167b6b1-5683-4655-97ab-352c343124de", "comment": "Malware payload (Mirai)", "value": "dd31e72bb55de03a5805d816335eaf84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329547, "uuid": "d73ef083-bda8-41ca-b0ff-9666141948f9", "comment": "Malware payload (Mirai)", "value": "026d24cfb966ad79f37f4afb091c8092b4857001e75ab6f950626d4bd0a341c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329547, "uuid": "9b17cef6-20e4-4c04-8d00-5e74a33ec9b3", "comment": "Malware payload (Mirai)", "value": "c049297ff1199c6d43175acf9fd546e55afc3cd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329547, "uuid": "6d13f442-3427-49c4-a7be-e0f6a3190a12", "comment": "Malware payload (Mirai)", "value": "0a31047dd44878893230af7a81052127bd366320b4e30c8a2c65a1d8adc9e1face9f80ce0a5c785b5b1e273c57d2d16b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329547, "uuid": "3ac92a05-191e-4976-bd48-e471ee629d06", "value": "T15343830ABF610EF7EC6BCD3705B91B4534CCA40A22E97F766974C528B61A14F46E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329547, "uuid": "ed46227b-d366-468e-868c-b923e8486595", "value": "1536:c4bQMezFxUAM4xU8dQGedlgNObhZEA6hrS7:ZbdezFxUh4xUEEhJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329547, "uuid": "27a6e453-5381-44f8-92af-607a2e17f686", "value": 59536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329547, "uuid": "cecfd133-4def-418b-a55f-6f44eb4e1151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329547, "uuid": "a79eb5d1-9ef7-4efc-8450-22e7d1658bfa", "value": "dd31e72bb55de03a5805d816335eaf84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f35ee18-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "0ae51ec7-a75c-4b6f-9ec2-91ba774dbd2a", "comment": "Malware payload (Mirai)", "value": "3db288c88c151a08a41baf8a9ae09a9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "e7c63ddb-da54-4d14-a15c-1261ed79b8e3", "comment": "Malware payload (Mirai)", "value": "037f46a202a96a8b0a8448d417ab23ee6c0fde6ec93de51589abf6092596627e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "7d97e303-223b-4511-8090-07dd0806aec8", "comment": "Malware payload (Mirai)", "value": "749a11e55d7f5e161dc407b6876f21de2a6c6720", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "a7a7e074-57a3-4291-b578-0aa1be2ee427", "comment": "Malware payload (Mirai)", "value": "975a5c21d91712c8978f33e2065eec3a563cd153b13ffa06f9e7592fe54a58be59329955ffb3edbe45b8d385144cf5c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315405, "uuid": "5c83ab9f-3ac1-4533-ac9d-002319869add", "value": "T157D2E1F4EEB9F787E062393D5E1C9C9D399CB473573AC91407811900663B986A2BCCE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315405, "uuid": "022dcd20-2644-45d0-bbe8-1e989c2925cc", "value": "768:+N8f6tfoQmQAXVylO24hxiguzhM3oQ8HzMEKwJfLRK1jqi:uMJXFlyzmk6CHgEhf81F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315405, "uuid": "0558adb5-c692-4da1-aa81-c59a15036f96", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315405, "uuid": "085ba956-0fa0-4db8-90be-711eca08d0c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315405, "uuid": "6cb9b45b-42cf-4dbc-95d2-f4408523e454", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe4098c-3484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691345471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345471, "uuid": "3f53462b-36be-4cd9-840e-1f84aa841360", "comment": "Malware payload (Fabookie)", "value": "7f8fdb5775ae02fef8efeff693dfdb7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345471, "uuid": "10172616-58e6-40ac-bd08-03d49fd94b43", "comment": "Malware payload (Fabookie)", "value": "05229eb55c61b01e7b7b9decd04435bc7fde4991b4430549bc7c64882eff63d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345471, "uuid": "b7e7121a-4fa6-45d6-a7ef-bce84f65b318", "comment": "Malware payload (Fabookie)", "value": "1a9f8647983ca86b5a4141ea0a5531e675b59800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345471, "uuid": "a06be5f1-2230-40b1-8216-5cec1d88f608", "comment": "Malware payload (Fabookie)", "value": "56fc0075854d2bb7aa4cfe480ba8056db20e11038c7ac9aaa45f156d166d7b6a2c8fcd408de6f85aedb2acc5e9190b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345471, "uuid": "847b0e0c-f8e6-4a91-b045-10ab45d308a8", "value": "T17B84DD64F0B2ECB3DA126B7039FCF91C91AD71551386869E365AF0B692D330031DDBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345471, "uuid": "8c9c307a-2634-433f-985e-6f9b4b0eff0a", "value": "96cc98468ed325b3857363887597bc67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345471, "uuid": "afd54c67-1ae1-4f76-897f-7f3ff64fd46c", "value": "1536:qyK9MVxCZrsuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6ud:qX9M2yuMXnAYy4AZ6DvcgJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691345471, "uuid": "c61dfb61-001a-4d65-ba68-27c20e191723", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691345471, "uuid": "815094db-9f1c-4603-ad6e-d6cfaede7cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345471, "uuid": "6e6af8c9-ecd1-46ff-bce8-ac1e4df13ced", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65582262-3445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691318315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318315, "uuid": "b786c415-ce12-4246-a594-2758623f91fd", "comment": "Malware payload (Mirai)", "value": "e53dd80654f7414eafa7e1ba1b537cd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318315, "uuid": "d81daf17-19d8-4748-be2b-1935c6448639", "comment": "Malware payload (Mirai)", "value": "05247a95175fe79375ac76fb38de11ce70e5bd142360f5fdd8cf08b3c56594a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318315, "uuid": "1583dd4a-38cd-4ed9-8f2f-6e39aa20d2eb", "comment": "Malware payload (Mirai)", "value": "e8201b86c2b629c7bd5341b855c47f5b55832b32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318315, "uuid": "ed901d06-8e15-4a0e-b7c6-198e0b6d5d49", "comment": "Malware payload (Mirai)", "value": "a319d89d63a030be43a169644c1e9302a90886ff8976f0105448ecd461a2b9442a432a4052b852bb40f7b38dba4cecf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318315, "uuid": "3c74417a-ce4d-4b8d-8f6d-728d3d8382be", "value": "T175735B24A97A2E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318315, "uuid": "9cd37d84-82cf-4d1e-9800-d13478f0635e", "value": "1536:SbHmkTSo3BOIqS5aq+Dc03lR9QuEk6vNNTKjfpFRo:omcjaq+DcclJ+vNwjfpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318315, "uuid": "6cc23598-84da-4885-aa90-755cbfaaa7fb", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318315, "uuid": "7d4356c2-400f-4c5e-8dcf-e66bbeb1ece6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318315, "uuid": "dc43a1f8-5ac7-4fcf-946e-d7fdfd43f813", "value": "e53dd80654f7414eafa7e1ba1b537cd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04050b09-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334043, "uuid": "7e6865dc-fd19-453d-be24-3598467f2ea8", "comment": "Malware payload (Mirai)", "value": "b21cf42189e52fdf184ad686a4ea3761", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334043, "uuid": "db988318-7582-4fd9-881d-feae40ffc3a9", "comment": "Malware payload (Mirai)", "value": "068d2bf9751d003f6e2e3c83bb701688fc3cfd83258784326085691779ba309d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334043, "uuid": "adbbff4f-d5ef-486f-857b-2bcc0a8080e7", "comment": "Malware payload (Mirai)", "value": "f6b46583bfd1d142364ba81d08f93d8faa52e260", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334043, "uuid": "65c56b75-1e36-498a-8bca-ffeb26d448c6", "comment": "Malware payload (Mirai)", "value": "113626d04809f3573da7eba61f5ef5fae524aec7806cf2a1ad963bb0ea5b447ceb8000af515350e6c63b85decaa269f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334043, "uuid": "011fb379-91aa-438e-9020-6c377d7f983e", "value": "T136E34A0BB5C184FDC8DAC1B44B9EA53BDD71F5981238B16B2BD4AE222E4DE305F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334043, "uuid": "656349e7-c721-40f2-bc7f-f536140871f7", "value": "3072:6VXSryDeg7I90i7D6wYNhva14/U/S9PkMh5ARHD+ld9uG8Jn4:6VXSryqr9mY4zPTNdZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334043, "uuid": "91a8ea6e-1719-4436-8264-d805b86cf7e6", "value": 155944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334043, "uuid": "280d0190-afaf-48c3-b9c5-21cff08b5917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334043, "uuid": "3d5b088e-f69b-466c-8015-9c753784f8c5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95453b44-33f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691283606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283606, "uuid": "b6d56b5e-d21d-4724-a075-92430686d9b0", "comment": "Malware payload", "value": "edc726be712f7fc73e9d8c559c82bbdf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283606, "uuid": "dbf487a4-fa30-43c0-b9af-75e993eb0dda", "comment": "Malware payload", "value": "071dd628d1a1d9b5d76a152427223c3089d52fff7d8edaa6853aa8ba287b0186", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283606, "uuid": "bd02adb3-6e0a-4757-8729-bc1b4b8e3e6a", "comment": "Malware payload", "value": "94ce044397795cdca4a14a198ec6af3928d4c7d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283606, "uuid": "3eb26dc5-d56f-4720-aee6-7b6761ccd0f0", "comment": "Malware payload", "value": "f5806fc84df984509826054c7d1871ef8de05eab7303a19da6edd16c3d1ba47a95c122c584eacb1ba8cf1dcfd58483f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283606, "uuid": "8932c351-63f5-471d-9ea2-3f61dd5ed3e9", "value": "T15F13E988FD58532AC7D172FBF70D03CD373B0B68E3EA72165A355B2233C6A654A2A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283606, "uuid": "62f9c5d5-c8cd-41c9-a9fb-460e04870ed6", "value": "768:SxI7V8uzwiSPUw7bswEI7MTaCY2M8WAQoM28jYiVa0U6v9I:PVtoJ/R9Me58HpB8jP7U6v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283606, "uuid": "d49c2a98-77fb-467a-9848-65b9dd788c16", "value": 44740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283606, "uuid": "8c5ff712-dcc4-45a2-948d-dbb74e5b6314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283606, "uuid": "e56d237b-e809-4d65-89ad-f7ae7c316f89", "value": "boat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa40e6-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329575, "uuid": "8ea00d4b-a40a-43fb-988c-0eaadea47005", "comment": "Malware payload (Mirai)", "value": "5550a4303683b22c0cca1322f6a19d76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329575, "uuid": "8c1a1de8-949b-4d23-8163-9af62ca79512", "comment": "Malware payload (Mirai)", "value": "080dc5ec07febc827c6005b67a5b6307d03b2f8fc2f87a074de31df71cc57b64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329575, "uuid": "19d9c3cd-8f37-45ca-8445-c5678b0e2b9b", "comment": "Malware payload (Mirai)", "value": "29e74ff12fd5f057dba0e79958564e7560e34129", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329575, "uuid": "8d9aa772-da92-4ef9-8978-2c3d7fab4da0", "comment": "Malware payload (Mirai)", "value": "ff799aeaaf03d789389bdeeadcd7d270abd2db537fce879cca6ce978e709b92056e9bced3f673f6ab2adccd88d3ccfbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329575, "uuid": "99362538-f5c5-463a-8ced-50aecc7954de", "value": "T13313E684B882DA1AC6D4137BFA0E83DD3B2973DCE2DD3307DD256B51378A92B096B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329575, "uuid": "2e782947-4204-40f7-b942-0637d232a79a", "value": "768:MfHKXhNW85co6Qo3Nos10fv7PrElZuz8R4I9JbmLCTtNG3+om/mMWfO:MvKX6N310r8ZuzSEUUIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329575, "uuid": "3f05ee3b-02fc-4faa-8f81-9f456927c43e", "value": 43236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329575, "uuid": "5f281b84-d50e-4026-920c-f48ddc461aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329575, "uuid": "45404510-0198-4260-86ad-c891aa822501", "value": "5550a4303683b22c0cca1322f6a19d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca86a1c-34a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691361169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691361169, "uuid": "6ed821db-ed38-4607-af6e-c5e4f318eda4", "comment": "Malware payload (Mirai)", "value": "9b918d17b28b6ab1e76ae7a716429de2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691361169, "uuid": "c2f2753a-8b7f-440d-a9d3-bab1f7aac523", "comment": "Malware payload (Mirai)", "value": "08ff38feb78de8f990053459be3ef6fa1fc2e7b73c292559ca5c74ed660ed961", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691361169, "uuid": "b886ecba-eba4-446b-89d5-8a1d57f6f8be", "comment": "Malware payload (Mirai)", "value": "26e37a84b9a7442c8f2af426ebfdfbdc9f627498", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691361169, "uuid": "6f0e5bde-21a4-49d3-8742-c22e98452310", "comment": "Malware payload (Mirai)", "value": "71a6446ef4af6dc393eacfb1a399559ac1d0407497005c179cbed31e37e11bac450572e8e46d76bfe96bd56ce1e5e13d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691361169, "uuid": "c3567577-2bc0-4e6a-80f3-361e662e260d", "value": "T19AD35C2568392F17C1D1F57E11BB4751F2E13B8E26A8C54E7DB20E4FFF206106816ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691361169, "uuid": "1c62261d-f364-4879-a1ed-c36b76610e62", "value": "1536:2f/un47NLNbYQOPOq8O9SgDxnd8sFObdH+7l2yjDvy1STJSX0eVvYLTa1a4Rjr6s:K7NMSglgN0KXVXk45r6Nw/5Q9x6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691361169, "uuid": "bcd9ccef-1773-44bb-98b7-822662634450", "value": 140304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691361169, "uuid": "bf3b7e38-6cd5-4070-b9dc-28c1b0c81542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691361169, "uuid": "1ce768e7-e8aa-45cb-8038-744a81628180", "value": "9b918d17b28b6ab1e76ae7a716429de2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4392908c-3469-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691333720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333720, "uuid": "467202d4-a0be-4648-b30e-a7889c8ee583", "comment": "Malware payload (DCRat)", "value": "11cdb13c17d21eb1e574459ab7bc1413", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333720, "uuid": "2899d26d-fdbe-460f-b819-78bbaf12835a", "comment": "Malware payload (DCRat)", "value": "091245bf789aabbefd2a412d39aeddec596c8b71aa93fdb4eb1c7b7d38ed3f90", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333720, "uuid": "22b85bf9-3649-468b-a87d-fc3fc810ada6", "comment": "Malware payload (DCRat)", "value": "020968dcf4b1095ad269de6ce7086e675a5e5e9d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333720, "uuid": "26efaac8-743b-4d79-9aef-3da4a780ce48", "comment": "Malware payload (DCRat)", "value": "b740f13935f60b998310b81cfc1845f93a0412f720a40e7480fad9ba8a7c22b59d8bc6cfd7e7200eaee3cd24afc5575b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333720, "uuid": "06826f75-c7c0-4d07-809d-e5e11ee2f42f", "value": "T158455C017E44CE91F0191673C1EF820847B4A9516AE6E32BBDBA337D59123977C0EADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333720, "uuid": "4c96197c-88e8-4fde-badd-f7b7937a6505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333720, "uuid": "349500eb-f249-422b-b971-3851a30943f8", "value": "24576:nUQHEn9SZXbl/PyQB+SovIzV+AWfGu5IH7P2O:nUQfZXbNNF0eP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691333720, "uuid": "48db32a7-19f3-4dbd-ad54-40234a6f67db", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691333720, "uuid": "e3d44ee1-7e38-4b8f-908f-55be59eb7375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333720, "uuid": "0dcae354-e197-42fd-b70b-1fb4290a69bf", "value": "11cdb13c17d21eb1e574459ab7bc1413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45de4f76-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691311820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311820, "uuid": "36f4bede-0a60-44d5-afce-f2e884ba23f0", "comment": "Malware payload", "value": "1ead0eed2841266723e332cb9144a808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311820, "uuid": "ba61a35d-edc0-45e6-8e91-7b63e2eaecac", "comment": "Malware payload", "value": "09571623326972119f44c4f2e92b7dc4ef670a9238d21c4fbc671269da610ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311820, "uuid": "858c080c-fba5-46c7-ab00-e0c9d850db8e", "comment": "Malware payload", "value": "9f2e2e18a72ade966608d2a92ae50695aec07034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311820, "uuid": "b0b141b9-3472-4f31-817f-30acbb04a7ac", "comment": "Malware payload", "value": "db77c06a66ac8ccb395ebc53baa9530a1d8dac8be1abc0953b9d4f5551f48c6d8a435f2763518a4bd660f17ca315e0c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311820, "uuid": "27d4c61f-97b7-49d9-a419-fe04e74e0fe3", "value": "T1F845230576FDC662D74B7A33DAB6A32381BA76036910946C089C627E3C00F6947DDB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311820, "uuid": "b7e9723c-6d84-4b92-ab0e-7d4285578a4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311820, "uuid": "e8d1229e-6dc4-4b3b-b884-376f2c71e0b1", "value": "24576:3JBD00ouu3cPUmYsovT4RXwIWd/AgWl+pqn3B1jAkEX2w2klbhKSdw:5BowussTsyTmXwIWmgnqnR1sfR/KOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311820, "uuid": "1864f6b1-f6d4-468f-9038-0d7bf1b3326d", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311820, "uuid": "5b387712-25b8-4124-ad6d-965dca43dcb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311820, "uuid": "711c7f48-6345-4a77-b42d-91323ccc3026", "value": "1ead0eed2841266723e332cb9144a808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1738f8-3460-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329845, "uuid": "13d25f5c-a32a-49cd-a3e9-a2eb140af43b", "comment": "Malware payload (Mirai)", "value": "73cc6ca6718db8d06799a161675e702f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329845, "uuid": "385abeb8-c41e-4499-b9cb-dc26d0480a99", "comment": "Malware payload (Mirai)", "value": "09aedd9d6ffb76ac0c80594f4627d6ffabe85c9ec19dc9888a11a35db909e17b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329845, "uuid": "8e228084-70e3-4bf4-a7d2-4520cd2e1cde", "comment": "Malware payload (Mirai)", "value": "51c5c6fc3ec69792646898ad853e8006065975b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329845, "uuid": "e58d1e32-5807-4e50-8c8c-28e0d459da7b", "comment": "Malware payload (Mirai)", "value": "e55fca659b0dcd39450eead6edd86e1ae00af02d82f878bf2f93aad6855bd7a53e530471d877c8d6a1547d522fa66b2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329845, "uuid": "380dc692-892d-40a4-ba25-473d966c2037", "value": "T1E3234B39BB35192BC4D8A43E26FB0758B2F5134A28FCC61A7D730E4DBF206506627671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329845, "uuid": "e19bec47-9982-4ab5-95eb-4c892a90ac77", "value": "768:/uvHIYsIhvVnFaJ9JSfTVKHdKQcI5YqC98vCO+3pLlf:/ufpsKHKvSZKt5E98YHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329845, "uuid": "e802fb83-a55c-45db-9f1a-56dc0f3290e0", "value": 47424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329845, "uuid": "576c9a2d-b433-49ce-a4df-b15c9b216689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329845, "uuid": "9ad4276e-9049-4fd4-96e7-13695053e08a", "value": "73cc6ca6718db8d06799a161675e702f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d254c42-3439-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691313013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691313013, "uuid": "9a255ece-e9cc-43df-8a7c-ffbe75abc18a", "comment": "Malware payload (Mirai)", "value": "a35871895d6dc0b6d609a9811d0c3161", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691313013, "uuid": "853bd887-4340-485e-84c9-078c33214f05", "comment": "Malware payload (Mirai)", "value": "0b8ab7cb2540988e7597d7c9cf5ca1ed3d347705a573d5dbda54b458a3cc3ebc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691313013, "uuid": "e5169c07-a57d-4fc7-afc4-6c2e63a6f923", "comment": "Malware payload (Mirai)", "value": "1b41aaa603d7e1c01f50c466866ca11d513ab3a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691313013, "uuid": "93fce013-1eb9-474a-b6bb-eb61a0904f72", "comment": "Malware payload (Mirai)", "value": "ee660394a6c3e68556a6c098dafafa6d229d54e4318f613419cede26f89db0fab5de7610059d3b124ed29602c7ae2ae5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691313013, "uuid": "b59128e9-7f6f-4088-b666-a21845b54768", "value": "T128934A3AAD3E3A53C1D4543F12B70720B3E5A34E25A9875E7C710E6CFF51AA0212767A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691313013, "uuid": "3ef552f8-2704-4418-8b04-af2e89994bc6", "value": "1536:E3AggGQ2tQg/sH63bGoaV8kN6SNJ1K+alVHoaFtRqXI:CQp8NMKNVHo/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691313013, "uuid": "72d15f5c-0189-421a-a0fe-a4eb943894c4", "value": 94956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691313013, "uuid": "29d6ad9d-6b75-4cb7-aa4b-d86f2edb1e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691313013, "uuid": "de4e6409-1646-4ef8-ac6d-047cc0aa4494", "value": "a35871895d6dc0b6d609a9811d0c3161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14490014-33f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691281672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691281672, "uuid": "6985eb59-a47a-4a34-a3d0-1312e6d904d7", "comment": "Malware payload", "value": "1e53766db805195dddac3167f0111d07", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691281672, "uuid": "4fbba439-01b1-4b51-a570-adc57607cdbd", "comment": "Malware payload", "value": "0d177d41c7bfdc5d0c9a00b77ef671063fb8b5630849add49b304ef2e3fe5e08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691281672, "uuid": "a964adfb-2a17-4f5d-bd6c-c7f20ce27154", "comment": "Malware payload", "value": "32d1c2d785f92551e56825ad875c0955fe1c50da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691281672, "uuid": "41abcdff-ee79-4ecd-92c7-e8a7fb228f5f", "comment": "Malware payload", "value": "54ea7e85085c18229b61dcebb223806a41f483616d99e46c1fddce598fd847b81aafcb760120d511aea187caeba7175d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691281672, "uuid": "e2e327a3-dec8-4f3a-934a-d3240426ad88", "value": "T188C5F142967F40C5F9CE14FEA34BA7AA0DA564CE4F34407209E80E9A0A1FF9345D9C7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691281672, "uuid": "b2eb609d-2308-4613-8e36-87c87989cc91", "value": "579335065e92c975721306914f37b3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691281672, "uuid": "5aa7684c-d19f-445d-ad56-17b5be4b08a6", "value": "49152:Q0Hk2goLd+0E+fyr1orFePGw12mKZyreXXKIXwYcc7K:Qsgyj3arKop2mIySXXKIAY77K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691281672, "uuid": "ad792503-7410-4bd7-8358-dc6dcb2e75db", "value": 2551808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691281672, "uuid": "117076c5-57cd-40c1-a791-0283c38b1b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691281672, "uuid": "355035f2-f22c-40d7-bda0-cb01744577e3", "value": "SecuriteInfo.com.Win32.DropperX-gen.18099.28058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dc315c-3445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691318319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318319, "uuid": "52ffc885-0e1c-4b83-af09-28fe7d33cf32", "comment": "Malware payload (Mirai)", "value": "704c7eff80879cbda402d9f95f31b22f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318319, "uuid": "c4f10c64-b4c8-4c1a-a823-8c75a5ed9e79", "comment": "Malware payload (Mirai)", "value": "0d634e2a7b1625b51309849408f879017965e27c177a55579aae561eec33249e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318319, "uuid": "82a2e403-7993-4a24-abaa-ee703777530c", "comment": "Malware payload (Mirai)", "value": "d3005d9d3b3dadea15413450bf2e09424d10cf76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318319, "uuid": "8bc598aa-ceac-4e05-8702-a747c7862c47", "comment": "Malware payload (Mirai)", "value": "33daee977f66dfbb7dee9ba759e4db4dcaaab2a6791fd7721ed646a271be3ccba570472096da5f500296cf0ac0066bd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318319, "uuid": "bee89f01-96d4-4062-a93c-513c65f2ae7e", "value": "T1BEE2D1CCA6C47CABDD8F987A338D0568A7D26851211C8F8523718984AF6FC5CE4DC47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318319, "uuid": "a0ff6fbf-8057-4086-82b3-f8aa30e2a34f", "value": "384:Z3fpCLrsjHIX69URc+hmnulYsS94W5/u60JooX2IjIrQ72DGu2dKHyBXa39RWGVx:9fpWcehDQ4W8NjIr2aKa3LWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318319, "uuid": "588ed798-a95c-4ed0-a0ca-d8b7428551b0", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318319, "uuid": "0cd3c99c-768b-411e-a6a5-c52eeeb371f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318319, "uuid": "54a88c2d-4f7e-4a52-87d8-f593fb5576a7", "value": "704c7eff80879cbda402d9f95f31b22f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d4e385-3416-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691298267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691298267, "uuid": "4d8b0a3b-35fc-4248-8062-b6b8b912c771", "comment": "Malware payload (Amadey)", "value": "90e1482208611ebf4b36413d6bf05f42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691298267, "uuid": "9c87f666-08ba-4e1e-9c38-486a03930f63", "comment": "Malware payload (Amadey)", "value": "0e41ffd44bc8a085a3bd49058ff0051538476c8a05f086593b02bc87b30268dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691298267, "uuid": "9e9644f6-b3c1-4bed-ae6c-953077389cf5", "comment": "Malware payload (Amadey)", "value": "9e54348e958c9ecf2dc8a7b59ddc27489a0b5935", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691298267, "uuid": "574d3755-81d4-4ed2-abe9-51a6a219f99e", "comment": "Malware payload (Amadey)", "value": "31b9f10a768211bfa77cf5e371854ae4c362f2cdfde8a265ac100be816ab7fa2c0151fcf1a51cfde330fdf6171eb1ead", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691298267, "uuid": "3b02837c-1af0-445a-b9c1-bab333773a45", "value": "T1BA3418567912C032D560A1B62AB5BFF2C49D6824ABB045DB7B800F77DA112F73A70E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691298267, "uuid": "1e11afc5-08f7-4229-b4a3-0ce844addb13", "value": "ff195cccada6bfe977f7c90930774f78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691298267, "uuid": "bbf1f849-b4b9-46a5-926b-c9a523184d54", "value": "3072:eSO3Te83mI75HrE+kqQUULV5J3T1XiRuiibP5o/l7RSKFyLiJGu7dqvyEzkzwkr8:se83mQ4LBVvZT1ilF/WKFrGu7duMAVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691298267, "uuid": "648e405f-6849-42a4-ba57-f1c634e1f447", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691298267, "uuid": "54142515-6212-45ee-a9b4-d58617d5992d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691298267, "uuid": "912f4fd6-7a2b-41fc-ae26-37d6c01126c7", "value": "90e1482208611ebf4b36413d6bf05f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c843f76b-3400-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691288845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691288845, "uuid": "78c0f138-573b-4dd6-9eb1-8ac19d0c7410", "comment": "Malware payload", "value": "6ec5372890d1f0a185e6655aa8ac67b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691288845, "uuid": "c7669df4-bec6-41aa-a1bf-9416bb994457", "comment": "Malware payload", "value": "0f033be393770c493f9203244d0caf37061a89e29e0093ea4fb9b0d9ea6b3536", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691288845, "uuid": "b26f9f9e-5446-4326-a0e7-b5b67ca0f269", "comment": "Malware payload", "value": "3affdbf63671bcdcabd7d78931868c7f491c3023", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691288845, "uuid": "9ab92436-561e-4cb8-9b4b-4377cb379da0", "comment": "Malware payload", "value": "ff9c415e07cc84b7c03e462f601c50dfe6b5dfea6160400325bf0717a4a7e52030dabc45bcd9216245dd9887c320ceb7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691288845, "uuid": "a5418a76-5c54-4bc0-8ed3-bde976e59f91", "value": "T16EC5F103027B84D9F5CC94FFD716A2E34C5991DC86B8A8789ED34E7A061FFE9406A136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691288845, "uuid": "0214f564-5c90-48a1-b485-284633a132a6", "value": "20370949d57d42d7895b59e1b24303b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691288845, "uuid": "02195ed9-9d07-47b6-aae0-f774c0607b64", "value": "49152:3dTQXWrA5DgJYAUbKyjBIU42B1mmkS2p865GHAmRmaW:tMX/5MyzDSU9fpkSbvg4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691288845, "uuid": "cba2222a-1a09-4edf-8347-884447522832", "value": 2551808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691288845, "uuid": "8d96be04-cd12-4ca3-ac9d-8aa7f1235dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691288845, "uuid": "7c5940fb-b4a8-4639-94dc-5685a78c46cb", "value": "SecuriteInfo.com.Variant.Lazy.370596.18270.30159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfc8b59-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326674, "uuid": "e27c53ca-7a87-4ead-9e77-4d1fcd7ae4ae", "comment": "Malware payload (Mirai)", "value": "e890320e86c5c36eacddb3aeda60f934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326674, "uuid": "23340ca1-3d71-4a57-b002-4110bc9fec01", "comment": "Malware payload (Mirai)", "value": "10bd1b0d3ed5e488f135675aee864c15d2c380a5d5320ef08ca7eabfedea7088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326674, "uuid": "e62ca95b-0246-47cf-a146-295c964e91a4", "comment": "Malware payload (Mirai)", "value": "4249526a550544da9aea1773e381cc410b6950bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326674, "uuid": "e489ac3a-1f6a-4899-a868-09e2748f0cd5", "comment": "Malware payload (Mirai)", "value": "9ca37b3b30f0c644d658aa5351013a2a0a78990859449870065e6cb58d1676efee6628895dd65e1806db8f37557e3c7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326674, "uuid": "bea9e473-88a3-412c-8e1c-a8b8b6b8c382", "value": "T14AC2DF10F1924D0AEBF5EEF41DA5E7E2BBB0191BF1D6CC9060C4F66267123660666ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326674, "uuid": "0c60e75f-4677-4324-ad80-7007d0f1e1fc", "value": "768:SVdafO76jpmX1tJHYkYRCyQkiI4ujt4uVcqgw09B:2am+SPekoCyQ/Tujt4u+qgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326674, "uuid": "a80040bf-68c6-4465-bf5c-76df4863926d", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326674, "uuid": "f894492a-355b-4633-89a5-0accdab3dca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326674, "uuid": "734f24d9-3598-4bbd-b1c6-617115d5608b", "value": "e890320e86c5c36eacddb3aeda60f934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c98ab3-3460-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329852, "uuid": "c35c7487-3e9e-4679-9df5-85dc6655379a", "comment": "Malware payload (Mirai)", "value": "6b98dcfab4de160faa8684568ffc2a58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329852, "uuid": "16ecd3fa-88f6-4310-85c8-25637b3ea9a2", "comment": "Malware payload (Mirai)", "value": "117173e14c9771ebaf8658d93b7e3e07548fb781a73b81e35d19359533deeb83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329852, "uuid": "0186de15-55ee-49ef-b443-fff10c810800", "comment": "Malware payload (Mirai)", "value": "cc2252d8bde24f57ac0c77ef706d2c88b043bf5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329852, "uuid": "bd7f8e94-9da4-42be-a47e-8cbc86f5eeb3", "comment": "Malware payload (Mirai)", "value": "96114e4b68c8a83338fd638819bbeec9b1dbe9a1807485fab493d833b2ff7e563ffe3a876109d2427353d4201f04892a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329852, "uuid": "9e7ed1dc-cb26-4f47-bb39-8beb86d2f26b", "value": "T1E0735D24A97D2E26C0D4A17B61FB8361F2E6230E25B0965D7C760F8FFF2464468172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329852, "uuid": "c17454f1-4c4a-4f85-bd61-4103f2d7e9f5", "value": "1536:5ms+geQfvznpCR8ee8kWsAUiAvF+7IlNnws8b:YwfdNukjZvFsI3w7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329852, "uuid": "369fcc7d-9833-413a-9ce3-ab2c50fbd175", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329852, "uuid": "29d88939-55a9-4615-877d-5273a47624e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329852, "uuid": "87d9f5b8-27dd-4bc3-8522-23118d354382", "value": "6b98dcfab4de160faa8684568ffc2a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f283313-3437-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Joker)", "timestamp": 1691312211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312211, "uuid": "c6145c38-cb63-44c9-badf-c641a45519b8", "comment": "Malware payload (Joker)", "value": "82a37e68ffbf70176119ba10b2ee6196", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312211, "uuid": "51dccae9-453b-4aed-b444-56a239e29234", "comment": "Malware payload (Joker)", "value": "1242a905aba25f45f5289f154372d792fb7a6fa9850a287b668bfcc0fbb04732", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312211, "uuid": "d51c1e6b-d288-43c9-9618-54b963869d7e", "comment": "Malware payload (Joker)", "value": "f4fcc98a7e8963339679a7c1ec06e3b07ef72ff5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312211, "uuid": "31926af3-9b39-4eb1-ad89-b809a60d7398", "comment": "Malware payload (Joker)", "value": "5334734d75e61b2686b56183cc82aa164520b75175fe10dff8e521d0cb6d512a0a097edc04d2dd3cf7e6412d667f5f2a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312211, "uuid": "e1d741cb-a3dc-4a37-834c-eb3675b1cf64", "value": "T1E3A69D09F21C642BC47BA171AE8F122B9805BC904746B6D37F06BB696A736D54F3D3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312211, "uuid": "b868f58f-8f84-4acd-ad33-4d43d64144ee", "value": "98304:B3s6oB0RS3+Whv8FtdsZArU6HJsGJAUTv7uI5iF9twHfQgLOzzipnsWhTxYXRWkL:66ZRSuE+dCjYtJAY3sTiLOzunZTdNdpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312211, "uuid": "1aa60af2-dc3f-4d36-bf96-4175fa9d9b2d", "value": 10155345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312211, "uuid": "742d2ac6-2f5b-4923-b972-a38413a92a20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312211, "uuid": "3154c75e-e60b-4316-8069-91a8a9cc0519", "value": "Accurate Image Comparison_1.0.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffc6257-33f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "45c032a1-a303-4631-ab89-b06e787bc9a2", "comment": "Malware payload (Mirai)", "value": "3108c169a9ced5199878fb6c9f028780", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "c66e1511-64ea-41a1-b04d-23d7d3d2a15a", "comment": "Malware payload (Mirai)", "value": "13688df9d2544e062be92bedb25f6b5f91769a3e4a426ab994818305c389e072", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "65cd9dc4-d4c2-4264-850d-02f387bf92f2", "comment": "Malware payload (Mirai)", "value": "6dcdf80cd4ecb9de0e09465fe351507b3fb5b101", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "21fc10c3-3d1b-4c17-9771-dcd382edfcb9", "comment": "Malware payload (Mirai)", "value": "07c8087b653fe3a9e6e311224e0f9e0483d4d9e1c2edd3a709a3f474b78794b71cd43ce5e0cd3f890e077904daa21661", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283007, "uuid": "57644713-5a2e-4401-8049-3108fd9ffd0b", "value": "T134C2D030A6A91CB1C6510A72F6B85AC9BE430F7EF6FA3890214157FA39419052DEE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283007, "uuid": "05bb2e02-b1fb-4e29-99e3-b014b88abb22", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE+d4FG1rhymdGUop5R:AWsoTAZ3alkXLvFh8nNE+d4FGFs3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283007, "uuid": "aa387e54-e3ee-4e5a-9bf0-5cad5151d6ae", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283007, "uuid": "ac2b1744-0903-41e0-a799-b1124b4f5934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283007, "uuid": "da8d7e41-550f-48dd-9aca-eefca1fd5a90", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fe86b5-3499-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691354610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354610, "uuid": "a7287749-d4cd-470b-9df9-a01b007f5d62", "comment": "Malware payload", "value": "f8dbc479c09148a529b7591ba89883c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354610, "uuid": "f983eba8-a7ad-4334-8e5b-008f9eeca4a3", "comment": "Malware payload", "value": "1668c2335a2fa03ccc5b5f3f2a11d9daa5892641311142a6ee72409cbc9d3672", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354610, "uuid": "6606385f-0ead-47ce-8860-90a7f0d7aa4c", "comment": "Malware payload", "value": "3813427ad43beccf1c889d6fef2bff3a42c10e4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354610, "uuid": "62a892ac-1b08-4d0f-a054-28f5376b496e", "comment": "Malware payload", "value": "f0f341e2b5abacfc77bd304212916983a72273086513d4b0da7ea382cb208fcfcde8066edafd1fde7fac100de74adf33", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354610, "uuid": "7e2f87f4-8d2b-4ebb-b5e0-f791d3cbd614", "value": "T1A6F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354610, "uuid": "2275aea1-db1c-4b18-845c-17d118c04752", "value": "ba23a556ac1d6444f7f76feafd6c8867", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354610, "uuid": "0e56b055-f7ac-4a1a-a450-03a3d4f13d69", "value": "1536:1EGh0o+lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o+lqOPOe2MUVg3Ve+rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691354610, "uuid": "8020339d-1bc0-47dc-b46c-cec313764790", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691354610, "uuid": "acd891e3-5048-41df-a0d5-83877b18ecb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354610, "uuid": "8fd1c1ae-85f3-4ae1-a614-c69e043d19e1", "value": "2023-08-05_f8dbc479c09148a529b7591ba89883c5_goldeneye", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3ee4fa-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326705, "uuid": "adfdab6b-35f1-4e61-9564-7ae6d8340aeb", "comment": "Malware payload (Mirai)", "value": "e04a2936859ff929ba979f0b2c5ca687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326705, "uuid": "449b14f9-3199-4011-9e7e-6cb1f1e1951b", "comment": "Malware payload (Mirai)", "value": "169db8fd8176e5470bf72f1acea0977da36a29bcc4b15fe38523f0fad9d8d0fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326705, "uuid": "76c9aa3f-b893-48f5-9301-2e5353581e92", "comment": "Malware payload (Mirai)", "value": "f1ba41f5326d92f323b5c5c0449eb77e00c4ebca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326705, "uuid": "e6ce5a58-86a1-4657-b1b6-10b41427973b", "comment": "Malware payload (Mirai)", "value": "497b7ee0e04eb41e800c7eeb72b237b37c8327aae8c249ea9d084addad0f4f22cce4354cc58f3b537374ce82583dc916", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326705, "uuid": "eac70cd8-59c6-4c38-a4ed-945968dacb9b", "value": "T127D2E18DFE88A0A3C86E2D3DD20C2BF18D94B0F577CF6D865314648CEE1527FA5A4918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326705, "uuid": "81ad0290-17cb-4880-9b4f-2f131f20e647", "value": "768:k1u8IVuBD9jr1zehhl+DaKUQsR4AXmHSAJbUWUY:ktus1xeIdAX6YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326705, "uuid": "7f626e0d-19a2-4e91-90bb-aa6e819d14d5", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326705, "uuid": "6ea441f8-ddf5-49f3-83ce-b688ded4a62a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326705, "uuid": "3182edaa-6b65-4f1d-86d9-153c01d5dbf9", "value": "e04a2936859ff929ba979f0b2c5ca687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8cb2cd-34b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691366300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366300, "uuid": "4074b9bb-9aa7-4206-a4d4-db63f60e37c4", "comment": "Malware payload", "value": "7bfc26c4c752b5a1a86f20eacd337c02", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366300, "uuid": "2be8f682-bb4d-4ed9-862a-efcb7fd4fbe5", "comment": "Malware payload", "value": "18982d2308d18190601df6315e3dcbb35d63e61f0709acabd54b9c60727ed9b8", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366300, "uuid": "41351ee6-3374-4595-bfb3-ff4b62b9a9db", "comment": "Malware payload", "value": "5e3394b427ac7a5d70f481557d0bd2a238429b90", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366300, "uuid": "c0119141-e604-4de4-af0e-c55f40b60b5a", "comment": "Malware payload", "value": "8b91b7039e0c9e62224e3e9f56ceb5093c570b0cab2790b798038e31a7070a4102af098c4317a0dc966700df0ce835f2", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366300, "uuid": "ebf7469c-7e4c-489f-8565-5335e78523ed", "value": "T11AC08C20451EC83A806B0A1889098EBCEC1250C161AACD6402A42A4ABC934AA4E881C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366300, "uuid": "f42685c8-4951-420d-9ece-0bb9b383917c", "value": "3:HRAbABGQYmimiLXIhzKEg9XuWA7MPp8o1YSo/QJ5/0GIyYesbBSn:HRYFVmizLXczf8XuWaIASoIJ5/0GIyYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366300, "uuid": "258b90bd-0c5f-4615-a7e6-e4e89416cd8d", "value": 151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366300, "uuid": "6cb0e1b5-5e6c-48d9-85c2-e0f717837d4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366300, "uuid": "7c84d043-22fe-473f-a9b1-25de386ee0ca", "value": "en-stable-local-upd(version104).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503e7565-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335459, "uuid": "1030304d-d5ad-42e1-9a69-6f807597b603", "comment": "Malware payload (Mirai)", "value": "0afe25f1f2077da2b4ca38c6f34e291b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335459, "uuid": "e71894c4-a444-4cd5-95af-da334dcee2f9", "comment": "Malware payload (Mirai)", "value": "1c15a6e6af92aa60e6cd127e0aed4bf1712a4c050977677a21a9ed91b2e35dba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335459, "uuid": "806f8328-1c13-4d0f-95d7-851c3c6018fd", "comment": "Malware payload (Mirai)", "value": "6cb6adb2620fb6c6af4ea92ac5ce595349ac0922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335459, "uuid": "8e02ad38-c99c-45ca-9858-b47c64057117", "comment": "Malware payload (Mirai)", "value": "223925797528bca57eba3dcec3320cbdb312b6993eec56b9b544304820db3945b2a13222a9dbacd1e98261f4d0afaf65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335459, "uuid": "5b00dc71-d18c-48de-8616-ed030cc7f11c", "value": "T128F328D7F800DEBAF80AE3374853090AB130B79115925B377297797BEC3A1D91867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335459, "uuid": "c10417f4-2b89-4a5a-bcf9-ae154c23057d", "value": "3072:PFbG8NeHPgwI8poCFpdIeRHhpDBH75BAmrVcjbiHL4BC+tJ0ymY2xj:UvLRvRBp9PAm/L4BCRym9xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335459, "uuid": "6dd8a08f-b782-4982-ab57-2a680a9029ff", "value": 170624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335459, "uuid": "1959a035-f744-4de3-b551-93e550986729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335459, "uuid": "0ef8bd7f-5e3d-4d3d-8e30-9df3e83f2bbe", "value": "0afe25f1f2077da2b4ca38c6f34e291b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937e4113-33f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691283603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283603, "uuid": "013debf4-77eb-4f80-980b-9cd7cb44828e", "comment": "Malware payload", "value": "0aff68873c3ff15c579f52eeed8cbc78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283603, "uuid": "f1e7c249-99e2-4e9a-b641-7bb9f7cd475d", "comment": "Malware payload", "value": "1d2bb56f1a44b2bdd8e0961dcb97b11d6859105ba0b3710cec9254bfd882dc17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283603, "uuid": "ddb60abd-edd2-4e77-8421-16f877903163", "comment": "Malware payload", "value": "eef26909614fabe8f3a1ed1a9326faac23c79d2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283603, "uuid": "780c180c-6d55-418d-a6b6-fe0cff3760b5", "comment": "Malware payload", "value": "44b0f153a70b0efd38b484351e46eaf04ebffa44ae57065bf18d1eea36775ee4c8fba929e4c4ad3c8260ac1f948a7d06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283603, "uuid": "3f5776d5-6043-4f73-b440-29f1e0ac9b3d", "value": "T12EF25C45A781C077ED0301B250B7DB375732E27A3096EE5AD7A82935FA62501EB333AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283603, "uuid": "db0cde47-5384-469c-91f3-636e9c4954dd", "value": "768:uP34Cpr3E+5Rh7LYEVC2pY9lf8S3VESJIg:uf4IrJrxVCY2lLuSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283603, "uuid": "3c0cfd47-a91d-4786-a47b-1f45ad1967ad", "value": 34836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283603, "uuid": "12314f32-6d0f-4d26-a164-d0e3ea9dc05d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283603, "uuid": "413b03a4-2466-44de-bea2-7ba14b71b520", "value": "boat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f759da7-3440-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691316023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316023, "uuid": "63fe9f1c-69a4-4493-897f-d7c75571bc44", "comment": "Malware payload (Loki)", "value": "f16789081b4d001aff5aa10d209e9bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316023, "uuid": "af56faf2-9edb-4362-a038-537d0f78e5c8", "comment": "Malware payload (Loki)", "value": "1dbd4c8bfc62f2efc6bf56ad3847719fa0f42a29df856a388734e2965aeecaa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316023, "uuid": "9409051c-5b6e-467a-8ee6-afc179f25834", "comment": "Malware payload (Loki)", "value": "b5891d21e4ab54f45182c4f5d96a25398314525f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316023, "uuid": "e3a481e3-f50f-4dbc-91ff-b54ce00facdb", "comment": "Malware payload (Loki)", "value": "82f41e08caeb2363bf88f1f8efce7cafe3dc850051cea2965c18dfc6b00dd5f33aea463787c8b0a6ba9afc9f1d399050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316023, "uuid": "afecdd28-19ea-429b-af91-d6a3c53b09fe", "value": "T1F0253AF4FD59B8AAC10ED731B29098FDD7631DFA028A4B9D06A7EECD5B037494B48481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316023, "uuid": "7d1d2ea6-dd51-4a6b-9f5f-8b305612ebd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316023, "uuid": "627cc26b-e19d-419f-b6b5-4c2d49387c46", "value": "12288:z2kwUarhvTWP0NQ+1gqhTo52F7mxIFSHtnZmV3jDVc73Fz7vf49Jg57ICfLc:z2k6rK0ND153FSNI3nVc71PvfFCCfLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691316023, "uuid": "8ea8ba0e-10b4-4bd4-ae19-512d9b3048c3", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691316023, "uuid": "69ef2c25-2fc6-400e-b043-71fcd1f5db8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316023, "uuid": "dfc1fab2-4176-4386-ad6b-419c66572975", "value": "HEUR-Trojan.MSIL.Taskun.gen-1dbd4c8bfc62f2efc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09ee6cb-346c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335165, "uuid": "9e3b08bc-5bd5-4809-8b5c-b6626eb4efe6", "comment": "Malware payload (Mirai)", "value": "6c08fc32b27931948793874f25e0c9b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335165, "uuid": "ba7c1de3-fe9f-4e88-ae49-c9b07cfb21cd", "comment": "Malware payload (Mirai)", "value": "208e4ae853feeede9be36b9385aa38e8547d83c979825ba7b9cb53a53c51c513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335165, "uuid": "b0f8a4bb-e818-4f83-b5dc-a961ec174cb7", "comment": "Malware payload (Mirai)", "value": "1733fda1e0274bfc77830c60d265c643de16e639", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335165, "uuid": "de58b938-ec41-4417-a0cc-936db4f1a8c5", "comment": "Malware payload (Mirai)", "value": "380a8e9400a6aa2ccd855dac72da2ad7ffd019e4162d9d329c412f2804832a6ccc57caf0d474a9ec51ae688085007f97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335165, "uuid": "abf8497b-a1d1-48df-a481-fc2d03d967ac", "value": "T19CA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335165, "uuid": "a06b1a4c-f4a9-4d94-9ada-f2c2a7a210c5", "value": "3072:VK1z13U6HzHoXRtmTUhQogvEmmFVcqq0GnDZT:VK7DDeKlogvEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335165, "uuid": "4c6580e1-5a8e-422b-8b97-39b7a7614f85", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335165, "uuid": "8c062693-b0f1-41c8-b17f-a27c16dd9f1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335165, "uuid": "93f41bdb-62cf-4a98-9c31-65b0fa082916", "value": "6c08fc32b27931948793874f25e0c9b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946265d5-33f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691283604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283604, "uuid": "8ad2458c-fc51-4c8d-907a-e517c210b24a", "comment": "Malware payload (Gafgyt)", "value": "820df80752acb49a8ce65fbe9f5e39f2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283604, "uuid": "3f7c6dde-d7b3-4847-a7e2-2f197adb0e7e", "comment": "Malware payload (Gafgyt)", "value": "211c7801dcb8456ca2fd97671600e34eb2f36e145579b96b446ee8ddf5d85cc7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283604, "uuid": "85af10a2-f032-4b6c-828a-9a5e2035176a", "comment": "Malware payload (Gafgyt)", "value": "8bbd3e0f378899a4004f3c294980805744e8ca0b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283604, "uuid": "d2bf296b-ede5-4c7a-b3bf-6dc2db0b5c95", "comment": "Malware payload (Gafgyt)", "value": "afbb26c529e0589a7b7a167f3ea19b7232e88a142d63eb181b058b7fceb0f794a518ee7415a3471e39e324592b4ad241", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283604, "uuid": "4a1fca83-7fca-4f35-8000-ca31811bc7d4", "value": "T1B1C32B09E7408B57C0E2277AEADB435A33339B54A7E733055538BBF43B827AD4E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283604, "uuid": "76017eeb-2f79-4654-bc70-82610432da82", "value": "3072:iEhu0/7aiUB4gaL/ljWNjQ0mm5q0pJM/9KbWV0VIR:iEhpzaiUB4gajlU/H5q0zM/9KA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283604, "uuid": "c5bfe65d-865e-4e37-8fac-2160c51a8702", "value": 127655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283604, "uuid": "76d6846e-b322-44b4-8d61-219a8fb477ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283604, "uuid": "84b8a215-96d7-4cbf-b885-1aac79cfaa44", "value": "boat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d683a02d-34af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691364031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691364031, "uuid": "8b7ff396-b461-48c3-a41c-bb3971b0cbf8", "comment": "Malware payload (Stealc)", "value": "101416cedaf94b696ca97774b069c645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691364031, "uuid": "8cf51ad0-4b0d-4439-9e11-01c6ced048b5", "comment": "Malware payload (Stealc)", "value": "233cc2340330ab4a985f698d85e27040bcd0e5c6fee536169955c126e30baded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691364031, "uuid": "4689bbd8-c998-44c6-b806-c7bc3d4c11e3", "comment": "Malware payload (Stealc)", "value": "d78c94e745522ad0a4ca3ba7bddc7507044153fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691364031, "uuid": "4023f5fc-e3ac-46ca-925e-c5576288e7e3", "comment": "Malware payload (Stealc)", "value": "98eb4cfa59a301f478134370e9d6e3d697a726b77ff135a799b9f45dc54bdaec5d62f15d27d0f4cb0baeb2314e6c586b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691364031, "uuid": "f599aa13-450f-4cd1-a09a-209eb57b8e4b", "value": "T19E54E053F6D85073D8F21BB018FA13831A36BDA14D74935B3B95991A4CB2AC8B43673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691364031, "uuid": "2c59a527-8314-441a-a4c8-aebb1242da7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691364031, "uuid": "d5aa6338-5e5c-4f36-b55c-6cc39c9c8bea", "value": "6144:K6y+bnr+rp0yN90QE4vs7dzw5ip800PK6XpqaTUgCZVE:WMrTy90qsxzzySgTiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691364031, "uuid": "738f3f72-90a7-4d18-8323-35296406f85a", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691364031, "uuid": "10e0799d-9af2-46b0-8cca-da9ef97feefd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691364031, "uuid": "959a2af8-60a2-470e-9b2e-b6d5fee3a42e", "value": "101416cedaf94b696ca97774b069c645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5b6dba-3437-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691312444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312444, "uuid": "f026317f-ce66-4baf-8a2b-441ec041c117", "comment": "Malware payload", "value": "be7ac8b5c5d0eaf7418ba603d9a6c820", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312444, "uuid": "50f49889-15cd-49f1-b0d5-bdd1c5becff1", "comment": "Malware payload", "value": "23b1deccae8a9bb164ed2596520655f7d68ef4083a3a97ac12e2c09532c71dd2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312444, "uuid": "7b629e00-d12a-4df4-ab6a-960395c2616c", "comment": "Malware payload", "value": "a044d58b5c734a4f2fc8566d8e769f8da8d8fac4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312444, "uuid": "943ce0ab-9842-4735-8ccf-42301f5e3ea2", "comment": "Malware payload", "value": "bada2b456e18aa955095e716ced75762509321593375eae5209c5eeacb33fd3c05264d9a6083a980207ee3cc0037aa5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312444, "uuid": "af484513-ac04-42f1-bf79-8f8ca2a452bf", "value": "T18CD33B2E77D98F10C65869B4C1E389280BE1B7CB7B33D7493F4562951D023E68E897CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312444, "uuid": "ad85e500-2191-41cf-85e8-f737e7a23c33", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312444, "uuid": "2205e8e7-4908-45e4-b1ca-e1d5dd7e8ea7", "value": "3072:ADnt1gszDVKc4UZLZI1bFe5N1hZmwWmkRsTaHIEZ:+nfZdKRUZCxeLYwWeFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312444, "uuid": "a9059337-3f03-420d-8a2d-de978ab834df", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312444, "uuid": "6f081808-cafd-415a-9361-a9179ba802cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312444, "uuid": "63076cf1-9fbc-426d-bf9c-e2b8d90d5cdf", "value": "out.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0cda5d-346b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691334724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334724, "uuid": "b6487751-3d38-4695-85bb-89278f8ba66f", "comment": "Malware payload (RedLineStealer)", "value": "9518fca03d63d2c0436295d4f16fbd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334724, "uuid": "7223d7a4-8eae-4f9b-b0f9-27ef6e04ad3e", "comment": "Malware payload (RedLineStealer)", "value": "23e3579264426af8e34718043ab5f2ebae5ca638c459ce74276d2a097191079b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334724, "uuid": "2fd426d8-5345-45f5-9853-f9480d09b96d", "comment": "Malware payload (RedLineStealer)", "value": "e4a7491f8dc05ea0aa7dd15153c9b52ca7d2b940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334724, "uuid": "c3ba3f23-47ac-47c3-86a8-90932ce13be3", "comment": "Malware payload (RedLineStealer)", "value": "7a6220c7d89a6b831cf0d3a3c9b71eb9ce1f52e38e4d664f489be06197c64fd3a851da7d1f0647ab824c50d926b150df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334724, "uuid": "34b0ec22-e176-4686-8894-c96bbb7f8644", "value": "T11BE47DE034C05179CEE622B70ADDB860005DFDB903B5A6C76AE44AEED130BFC6935979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334724, "uuid": "065c4537-73ed-4944-8d6f-8de6300895a3", "value": "5fdd325fbbb3f2851798fcc614fdc4d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334724, "uuid": "3e836684-21e0-4f52-9335-65b39152c7e1", "value": "12288:3MYPWPMzRHW8/OKarUdUYuCzhu+ZuAwVKsIYAJEJ/Js:aMzyUdzB2bn/xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334724, "uuid": "11c42046-cfe3-4ae4-b2b3-94d265adb919", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334724, "uuid": "56429444-bfda-4310-8da4-6a0976f7350c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334724, "uuid": "703b590b-b115-46ff-87c9-43cde92092da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1cdfed-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691311746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311746, "uuid": "a4248ded-5e5e-41f6-8c45-e8eb00423621", "comment": "Malware payload (Amadey)", "value": "b2ff1697a6a81ec9b35c0ffb45c9cde2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311746, "uuid": "a94fe5a6-de9a-4c1f-a912-b62a22e2110a", "comment": "Malware payload (Amadey)", "value": "2a3c0d7e6bddf093b92e649c51fff89df7588e835b4d16a1fd15508210b2e9c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311746, "uuid": "d8a670df-9a3b-4bc5-817d-ad51f5650f89", "comment": "Malware payload (Amadey)", "value": "d910cb1ea3b85e84970c85552afd4721e0a5fc81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311746, "uuid": "1a15deba-84dc-411a-8cd9-e4b4b5182011", "comment": "Malware payload (Amadey)", "value": "41f2df26017eb1d79e2011901d2995385fb52e11c1977edd81837961cd46759af6bc466ce12a49b0c0fa3c67f084dab4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311746, "uuid": "abb98608-aa69-46c4-bc7d-26529321eef9", "value": "T1593408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311746, "uuid": "94056247-eebf-4879-ad91-281e4ceb6c22", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311746, "uuid": "5c6f89d0-12ad-4e91-a4a0-237712c74fb6", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311746, "uuid": "54942db8-929f-4c69-9e09-cc3d74232426", "value": 238839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311746, "uuid": "20518c76-a820-4122-ace1-fe684690562a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311746, "uuid": "5da8a011-55ee-4b64-947a-dbedfe2b1f8d", "value": "b2ff1697a6a81ec9b35c0ffb45c9cde2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bca789f-3438-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691312715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312715, "uuid": "96c4309a-8c4d-4ce0-b254-ea1d47e53e02", "comment": "Malware payload (Mirai)", "value": "01203b96f66b3201f127042d1880125f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312715, "uuid": "4d48f7b3-14f4-421a-bc48-8cfe0a0370be", "comment": "Malware payload (Mirai)", "value": "2b1249850a8d83768acd3a96597af3076dc78a808216c9d2501d77876288080f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312715, "uuid": "e5817fba-c51a-460d-a881-4d399d556281", "comment": "Malware payload (Mirai)", "value": "a17c20704b6694779bc7b01bab83e0488387f16a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312715, "uuid": "67e38f25-180e-4a69-84ba-c43b8e017238", "comment": "Malware payload (Mirai)", "value": "26629b41ba10a70193afe8412e1cb4062e49373428630e0c05b2f3381c81f4244c8d5e558f84bcd2db39b6551ae565a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312715, "uuid": "de956a53-bc03-4575-aaad-1583f7335f0a", "value": "T1B1F2E1CFED553CC9C99F8E7F84A65BE0ACA0B084B44983DB37688C85D62D50B7AC8461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312715, "uuid": "7e3eb20d-2ef8-40c7-9485-307ff6a625c0", "value": "768:5V4f29fZab2eAB+2YaoT4eP0npdOOrwsMIzWMD2:jP9fZ0yeao8GydsG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312715, "uuid": "bf024693-8a63-45bf-a923-f0ca69e6ad0d", "value": 35736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312715, "uuid": "f46189fa-7cd7-4690-a4fc-8a6c1f3e3c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312715, "uuid": "5641edd5-b1d1-4c09-a9a9-2773af9df506", "value": "01203b96f66b3201f127042d1880125f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c6abac-3429-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691306162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306162, "uuid": "148a3a30-06ff-4869-9ff2-085924eb927d", "comment": "Malware payload", "value": "b896e344e5ad7d023a0e3a75fa01e738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306162, "uuid": "d9c33369-8ccf-41c1-9635-1a5bfdc7f855", "comment": "Malware payload", "value": "35e349621ddf050a9abb0ea7fa30b16c0a4dbf1c9f367eb613865d51f989b0d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306162, "uuid": "079f3122-bc43-416b-9a19-a641110ddd15", "comment": "Malware payload", "value": "88a29d65dbf228c31891f9e211f0cc95319166a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306162, "uuid": "dac24fad-eb2d-4532-be24-2a7a3b8003bc", "comment": "Malware payload", "value": "e328ad801442673abbe84a7c76009ec487c469266840ec79ce83d2bc103d53992238010f48f19f9f84c5dc7eebe43cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306162, "uuid": "435ae678-a80b-44b6-ab76-a3764d922bd8", "value": "T1E4D53303B9C189B7C0652A361B66E75A297E74100F1C0EAB73DC4E5ABB791E137309B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306162, "uuid": "d58f71b6-4008-4dc3-acc7-60e12dfb7607", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306162, "uuid": "bddc8444-84ef-4bbf-91ed-97ae94b3cf9d", "value": "49152:L5Po+v4sLe33M0zNQpfsv6Kd4W5njnFUOEVNj0g2d:L5ynfE+4ojnqOiWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691306162, "uuid": "211e153d-9153-4947-bb68-816672743a70", "value": 2967024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691306162, "uuid": "d309412a-de75-4702-83c2-e3eb78055716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306162, "uuid": "aafe5fa1-a51b-4028-a027-64f57c1c77f4", "value": "b896e344e5ad7d023a0e3a75fa01e738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24e7f89-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315437, "uuid": "9cc9d709-45b7-4008-b8c3-7a8f08e78ade", "comment": "Malware payload (Mirai)", "value": "762d60a2884fda7b4c11761dc030b3d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315437, "uuid": "671fa51b-3ab8-4f09-940a-8751413040b3", "comment": "Malware payload (Mirai)", "value": "36315d4533aefaa43139a4de1f2aafd9fa5eea48edb0d4be2258a8da5da1d03f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315437, "uuid": "190b3d34-4b63-40d6-8bc1-4f9236142e59", "comment": "Malware payload (Mirai)", "value": "a5e0fe3409366151ed0e6511d65d0d52ecb4ce73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315437, "uuid": "810b5056-d7f2-498b-81d5-0d1164efbb10", "comment": "Malware payload (Mirai)", "value": "15c01eb74f5596f7ddd394bc806eed557f6ffa5dea9da01b209bc9f8c121ae7d4f508a29be1a9dff6d1432d97debce0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315437, "uuid": "2ff3f215-d90e-43a7-91e3-ecc88047ff00", "value": "T1BEF2E10C1D287D6FCC9D1E7C4A6709754AC4F5C0A86AEB4D66A4EC81F23D46FBA48CA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315437, "uuid": "5b28b977-2446-473a-95d6-4283eb4d17fb", "value": "768:BhRlJyOa9KS0GaFCRrSvsgX2RXcz0lCafu1/X3OqnEaWMg:BrlJyUatMzL/XdEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315437, "uuid": "7df93f27-b263-4aa1-98cf-9fb916209119", "value": 35768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315437, "uuid": "a76ac4c4-e52a-4deb-bc63-23072c49e73e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315437, "uuid": "7cc58081-8ad3-4a52-9ca2-f6a583f2bec2", "value": "762d60a2884fda7b4c11761dc030b3d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66dae3e-344c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1691321511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321511, "uuid": "0a447999-4297-445b-9b15-5ffa75b62a5c", "comment": "Malware payload (Havoc)", "value": "6fc6eb3ed2366b85dca354e44e956a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321511, "uuid": "c4c99f3b-8946-4848-8577-bbd709ced624", "comment": "Malware payload (Havoc)", "value": "37a6ef95815119e73613aa856f88a70ace7ce8dffa6e0b131b6f148f2dd37fc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321511, "uuid": "11bef2de-29e4-4a11-9489-51181f6633c0", "comment": "Malware payload (Havoc)", "value": "1ddba497b22b04fc824204384c64ca7b9de8c38f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321511, "uuid": "d9888a44-f348-4de9-89fb-e675c180ae6b", "comment": "Malware payload (Havoc)", "value": "e1e9b756438f188cdb8c5f84445761f706a980de4ae0e01142876aa813035a9efc46208dc7b43c4128a74f805023c48f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321511, "uuid": "7dcb9911-b56f-4c2d-98c0-d1a35dcd72ed", "value": "T12D93C806E1A330FDC5BAC2754B8FB632F9B6F45C15341F4A5B20C7092F61BB1662EA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321511, "uuid": "7b33deaa-4c8e-4432-be65-d568d688fb87", "value": "768:ubgyYWldBM19THIh9TxzGtZ4o+BGwC6M6IT7JAD14lthdxALrCPx1VskZhba/ejo:TyZ4THI7QQy7J84JACjZpbdHQz0Pshr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691321511, "uuid": "ae58c311-b010-49e3-a13a-98f61272454f", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691321511, "uuid": "4b39b53e-f015-4d4c-b584-3220bc1d0e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321511, "uuid": "aa01b0dd-a8b0-45b2-bcae-8f913d6e078d", "value": "SecuriteInfo.com.Win64.Evo-gen.13677.2152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3de01e-3445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691318323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318323, "uuid": "82dac39b-46fd-4c67-acd9-5f6215bba9e4", "comment": "Malware payload (Mirai)", "value": "34daf5a306f9c1e300bc354b01c0fdd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318323, "uuid": "65634f43-1e09-40b4-8aaf-bff245da5817", "comment": "Malware payload (Mirai)", "value": "3c05fbab239c62cccf7e75c6a650620a1a51276b1665b52b59467defc9aa0cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318323, "uuid": "d2eef900-2401-406f-9c9f-93293b4e9c92", "comment": "Malware payload (Mirai)", "value": "3ba939569b1e60987e16052315d9a780d5163e60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318323, "uuid": "1a8674d6-07f1-4c4a-b3ac-26a256d88e75", "comment": "Malware payload (Mirai)", "value": "7c5f98a81fb02c80c91cf2aadefb31547067a77902df6f2d542e1ae7a65a8d9b363a1bb453ae5e7efc29b693785e805a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318323, "uuid": "ef129261-c7f7-4c4c-8daa-a5c5024f1b6c", "value": "T19CF2E163121DB939BA711939FAB907453DCDCBE676DE2513310009682CA2E4797DD1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318323, "uuid": "69d838db-12a4-449c-8cbc-65f6226a22eb", "value": "768:EHinV8dc5aFTFBDDJv6c3TR3SayB9q3UEL5G:oeGLFhBDDccjRiMLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318323, "uuid": "d4b65c26-e312-4c76-b1e3-acf9e949f50d", "value": 34500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318323, "uuid": "c7ca1419-a271-41e9-a2b2-dbae214ce9b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318323, "uuid": "0c25ed82-4b1d-4c4c-8334-11dc00c69026", "value": "34daf5a306f9c1e300bc354b01c0fdd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcc8ad2-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326701, "uuid": "cafd56fa-904e-43f4-8d8b-2e664a6b6e9a", "comment": "Malware payload (Mirai)", "value": "bdbce4e171ef4c26d160f0f88e64bc44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326701, "uuid": "9b0bd37d-c393-48e0-8c6b-c053fd91413a", "comment": "Malware payload (Mirai)", "value": "3dd8b04013b3c464b86701266c039e893ca38e9e956d4e88ed0acc57d1d32b1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326701, "uuid": "6ed22b74-1626-4b89-9e8c-58827e892c26", "comment": "Malware payload (Mirai)", "value": "2b87cae1134a574402ff8aad375ebe6e69ab7ac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326701, "uuid": "821475f0-dbee-4d46-92fd-e1e0ce32509d", "comment": "Malware payload (Mirai)", "value": "e82d3eb7d3821b1f0214e6e00801c01110126532b417fb192ae0fa583881511dbf7e88c024df35fe2bfad7af427a9446", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326701, "uuid": "dfdb6d1c-b7e0-465f-b11a-7712b3795f09", "value": "T144E2E1575721D8A2DB7879F1DC804BCB1BFC1FACD8B9F0A1881146546EB74428FB82A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326701, "uuid": "e70f7d12-3a60-4855-85d3-cc35cb8c026f", "value": "768:OoiWiO031vpAPbrVWZK3SqL0xgHgfOLFN7hUdWwrY9q3UEL5In:Oorm1vpALSGQEXLHOAULc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326701, "uuid": "fee8a7b9-d844-488f-9baa-667a14614620", "value": 33004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326701, "uuid": "f187739c-55c6-45f2-8c73-101f17e0cfff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326701, "uuid": "163e804c-7e54-4935-8493-8546a67eb391", "value": "bdbce4e171ef4c26d160f0f88e64bc44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fcd9cc-34a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691358605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358605, "uuid": "53516a70-31e1-4fdb-9606-998c3c70c5fe", "comment": "Malware payload (Mirai)", "value": "2ff18b9ee77ea63d06e4d05faca531a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358605, "uuid": "f1a16a4b-898b-4c02-84f8-093f063f3676", "comment": "Malware payload (Mirai)", "value": "3e9b65856dad5f94bb818c056bbc61f483831ec2d7f9cd800f21aa1ec272a1ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358605, "uuid": "7454d24e-6734-4433-8e32-078a4ca22ab7", "comment": "Malware payload (Mirai)", "value": "d2a0cff243f5d1ffc729bab7ad08c2080c4b4b4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358605, "uuid": "824b47bb-ce40-4f66-a968-5eda375f5bad", "comment": "Malware payload (Mirai)", "value": "b4d0a2cad1482d7cfb02f57f608d252d4d01757417b07a99560d98692b2ba77db43911b65060339cf415777faac7710b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358605, "uuid": "23975042-5714-4a21-8f4d-3e2b2696a720", "value": "T16D244B82A9418E23C4D617BBF5AF018E3331A7A593DB72068D245FB437C6A5F0D63B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358605, "uuid": "70c40585-d9a6-47a0-bfb5-5e3f9f81b99a", "value": "6144:rmGtrOMBv2z3wBFS5Ng/8w0svZvzNwqvR72xLV4LR/KK3WbM/9hHT:rmGtrOMBv2z3wBFS5NFGzrvR72xLV4LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691358605, "uuid": "30363c9b-d5ee-4a2f-958c-94b64e40650b", "value": 216287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691358605, "uuid": "0a55b0f7-01a0-4658-b1f0-fb06b7387645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358605, "uuid": "d64c36c6-1dc0-4959-82d2-a6854a7e820d", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f485b6-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315449, "uuid": "20626a3b-a11e-4efc-b22b-2131f6ad8095", "comment": "Malware payload (Mirai)", "value": "af79c7d29ea942aa8d9f610cf8485edd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315449, "uuid": "668c3a90-91cc-4607-b546-849861471d1a", "comment": "Malware payload (Mirai)", "value": "3f677f756c467b6fd70f45ce5de3e8cf53ccca5fcd24a850da36cc9a328bd07f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315449, "uuid": "fab6fd7d-7d41-436c-bbef-0a0c59eb5652", "comment": "Malware payload (Mirai)", "value": "b9487921763fa510939bb73af322770d2c0717a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315449, "uuid": "d402402d-7c45-4323-8ebd-e44199036f22", "comment": "Malware payload (Mirai)", "value": "3d9eb708adb67a83602fc2cfa05ab3a83b953e33c6d2424c92c116247e6314576ee601bf844e94ebb27fc72c164de8b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315449, "uuid": "864726d6-fd44-4a8e-954a-3a6e39dfcaff", "value": "T108E2E131E5824431DAC40DBCB0AF990272DB4229ECD973D7AF144A5A7FD7242236BAD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315449, "uuid": "12b7c00c-9cd1-4d7e-8282-731dde40903e", "value": "384:ikqJhSYakjKDKxfwnbg4Kx8ZxzgoYWEAjPXEHATBV8S6SzNtju2I+ZlMeemdGU5r:iC9kjXEEVxmxzgoU4PXEIP5Ju/ee3Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315449, "uuid": "3a6f52c0-2b7e-4333-89cd-5a52ebbf96df", "value": 32232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315449, "uuid": "d0ef4145-c1ad-4632-9f6c-af5daac16e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315449, "uuid": "1958e179-c754-4fda-a77a-251316480fdf", "value": "af79c7d29ea942aa8d9f610cf8485edd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699d41f2-3438-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691312738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312738, "uuid": "c4e7e43f-15b6-4410-abb7-5c30877fa59f", "comment": "Malware payload (Mirai)", "value": "ffaedef4a3b0acbbe6b549c6091848fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312738, "uuid": "592db488-6ae1-4508-a861-887fffab2358", "comment": "Malware payload (Mirai)", "value": "40540921fe263ab76c34398ed2930a8668bd7447c7783dfa0ce1f000d82c7caa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312738, "uuid": "08ff8e8f-bce3-4992-8dab-3011abbe17ee", "comment": "Malware payload (Mirai)", "value": "4ba53ad12dc718b2f5278f54b8508f7f66c2f8fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312738, "uuid": "588d7691-303f-41ad-8de1-ec4c0e249c61", "comment": "Malware payload (Mirai)", "value": "5855c6eac75446084603512e73a5f9a6a9407ff5d8c6069787fb03b0d8f434689dadd262f8cecf83989412e617b87ec8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312738, "uuid": "20b5d800-6eca-4541-9528-733ed8f06163", "value": "T148F2F1602B08FBA6D9D04E7586BE4B027955CFFBD3C5FCCE016563AC0784A8523A5D23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312738, "uuid": "58937456-2b29-4dcd-8d6b-a145163e4fa7", "value": "768:mCBXeF0g0aS7nqvwm8b6pBUJzCrTk/tRj1cdgcrf0q3UI8b:BBM0gI7n68b+Brk31cdPrjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312738, "uuid": "4b148929-0886-4afc-bf1a-cdf2653f3e4c", "value": 37004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312738, "uuid": "54400ad6-4829-4875-80dd-55e777978b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312738, "uuid": "89525679-6955-48c7-9590-6aa993c736ac", "value": "ffaedef4a3b0acbbe6b549c6091848fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9925b91b-3411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691296068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296068, "uuid": "56cd3fb1-e026-4705-972e-f8471854dfd9", "comment": "Malware payload", "value": "9db32edb9bcd89cd6b1fa1911bce62b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296068, "uuid": "0325696b-aa1d-48ae-a822-aa47f7bc9a11", "comment": "Malware payload", "value": "407d8929a9ae8ededf1644ce803f18718607c64f3080db6c05d466d6e52a4bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296068, "uuid": "8089429e-7969-48e4-a452-4835d4e982b0", "comment": "Malware payload", "value": "2f677cd6746b3805f2e0fa315fa415c74e29f576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296068, "uuid": "1e6bb3c7-e1d4-46f1-947c-6a24e6c3f58b", "comment": "Malware payload", "value": "61ecd502d0adfe5d02011cc25ce0d9ab44c2122631c095ccce6712f49cd1b422e68926e71ea8adf2cbf5ccf6cb82d090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296068, "uuid": "229d4c94-8840-4eb8-bd77-61e04bd59c69", "value": "T1175366697E21ABEEE5AC82314BF75E70935922D236E19384F2ACC30C5EB024D585F7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296068, "uuid": "9dcd1abf-5a11-4e26-9499-bb72a884417b", "value": "1536:uAjyHTRJg1vdjzC2Wb8qVmxm3LawK0TU/iEcftA66e8jVcW:HZ4EcftAFVcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691296068, "uuid": "4bcf23ba-5246-47f0-83fc-7f1033272160", "value": 66040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691296068, "uuid": "9414ef7e-f11a-4c42-8257-f92ac54d1cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296068, "uuid": "d6b2ed83-e127-41d7-ae39-08a350b8a6bd", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.11803.4183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02bd059-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "ade50c3c-edca-4050-b328-affac199a1b3", "comment": "Malware payload (Mirai)", "value": "776cfd601451a4d25e9bd2740dbef3c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "fe94419b-8167-480b-aedc-b1d8b9196ca3", "comment": "Malware payload (Mirai)", "value": "40baf91304ca5c68dfc95bfd47d7ab1e0e3b1d44274bdb370b411ca5924ce8d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "e3a10c71-85be-400c-9988-89beb55071b4", "comment": "Malware payload (Mirai)", "value": "a9fbae9700f4f1988147906886a8ca062a1b521c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "3b2c48c7-564e-42b9-9769-a636514e741d", "comment": "Malware payload (Mirai)", "value": "9c6acd9c104f94cbf2495bc13127a419fd14ab83371b5e7a35c5b6930d3c9a6ada444c3cdf282c47eab6ebc5d4f02933", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315407, "uuid": "e9502ae0-d3af-47f3-832b-f29389db96e6", "value": "T14CD2F12661F6CA82D5A00E34FE388EA3315F77B984F7327015C42E7CA9DB466113B0C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315407, "uuid": "fd64da6e-383c-4de4-9814-794ecb2b3774", "value": "768:/ep0S9iolLd60JjOxCzvemYBfyL8ZOiTs3Uoz2:IDiILI0Jj0AvTdL8wBz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315407, "uuid": "9d68f24c-bd52-418a-ba84-89532d783a56", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315407, "uuid": "1d60f8cb-d030-4c41-84d1-acf4f996dfb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315407, "uuid": "7b124783-15ff-49fc-b826-eacfb51c3f79", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a59a7c-3414-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691297404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297404, "uuid": "bc98996f-2270-4c5f-b86b-faa74a0a66d7", "comment": "Malware payload (Mirai)", "value": "a8f564f701f2d391455e743539087628", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297404, "uuid": "e0b52735-8739-436f-ac36-72a8c1bc06bc", "comment": "Malware payload (Mirai)", "value": "445a8cdf70bbab55e898a2b4f8b8e36ccb49bd5996807152085cd96b96a65c7b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297404, "uuid": "604d4ffa-04a9-4a62-9bbc-cda4f233f85c", "comment": "Malware payload (Mirai)", "value": "70bbcfa2716c417c168164733ba9b6343fad2b18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297404, "uuid": "5ed80914-1d65-4d92-8f05-9254fce13fc3", "comment": "Malware payload (Mirai)", "value": "8c7343a2be0d20d073549a0561d31f869605b65a0da9739807f572cc5fd1f66418c98f01fe44e72ef1e81a67d6461237", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691297404, "uuid": "9b2063ba-53e9-4f2f-911e-d3865a5a971a", "value": "T10EE33A56FA818A13C4D6177AFADF42453323AB5493DB33068928AFB03FC679E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691297404, "uuid": "675984d6-4870-4447-8fc4-276657645ecb", "value": "3072:JA94Ts84h04s2/aw1I83nIQzcHuW1qLpbX2fCM/9BHzmEupk88:694n4h0E/aw1I83n5zcnmpbX26M/9Vm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691297404, "uuid": "29d408da-1cea-42b3-8810-8d640ab83003", "value": 155398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691297404, "uuid": "5ed109bc-813c-4c3f-92ff-0477ffe653f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691297404, "uuid": "5268f78a-d28b-4251-ab29-59cf17809ccb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3938ac-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315431, "uuid": "54695de1-d912-40c5-93cb-c19fccf81e75", "comment": "Malware payload (Mirai)", "value": "cf7dd0be80a1bf87972481d9c36a09e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315431, "uuid": "a5c9c2e6-3894-4a0e-aa29-efffeac233b6", "comment": "Malware payload (Mirai)", "value": "4482fe07602e6a2b528cd31cadf8e5ec83daff19df4c99fafc9cc915850c202b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315431, "uuid": "16a738dc-5073-4e0e-8ad0-9c85a5eb8582", "comment": "Malware payload (Mirai)", "value": "2fe732edffcf3a945f4baca7d9f2cc41cfc9edb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315431, "uuid": "52c80265-277b-4eac-8e33-ce0315e968da", "comment": "Malware payload (Mirai)", "value": "6d560e7259fddafcdbb05f51eaf03d5226c7ce738cbfcf001341aa160b164fc648c3fbc93ccd6cdf4d904d0e3e23804d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315431, "uuid": "ba53d35b-249c-443b-97e7-f35ade5e6a58", "value": "T1EA4302F097D72B9686A20C78F87B0990530B273DF1FD7C2A66C5038A6C401816FE65A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315431, "uuid": "3042c755-1e3f-4558-9d06-e6f31e8f893c", "value": "1536:JbKiFr7cWCN3pIMomoXXpUkZiYCuDPWVvyttGUEAB5yg1pIfXWk:Jbph7cRNa55UkXCuDegttG85yuWPWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315431, "uuid": "2c8fef5f-59b6-4041-a5dd-bbdec4eec873", "value": 57420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315431, "uuid": "e1e112c9-509a-4b7f-9e0b-fa32edbb996f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315431, "uuid": "b24a80d8-0bdb-4ba1-9fcd-655d79f5b30d", "value": "cf7dd0be80a1bf87972481d9c36a09e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278702ba-34b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691366315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366315, "uuid": "47d89ea8-e35c-4991-a583-8639b2c2d87b", "comment": "Malware payload", "value": "88c9b0ee5abc5416849718ec44a611cd", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366315, "uuid": "56ac4d21-9145-451d-ae03-908bf1551ec4", "comment": "Malware payload", "value": "45aa359992abaeaa1af1583057259479c55623f62c264b2fb703751b8ab08b15", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366315, "uuid": "79418280-6241-46e8-bc93-36cd25feb7b9", "comment": "Malware payload", "value": "731b6d7bc401ee699a68ff2898122ca685c9a1f0", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366315, "uuid": "27fa8471-0339-4001-886f-692225ed4266", "comment": "Malware payload", "value": "dfbe08e199ce2b4015331bdbfafa407dd6a5a752f490abd1e5ec06b04667b6fe77b13d6e2ea50b78ba1cdcefb237aca2", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366315, "uuid": "78ac702d-574f-404d-9d87-9cfe558a4c6a", "value": "T12EA533134B329EC4E423317B6CD57930FA6D9236B9627E7CC25ACA8720D9DDAC96CC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366315, "uuid": "c4767aec-f21f-4e91-bd97-177c0ec4db84", "value": "49152:OcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKncjznXe:OVtEgPdiERqpWvMOODPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366315, "uuid": "37ea611d-b38b-4db2-9228-649df067a627", "value": 2190801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366315, "uuid": "4d2e02f7-4638-4701-985f-fd7f233d7d98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366315, "uuid": "8622cc66-212d-4588-937d-a609d4c9c8c8", "value": "intensify.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5addaf2b-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335477, "uuid": "f13c5856-52f0-4da9-99a6-c044db5f9fbd", "comment": "Malware payload (Mirai)", "value": "1e43e06ce9a3515d7959433f08b3c7c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335477, "uuid": "a25bdb04-80a8-4e16-be07-df98d8aea822", "comment": "Malware payload (Mirai)", "value": "45cfc853d86f134e618594fceae2ec08b0be460a451c8562fd9de552df33f21b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335477, "uuid": "897a05bf-9a16-49d1-b25e-43f92622f203", "comment": "Malware payload (Mirai)", "value": "d7ed270eb6715585d79b69af0d6fad986811c830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335477, "uuid": "c6dcf4ce-95b7-4dc3-a772-d70a32f8d9c7", "comment": "Malware payload (Mirai)", "value": "52419936c9c8a0c73e1340c012e8865d40630e71cdcc2483a4705ea03100f3679eb147225d1316f8af0574c7730bdba5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335477, "uuid": "8485bbde-1de7-4f32-ac93-2662e4a8c59b", "value": "T187D35A73D8296E68C564D5B4B034DF792B53A69181472FBE29BBC2B48083CCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335477, "uuid": "a9b08656-a0be-4197-965a-5a5b9540775e", "value": "3072:BWw4gIbCVFmeFOKxtu6aDwxuW7BAg8RDc:BWwb3VQecKy477t8R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335477, "uuid": "0d06d8ed-4e76-4214-90e2-6c7fc6db647e", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335477, "uuid": "2675f7e7-3cba-4dfd-a8d6-e4d66657a29b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335477, "uuid": "bc4e40fe-fe60-49ad-b992-adc06f4047d0", "value": "1e43e06ce9a3515d7959433f08b3c7c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43f1d11-3457-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326205, "uuid": "36af5fe2-c6ab-43f2-8059-76108eb28295", "comment": "Malware payload (Mirai)", "value": "02a5d86d848a0c6971127e8e81062122", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326205, "uuid": "50597956-ebe4-442b-b335-d4e8d24c3813", "comment": "Malware payload (Mirai)", "value": "46be6dae79228ed400093ec805a52faaee1822345176ecda194b370d691d2682", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326205, "uuid": "73a73baa-f884-41ff-b549-e9d7c2865fa7", "comment": "Malware payload (Mirai)", "value": "690e713ba8cbf3fc6cb81d30c25115d37340c7f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326205, "uuid": "e2d1ed40-d13d-4621-a2ef-52ced954b360", "comment": "Malware payload (Mirai)", "value": "e0110a09856163abf59d5f17ca1dda2765ed6069364c7765ccc4e4c2bb54b76a5b0008ab592cadfcdb358acfa237d240", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326205, "uuid": "38a82c33-d6fa-41b7-9fac-f7569011a493", "value": "T1A2C2F1FDB4AA27B6DBD9963D4032C8271052F42B773E470B73819037B42A0743E259C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326205, "uuid": "bc7853d9-4c1a-4329-bde9-a9d5e42f66ed", "value": "384:M6tMV3mOKFPNqOB7tJdmZICSe3oECHjYlQ2NnE+51u0SjmqHdnSpTXmOQxlqBOMB:vMV3KqOB7UuzDz+NoXm0BOhBZE2l0N+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326205, "uuid": "984e0451-5002-4591-9f0c-701d1fef1779", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326205, "uuid": "b81b3dc7-c7fe-48e4-83ab-3887224ac13e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326205, "uuid": "397187ef-b1b7-4792-a095-0b38ec0e008a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a11fbf5-3489-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691347421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347421, "uuid": "9714e752-9c22-460c-92a5-64b2a83a536d", "comment": "Malware payload", "value": "bcdfeb4cc827cc5c62b35186ff2b4a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347421, "uuid": "2c2818d2-817c-4994-8442-3d3ef7e17c18", "comment": "Malware payload", "value": "471b06245c7acbad1acbb262dce5167c614099a84a2751281a069cdbd64c072a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347421, "uuid": "063fd8c2-fa2a-4bb2-a248-ae65d4ebeb80", "comment": "Malware payload", "value": "cff23a7ee8e24b73d0d1b8f9c15cec95aa2a4d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347421, "uuid": "650a6e44-8315-4945-be24-4384b8dca9de", "comment": "Malware payload", "value": "6eefaedc6030c338f014f71f14a1592fa8fdd75341810af25a47c4b9d9192908d73a48df30e4d13c811418aa693a0061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347421, "uuid": "4506b9f2-9730-461b-9f8d-5d5b1747193e", "value": "T116A49E1352A37D50E56ECB76DE2EC6F43B2EB5908F19375A32289B2F15B01A3C673205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347421, "uuid": "d4606618-a9dd-4c26-b3b3-8b341533c2fc", "value": "13af6b3f8b2cc343b7a99f8ff279e770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347421, "uuid": "78a78195-94ec-4336-8e76-da7922e3365c", "value": "6144:s3VLDqThuUXgrLbglCkgSpSqYjoo/dpzGL3an0O:sFLDuBgrLb0DpSqYjdpyba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691347421, "uuid": "8a526a88-f185-4060-ba0a-0f772fdc5194", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691347421, "uuid": "11d29d24-c77b-46b7-94c9-07f262ece500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347421, "uuid": "28a0fb10-1c33-4ad4-92a9-dff2687bf884", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9888fb9c-3411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691296067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296067, "uuid": "38c0737b-9494-4f06-a869-523fe94b97f3", "comment": "Malware payload", "value": "8324edc95b35a45d89247112594ae742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296067, "uuid": "786d12cf-0c4f-4950-a2b2-ba7f6f0fd7a7", "comment": "Malware payload", "value": "48f365f5c5a7acaa5bcf3dc1d50582570a6cc7752f9578e5ae17fa682f740c2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296067, "uuid": "020ab349-e11b-421a-a0d1-35ac284202fc", "comment": "Malware payload", "value": "7e662988498d77725d88fd19de2d851083fe5a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296067, "uuid": "64d41513-f212-4809-8904-da9715154131", "comment": "Malware payload", "value": "f5dff2fd553626bd26aa35e8752e4245889951729847d127bd6c384e9144392c2880657f3ff9ee38c5b157d4686f23d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296067, "uuid": "eb422654-b103-4371-9f32-d345e4712e45", "value": "T1D113E988FD58631AC7D172FBF70D03CE773B0768E3EA72169A355B6133C6A651A2A110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296067, "uuid": "e04f730a-fa90-4796-a948-85d3920b04ae", "value": "768:9Rc71emFTlSP0o1zsceg7GsTC4qML/VNSY8UYgl1vAtI:61foh9dTG8tLN/8U1lKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691296067, "uuid": "29e689ab-22c9-4124-8f1e-6727fc5e4349", "value": 42308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691296067, "uuid": "acca1fb1-5c4d-419d-be33-b3d21fe96be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296067, "uuid": "292f323f-30fc-4075-9dd8-fb8ef5408d78", "value": "SecuriteInfo.com.ELF.Mirai-CE.22305.9257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9d6ff7-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691315460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315460, "uuid": "09f0e1f5-e9df-4c24-af88-29035fc9065f", "comment": "Malware payload", "value": "d52d49b127a304d042239dab5add02c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315460, "uuid": "499c9e9c-770e-4a8d-863c-07729846afa8", "comment": "Malware payload", "value": "497e79b138dd61f9f9b1d223ec0a76fa5ef93efff423cb96dc42ec8ec1cb9c69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315460, "uuid": "5d3ab618-6f6e-4c74-b54b-05a232f2bcc0", "comment": "Malware payload", "value": "97f2ba17867fbe0583a23afabf92faa2ed46d9f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315460, "uuid": "362dbc22-a44d-4c57-9c9e-5f73e317fd95", "comment": "Malware payload", "value": "51f20a6faeca196e039abd94efc08ae9ed05b953e40d04ce2e04ad25e9423dc4c9ed959d54101d7baff15c1be336f843", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315460, "uuid": "cc97349f-31d1-4a39-86f3-b244d9564174", "value": "T13123F194F4EA8C71DB8B0EB254995FC22BA31FC60E80D87905680B4D4CA58B3BF1D6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315460, "uuid": "99c93bda-6102-4975-8ef8-3fa11daba578", "value": "768:ySq176cBgL1Hrb8XwLbjqkWWknWaf2tkc42hbfToEkw4Ton12NFOu6Kr9vzjgUh3:yXBOL1HrQXvWdaf4kc42hblkw4T2yOox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315460, "uuid": "ae9d1ede-dced-44fc-9fe3-b3457627b720", "value": 48556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315460, "uuid": "719e4ad4-9a86-4da4-a8ec-5cb29b50888e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315460, "uuid": "13b5c826-ef28-45d2-912f-2bda008a174e", "value": "d52d49b127a304d042239dab5add02c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd87dd82-3435-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691311698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311698, "uuid": "10f9efbd-624c-4d89-9424-ca792c71708d", "comment": "Malware payload", "value": "3314cbfbd906c3f407388544d1f536f2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311698, "uuid": "3a967bd8-5d43-4820-ac3d-7434edab4e37", "comment": "Malware payload", "value": "4981af2bd01d0389723d12cfba4550be4ee67257193caa813271cb539b6decef", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311698, "uuid": "78f93a06-9a4b-4bff-b8ae-78d7f310eac6", "comment": "Malware payload", "value": "093912c8bb75a77aa588ca510005e6755f2e3a82", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311698, "uuid": "ccf23717-8388-4a29-9b90-e3de558b1559", "comment": "Malware payload", "value": "a378e20d3eb9847e8efdfebcd6afb69810760d9f88a5eebe547df2e5080e8f0f7b4a63a82b27d132c079d01e9cd0a61c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311698, "uuid": "0146f789-7702-44c8-bfdf-ac20f3d27989", "value": "T142D42334157880B69A822C7DBDCC779C5209B63A35F1F1AFBA1304C258BC8663E9FD59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311698, "uuid": "2996153f-f336-4e55-a624-4f1f91c31b5a", "value": "12288:vdnW9Grqb9PfVVVjSfd1EO4cpSD5b+SP3ueylqi+0VR8W/UgkCm5dm+1m25tL:l5ry9VVjod1EO4FD/P3ueyrbVRjk15dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311698, "uuid": "65732b20-1005-462c-a79b-6ab0ad1b5d5f", "value": 640802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311698, "uuid": "121c6693-f80e-4309-b5e6-f32ed4f1acde", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311698, "uuid": "f61ff1a7-ed1e-48c5-b94d-8f12abc05659", "value": "DGSG677286-SGU.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbca693-348f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691350108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691350108, "uuid": "1761fc8b-9244-40bc-ad2d-e0a326f47530", "comment": "Malware payload", "value": "852ff80412b38f8c3f9255a1a150676f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691350108, "uuid": "eafbf0fb-1efa-49e7-add5-1d1bff3b9e7d", "comment": "Malware payload", "value": "49f277844fc1846ca8eb0a305a333bd0b54a8af9652b0b877a00650bafa5ea38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691350108, "uuid": "cf3ce9ad-78dc-4053-a80c-9b92ca751d38", "comment": "Malware payload", "value": "0856eaf7340d71f50f90813c5677eb4d1aff78eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691350108, "uuid": "d7759c76-08e3-4b74-91fa-5d6b426d3443", "comment": "Malware payload", "value": "25a2264f86c28126ebf1a53437aba859789aefa22aba2607e7eda2d3acf32a54a57d594cad20a4cf9c3c0387f19372fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691350108, "uuid": "df9329a5-1147-4513-b412-d394d290cdc9", "value": "T115B2D1285F4000C9DAA2D4B06DE7039717A40FB6E553EC5FA59BEA875EC50BD3483BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691350108, "uuid": "237409d4-1b54-41c5-8bd9-396fa8b1db13", "value": "768:N+ra3G+LBdRJ4e7Z1MEtuswJgGlzDpbuR1JA:N+GzdRJ4eAEtuhVJua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691350108, "uuid": "94401b5d-cf99-4ce1-a751-178a50764233", "value": 24720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691350108, "uuid": "553ae59d-974a-4ae5-9418-0d42f22d9c20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691350108, "uuid": "de43b2ae-e121-4c98-8a87-3cd655ab030b", "value": "SecuriteInfo.com.Linux.Mirai.2001.19678.11359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fa0e4a-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335501, "uuid": "25bf9ffb-cde3-4ba8-b14c-f93aa258866d", "comment": "Malware payload (Mirai)", "value": "f272d0dd23ac42303cdddcfe4df54aa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335501, "uuid": "ec923c7c-09c9-43c0-a82a-339ff8208355", "comment": "Malware payload (Mirai)", "value": "503a6e977c8fb68ffd015b1f882acdd9f90b98612dd41b676ee08ff10c7d0a90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335501, "uuid": "dd6e21fd-e57a-492f-a12f-dc11f5a7e448", "comment": "Malware payload (Mirai)", "value": "41be6c80c5b261df3f60f68f2c28a86da521c949", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335501, "uuid": "9b1435f0-2c0a-448e-b3e2-f14c93eda6c0", "comment": "Malware payload (Mirai)", "value": "8ff14cc8d90ad3ad46b696d810545d7240263806daefc4476052165db9572227ac417bf9cc7e8a418f66722640050bb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335501, "uuid": "5377a88d-2c2a-4bd7-9c3e-84ff58daecd5", "value": "T1B8E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335501, "uuid": "6af561f6-2e79-41c5-bd97-0d4ab02e78d8", "value": "3072:JW6dm9tS1aRGQdK76t/zCiI5mrThPaLEnvPrNb:c6IG+LCjmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335501, "uuid": "6aa9456c-9f4a-4af5-ab2c-754604228d98", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335501, "uuid": "380dfa35-8438-4a9d-a427-d44ba2d54fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335501, "uuid": "512e804b-e099-4160-bc74-3454205a8745", "value": "f272d0dd23ac42303cdddcfe4df54aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab38890a-3498-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691354080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354080, "uuid": "c81ebc3c-ad1a-4f74-ac82-f115a8f9ff27", "comment": "Malware payload", "value": "f70b008f793feb2e2d8b1285a5bfa38b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354080, "uuid": "621e5e18-39ca-4972-8ebf-e0b7d24e5651", "comment": "Malware payload", "value": "52b2b45ea5d9d4871a9447c0f379ac85704447de2007b54073af0c30f7fbf488", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354080, "uuid": "bdbc9965-043a-4814-952f-29c733d67f15", "comment": "Malware payload", "value": "fb421a36933f57c2cff7bd893a1a7895af0b49fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354080, "uuid": "4264a476-b99f-46b5-b2b2-501850fb5c31", "comment": "Malware payload", "value": "1237894cb4c7c05c49bebddecd7368716f18cfc8007e778e6f4d5bd8e8fbc2bd8647025dd6c915376c66fd7877384e00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354080, "uuid": "a31b0542-0027-4c3d-a5da-d91f7e3c70ac", "value": "T1E735AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354080, "uuid": "6bfe3daf-4829-4d1a-9f48-77e4b8ff9b60", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354080, "uuid": "23596350-0267-4e6a-986b-7c4a7c272287", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/fRPOO8GvHUq7:F0dwAYZt6C31WeTHRPOhGPUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691354080, "uuid": "f3bcde8a-b3d3-4f4c-93f5-67ecdedf45f5", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691354080, "uuid": "26753b06-3861-46b1-92f1-a8724fc7a69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354080, "uuid": "8edea90c-2c47-4251-8f1f-951e84c34425", "value": "2023-08-05_f70b008f793feb2e2d8b1285a5bfa38b_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5259add-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691315442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315442, "uuid": "b5061d30-1f80-460a-bd64-521b1e00ade7", "comment": "Malware payload", "value": "1cce29ffd77292915e3a1c37531ca69b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315442, "uuid": "4d802c9d-2cd1-4704-b8b8-ec2d2bbb0c70", "comment": "Malware payload", "value": "540cba3ad79a126ea6d2a9cc57b7542e56bff1c28cec6140a481abea94c1855c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315442, "uuid": "350b8123-b4cd-40b0-8dc0-5636ffba5fdd", "comment": "Malware payload", "value": "a9af6ca2761df7d282f8cf98eee4e6d888c3d91f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315442, "uuid": "3375a6c0-9420-4c8e-95bf-be249b83bbfe", "comment": "Malware payload", "value": "6fd86431edf698da865700b0d6fccaa5e371053ac1201bce8f29a69d1b78aef17e6c6793478192a3825f2dd693423602", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315442, "uuid": "b5d187fd-6b8f-428e-9c14-70ead94a1c14", "value": "T10843F163C806C768E7A36939D58E410732642378F5E8356CE304AEE5EEDA518E6AB470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315442, "uuid": "ebdffe76-7188-4ff4-a139-16625ab58c13", "value": "768:hut6h8SbFzNBRym3H6wDjA5+8/MLn50RsH7U7QjXredtULE7F7s/gYcC8i66q3Ux:huTSb1TRl3H6wPa2H5jyYm+/cQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315442, "uuid": "d1db759e-796b-4e78-b636-28e2a3096713", "value": 55676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315442, "uuid": "1ff63b4b-a2b3-4561-bf81-deb06461e331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315442, "uuid": "011566fc-0241-4222-b18f-5b12507d6000", "value": "1cce29ffd77292915e3a1c37531ca69b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c31cd89-3479-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691340606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340606, "uuid": "76ef7876-9ffb-4859-af5a-cf13595878da", "comment": "Malware payload (Mirai)", "value": "45c24f5f9d6b02f6460f112085574696", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340606, "uuid": "cc027ef6-0c67-4f5b-afe3-250f606e6e94", "comment": "Malware payload (Mirai)", "value": "549858fa11ad7282a88e94b9e0660fcd4f2df6ecea8dcbd5684ceb322e22136e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340606, "uuid": "014db4f9-b7df-426e-bf82-67c0a4e3ac95", "comment": "Malware payload (Mirai)", "value": "39232a93e62d486b2c08027087e13d14caba1113", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340606, "uuid": "5cdf5f1a-267e-456b-8d67-b3eb153cdb6c", "comment": "Malware payload (Mirai)", "value": "0d75e1a691868c5a79ebcd45c89415b901c917f4c95ee4391e8789432142ea07f3291efd169e4188998c9bedaaa70585", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340606, "uuid": "aa8e593b-7704-4b3f-bc2f-81020cc70d20", "value": "T1B092C030F4DAE631E1B52479EA21C2D64555CBA8C2E170336F550B2CF5D5906B839DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340606, "uuid": "d8ab5462-279b-4e5e-9284-da9fc6511b5e", "value": "384:vUiD1e2vTZ2gdRNJhwug7fXBV8llrCNTOxtgxDwDooHhymdGUop5hkt:nD1e2v4iJhwuKfr0r8dKDows3UozGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691340606, "uuid": "f6eb817d-2226-413d-9bdc-1510429ae500", "value": 19592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691340606, "uuid": "dd74dbff-7c44-4f97-b385-af7343b3837c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340606, "uuid": "8a77ec5b-cbe9-4c33-8730-cceac73b0747", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9262d3-3498-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691354088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354088, "uuid": "00a62241-d931-4d6b-b2c7-6dd858503149", "comment": "Malware payload", "value": "f92a9b05632c0c2092328df74a13e2f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354088, "uuid": "591e1e74-8744-4f87-a0c2-6a83b2947d8c", "comment": "Malware payload", "value": "563c3ade76b19c229cce52b3aecd01ff9d02157258352073dbe4bc9d1791adf5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354088, "uuid": "29a3b19e-14e2-40cd-bdae-e5ce4e229e48", "comment": "Malware payload", "value": "7c14ee3b1e5666014feca33138917915a8cf2089", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354088, "uuid": "f9bde07f-d549-4b78-b63f-25c52faa9b86", "comment": "Malware payload", "value": "26170864e41c6df7f9f337c369595d6c65fc0c38b929b7c5a6ac5da4c448a943fa8754865d2ecbb268e3133d1ef32958", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354088, "uuid": "33e6c69e-3ce6-4c09-aed9-a0813f11023e", "value": "T1B535AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354088, "uuid": "29d656fc-868b-45aa-bb04-18354ab3bb82", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354088, "uuid": "1111877e-4faa-4f7b-b61e-5a5c47ffea83", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/fRPOO8R4HUq7:F0dwAYZt6C31WeTnRPOhRQUq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691354088, "uuid": "3606763d-9202-4e24-bcaf-1bf0c7f8d43f", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691354088, "uuid": "a76696b7-6b7e-4d35-9fc3-f5c25931fe68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354088, "uuid": "02d8960a-e115-474e-ac7f-1090ffe5363f", "value": "2023-08-05_f92a9b05632c0c2092328df74a13e2f2_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd0a086-3435-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691311702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311702, "uuid": "e9ac21d7-74af-4201-9802-d784bc314843", "comment": "Malware payload", "value": "4cdb9a719de75fde3c4775af41e8ab07", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311702, "uuid": "490c4402-289d-4c44-91e0-d62bcf5bf105", "comment": "Malware payload", "value": "5642f91cd9087ccd09def93a6d5ceeda021f1e00faeb4d21ff00e1b70f1aee1e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311702, "uuid": "4c29dfc8-b2ba-48b1-b865-ab3020056e2a", "comment": "Malware payload", "value": "441dfce1bf57e5971680b7b2a1a8d7bab84a3d07", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311702, "uuid": "c2defb85-e787-489d-872b-c633f49a9354", "comment": "Malware payload", "value": "3c0e3fc74f35ef26d46a85c22f0476cec6fe4380901ec2732556dcfe01f6fc1790b6fe7207bc755c1a8c59a801181c78", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311702, "uuid": "0bf6ed45-7f1a-4ea5-97a0-0eabbbf610f2", "value": "T173E4337A99D9B28E8B4E62F7715C7E02DA9064B212E43E0E2C331D5DD85DF189C53C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311702, "uuid": "e60efe9d-83ad-4b5d-a8b0-79630dc019a7", "value": "12288:veVxgEos2abDOTh/D2rk6SLEa6EOV9pnQmIwZa4pSy26h97:vmCEosNAeiPd+9f4ySy247", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311702, "uuid": "873e626e-39c4-456f-8449-6482a4e25dba", "value": 662806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311702, "uuid": "9a56b326-6b72-4b5b-b93e-3b0fa46807b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311702, "uuid": "8d701a68-8105-44d9-8b41-901aa88ebf17", "value": "pago de la factura 11-369013..xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c2417b-33fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691286607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286607, "uuid": "9c85290e-53fa-461b-96f8-7040ed139ebf", "comment": "Malware payload (Mirai)", "value": "5a162885e334416b8e11d4c08477c6d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286607, "uuid": "db5ef14e-d000-42ed-8133-e55b1eb2e78a", "comment": "Malware payload (Mirai)", "value": "5ad378a552eeb9e18d431760d89c2479d87eb240a2bea481021575d1e5945b61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286607, "uuid": "846cf30a-6b53-4f13-a655-09d3314a9d51", "comment": "Malware payload (Mirai)", "value": "d90f40898d21ff33102d122627cd09682fda309a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286607, "uuid": "8acbc991-d71c-4432-a036-6920e07d8fbc", "comment": "Malware payload (Mirai)", "value": "77ca51dfd404b49a3b99a3083c3fa08a431d54719920eccc67a99e5252bb55353fd081c6a5a76566ab0aa69f17ffffba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286607, "uuid": "36655785-c501-47a0-8957-f516df90588b", "value": "T15223F895B9C19A06CAD443BBFE0F42CD372663A8E2DE3213DD262F5137DA52B0D6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286607, "uuid": "6133a52c-ac44-44f2-aa9d-9e8cf40c292c", "value": "768:i7BN5Fay6F5UadKna1cbwTXMMfXCGkvwTrwK41zNMJ3iBZTybnmwRL:0776F5Enuo4MGXLIK41JMJSBZ+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691286607, "uuid": "a7158488-09b8-45f1-a3a5-3b955568186f", "value": 46096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691286607, "uuid": "6ac43614-cdb0-4ce5-a058-669f702b9ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286607, "uuid": "5c603bee-6791-4499-8b30-647c68e4ef6d", "value": "la.bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58698c6-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691284170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284170, "uuid": "bf0adc39-5e3f-4165-802a-b1648b430600", "comment": "Malware payload (Mirai)", "value": "3f71732be7708ccdf0ef48f560e11e07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284170, "uuid": "5107f7bb-32cc-44b4-a6d7-d79ca65def02", "comment": "Malware payload (Mirai)", "value": "5b0f0b54dc6d77d39666d46b92c003ed5f913cf92fa139fc2db47331bb6f7a21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284170, "uuid": "08df0599-fdc2-48c4-bb4c-7e73f858660a", "comment": "Malware payload (Mirai)", "value": "2bd7203d245f197971baba8cccb7576041daf562", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284170, "uuid": "d64dcd36-0963-4692-9605-e5402ec01c42", "comment": "Malware payload (Mirai)", "value": "6934bd30e13f3fcc2bd53fc1c61a83fe3fab428e1a774bf8d7c2bf8df94a560f3f70736e47151b552a8f5ab947de31dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284170, "uuid": "e3b19eea-df8c-4bef-92d4-3d5db7e26987", "value": "T1A8532C96B8016D3CFC5BE6BE40110A19F931376129B30F2BD6A7FCA36D321A65D1BD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284170, "uuid": "755e96e4-5f77-4daf-ab28-941661879ec3", "value": "768:HeBaz0tMQaaZ261DmbgiWJNS5LhZ5GGuKdOmXPLzqovl9uQ8yhh5Cu7VqntyPGy/:HUfi5LhXGGukLXHfvlMQ8yheu5q4PGkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691284170, "uuid": "e74a5aab-0ad8-492c-82b9-531dc45a6f40", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691284170, "uuid": "16352f67-36c3-4ef8-a8ee-0e730fa22ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284170, "uuid": "3bbb8971-2a6d-4e38-b793-f6561590662c", "value": "3f71732be7708ccdf0ef48f560e11e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d2fadd-342a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691306805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306805, "uuid": "cc44523f-6d5e-45dc-89dd-702b006e7cf9", "comment": "Malware payload", "value": "3f1f12e548895018ce75f9f791a531f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306805, "uuid": "6645e419-01b7-4dbf-bc50-2d974e42f7e3", "comment": "Malware payload", "value": "5b6cc5a203ce85e6146c89957e9d740d66048d7f2e9f9b752132c88b4dbf5078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306805, "uuid": "ad53eacb-3137-499a-93d0-198cb5affae3", "comment": "Malware payload", "value": "7c076404ea1e4733b3b50a8331a94dac844d0f01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306805, "uuid": "6b03721c-badf-4345-9db6-b35e18cfdf86", "comment": "Malware payload", "value": "0353866e4d55b669b2bd3a297bfacffee229c158fcab8f84149b862224aff7ac0eba8f2b7077401a405dcdfdf6d6ac25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306805, "uuid": "8009633e-40d0-436f-a54b-262a50902343", "value": "T16507339FEA2740F7F1B303B0A5695376C07BFA956092B0CB06908979F5F04E1F446AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306805, "uuid": "3f274638-3917-4f5d-819c-a48fc947e03e", "value": "bc5ce990cf54f8d435a68eb97512f73e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306805, "uuid": "e03ae54e-c6df-4592-9b0a-7fee34638061", "value": "393216:OZIF8KcyuYp4xSpHHyx/QVtBP0+EPXTDNvgxdzkx1N2oxE4rJBytuj4:OZ5KclYp4xgy/QtdCXTDNvO6jJplByt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691306805, "uuid": "bf5d42f3-73f8-4787-881f-ed1f35b0ed51", "value": 16853603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691306805, "uuid": "4f6f7eff-3c64-44d5-a968-628cc667bfd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306805, "uuid": "6b473545-df34-42b0-8177-ce2061c4fb5d", "value": "3f1f12e548895018ce75f9f791a531f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f06a3-3498-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691354095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354095, "uuid": "0d665770-cdb2-452e-9688-d83094eabc4a", "comment": "Malware payload", "value": "f7d7bd66f43429247512433342b53822", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354095, "uuid": "3a8b2542-2b98-4da0-8c73-13cc03bd137c", "comment": "Malware payload", "value": "5cf7d7b2a3b453d04e0d30b3eb580cbb963939478fc1206496f619698fb63490", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354095, "uuid": "b165e0be-7ec0-4c99-8002-2042ea641711", "comment": "Malware payload", "value": "b7bff73b54a20a4348fbba2c9b9f3ee6101e3aa7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354095, "uuid": "9533d9a5-4381-4243-ad91-6dea6a1b959a", "comment": "Malware payload", "value": "eb4a05c1540a22c844b875d43f31ba614c108a47b7d8bb9bfdd466102b344b42314f6c24f1f8640108ad29d4c02c483c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354095, "uuid": "14a1a4df-dfbe-414a-a3a5-d036ad9c8653", "value": "T1B035AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354095, "uuid": "88acc1ea-4170-4f63-9cd8-b84167aab8e7", "value": "0c756c849bc7b459f78f7a5ce46cd4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354095, "uuid": "d5f8aa69-237c-4ec8-9d0a-61fe6decf26a", "value": "24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8GaHUq7:F0dwAYZt6C31WeTPRPOhG+Uq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691354095, "uuid": "42b3c9f9-3794-4454-af1d-00b19d84ba21", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691354095, "uuid": "7a2af297-540d-462c-ada7-953b5aa20155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354095, "uuid": "319638c3-ef38-403f-ab9c-b45f97f48f3a", "value": "2023-08-05_f7d7bd66f43429247512433342b53822_stop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f20dc7-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691326709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326709, "uuid": "af220338-f56c-4c11-9782-883f3dd44441", "comment": "Malware payload (AgentTesla)", "value": "b78f9dc987653121104c5eaa55ab8d4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326709, "uuid": "36188b8d-db46-4215-ad7f-a8cf08de5fff", "comment": "Malware payload (AgentTesla)", "value": "5dc5d1c2c2615331ea899d3c56e681d5ae4098887efb634d23ece74a29846623", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326709, "uuid": "a4c8908e-05f3-4dfa-bec7-4bdf19c60085", "comment": "Malware payload (AgentTesla)", "value": "96bc3f89fd957faa8f99091d14ff7bb17ea8c3e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326709, "uuid": "de2d74c1-6201-4413-a2bf-26afbb1f7417", "comment": "Malware payload (AgentTesla)", "value": "b026302a2d43ed6272bd54db0595dc7593e0ef85fadd54d99ca18978919f9d12baf900ff25ab9b96064aae03e17290d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326709, "uuid": "3bda75f2-b978-4418-bb6b-9aa0363611ac", "value": "T1DD158D243DEAD03DF072DE7D8AF8A596BD1AE263260EE49DC0D002495613BC2FD9653D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326709, "uuid": "50a44a3c-fa57-4c0b-bf62-2fb9234a95d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326709, "uuid": "c02cb6ae-338c-48f9-ade6-faa56c5a3c6a", "value": "12288:HZm2JnLbO9qdWCXws8r4gJpLSqs+yEiWz/gPdflvX7/x3s7aTbXh2zDibm3BJLF0:YThOag19157gCsLnblo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326709, "uuid": "a220fc0f-5dec-4dc6-aa89-b5567bdb862f", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326709, "uuid": "5202c005-e19d-4433-b89f-2484e1a17ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326709, "uuid": "79084fb1-0ac2-49d0-8ff8-d1d197cf6959", "value": "b78f9dc987653121104c5eaa55ab8d4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04da7e8c-3455-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691325025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691325025, "uuid": "649a024b-abf7-4b94-be3a-c337182f314f", "comment": "Malware payload (njrat)", "value": "075cfb9b060c21f8124eea51436f8282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691325025, "uuid": "3f97f23f-10df-421e-8b9f-2bc3925c85b8", "comment": "Malware payload (njrat)", "value": "5df688f5538aca79256dc329400ac5fb412000930d21072433733fa8417b9913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691325025, "uuid": "d327125a-16b9-46d1-9b46-c1c4a9475220", "comment": "Malware payload (njrat)", "value": "f0d7ce2d57a1d5886294d81b2e289f421c6106de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691325025, "uuid": "72fb78e8-ee07-465d-bc67-293687f487a0", "comment": "Malware payload (njrat)", "value": "3ff323acb1f94da1c2c0228348399f6beb9950ad5c2e3fd7d985580ab8b83b052a11a9e7fc487d5ea24c5cf90342a5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691325025, "uuid": "9774d82b-1fd0-4088-8f59-1fbb7cff81d7", "value": "T13244D02075C1C2B3C477113044D6CB759A7A357207AA92D7B6DD2BBA6F203E1A7392CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691325025, "uuid": "1adbdc87-c627-432f-be9f-18f205347d16", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691325025, "uuid": "3da7b0d1-e5c3-483e-84c1-b43cdce636d8", "value": "6144:PDKW1Lgbdl0TBBvjc/EPuO5Wo8XBZ44AMmlwScO/Hgij:Lh1Lk70Tnvjc8PtEo8XBZ47lwNcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691325025, "uuid": "19147d5d-fa10-46e3-a43d-39b1292e5f4a", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691325025, "uuid": "5489b9c2-f4e3-4e0f-bec3-0543b705821a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691325025, "uuid": "deed8ebd-b3a1-4b3e-a4da-44d63d052cff", "value": "075cfb9b060c21f8124eea51436f8282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52ff98d-344c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691321509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321509, "uuid": "548a631e-2fe4-4273-ba72-25d75719ff52", "comment": "Malware payload (Mirai)", "value": "f2c17e37a73ce971b52660f8774f5a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321509, "uuid": "5bac789c-8978-4784-8ea0-c5729bbdefee", "comment": "Malware payload (Mirai)", "value": "5e7e100e54a5e5357b5238072718f197228d822f850c4fb8289e6d8cdb894cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321509, "uuid": "00f25e41-dc39-4bb9-a38a-58a27dbf5670", "comment": "Malware payload (Mirai)", "value": "bfeda470a59f11bb909423954c8b4545e58956dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321509, "uuid": "0344469e-96a6-4c87-a5c4-a065792e9fdd", "comment": "Malware payload (Mirai)", "value": "ac7772621d2d055520b8e1fb24fdb15003d8ab082846c6ae910198e23d70a22c5edbe00023cb97a415e3a965542e8420", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321509, "uuid": "2d8b9035-6335-4ed5-993d-1866080c681d", "value": "T132F2D13C1A281458F96FC43FD38B46B0AC30AF8625A3DD16A290D9D84F0357DB96969A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321509, "uuid": "463074e4-7030-455b-8a68-f89491ab46fb", "value": "768:mw3jxl4AO6yd0GLZ7kMVHFLNwU6g4L0PEf+pgB3JgGlzDpUYsa:7M6K7kileUNyAEH1VqYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691321509, "uuid": "01c8c62f-611e-482e-ad3e-6d1f17871532", "value": 34752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691321509, "uuid": "3d71ab9c-f8a4-495c-a6ae-1ec47fb398bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321509, "uuid": "049ff2f1-842b-448c-8a80-4e84c3f9e2f0", "value": "SecuriteInfo.com.Linux.Mirai.671.5712.6413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad37cb2-3411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691296071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296071, "uuid": "140808fd-327f-4b9a-bf59-731418dd5015", "comment": "Malware payload", "value": "aaf8d4e045549870770506dd28331516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296071, "uuid": "efd810c1-d505-449f-b91b-7ba65f83491b", "comment": "Malware payload", "value": "6081d6e2a238a24ca101d14e94ed30641396a01ff379a94e58bf885cfba5ec1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296071, "uuid": "7379f664-b358-4adf-a1a8-638945cf9e99", "comment": "Malware payload", "value": "333e423ee0f738f195562b53a61f45be8cddecec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296071, "uuid": "74f75bf4-ba41-408b-a1db-04553c964149", "comment": "Malware payload", "value": "9591b86c9ee517bcb0277748ab73e93d10ccf96a23d85e7417e1cba0df1cf4cca6ea9d70043a7733601b8bfe68d4fe31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296071, "uuid": "1becc2ee-34db-4bf8-8857-187850673234", "value": "T1CA535426AB51AEB7CC5ECD3305A8464230CDA49652D83B2F76F0C62CF75A90F49E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296071, "uuid": "60379318-53bf-44e6-a6a8-09398ba36459", "value": "768:BmEFNHsGyu5CMeLe7DeRPSMZlAwuLuYSMHqbZnIJXi3dcvmeCDQn5FIZvRb:BDuG326DEPlUfKbZnIdmeCDQjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691296071, "uuid": "c0f9b524-3667-40bb-9017-8c573893c71b", "value": 66040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691296071, "uuid": "082cf609-4d28-4210-9a85-74cc849b6ef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296071, "uuid": "3e88bb06-0f1d-445d-9fbe-feda223c6d28", "value": "SecuriteInfo.com.Backdoor.Linux.Gafgyt.JJ.29877.31127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c4f47c-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691348432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348432, "uuid": "8e91673a-069e-4146-99d7-3887cdb6498a", "comment": "Malware payload (Stealc)", "value": "1c893bff867579997d1d05d37e2bd463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348432, "uuid": "9073c1a4-4fb2-4582-b96b-0d7a9b8eeb23", "comment": "Malware payload (Stealc)", "value": "61cb8845a1dd53b3dbe20eca12f2f5321c03c7b9a4b80315de24c8ecb083e4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348432, "uuid": "a7b23e02-8d06-4e78-a77d-0d44e6be6734", "comment": "Malware payload (Stealc)", "value": "2c693549eb71900d8bddcd634e56f619db30aa53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348432, "uuid": "9808ea03-49fc-4ef4-aa16-315dd22a08be", "comment": "Malware payload (Stealc)", "value": "7adbce985bd1d9d9410a710c8d06519a69f02501a0a63b3774b2373a4bd587f5d71f70e01e74c15642de19eeed932961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348432, "uuid": "df69d868-975b-48e8-b757-a1a4eb843123", "value": "T197947B2433D08C32C6AE4675A4A0C6718634ED2657728BD727C46FBB3D773C08A65BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348432, "uuid": "93104a92-2a2a-461b-8fde-aa0eed8a76da", "value": "6256ca6fb1d33cce27dff272311e3072", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348432, "uuid": "ee09425b-c50b-4329-958c-76ec4ccf05ea", "value": "6144:fjxzYPg/USg7WFugayIv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7FL7:7NYI/7FugaDS2zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348432, "uuid": "020bd7c4-df78-470c-86c0-5975da289a6c", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348432, "uuid": "f4dbdcdc-54ce-4d54-a7d8-71f0bd90da60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348432, "uuid": "3ec6a16c-dc8b-427a-9a14-3afb824825f3", "value": "1c893bff867579997d1d05d37e2bd463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021eea8a-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334040, "uuid": "e9ab86b5-9b99-4bb5-ae4a-ce0b5bc510ba", "comment": "Malware payload (Mirai)", "value": "ae715ca97935d756e64bd3f788521efd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334040, "uuid": "03d683f7-ffb4-4ad0-acb6-b187d9c756aa", "comment": "Malware payload (Mirai)", "value": "625e792691a4edc428554ba6f8d4511ea7f5a47b9fd0e362398120af4fa99c5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334040, "uuid": "37e01520-2e72-4536-87cb-68159b6a0ebc", "comment": "Malware payload (Mirai)", "value": "533bcc6a3c4ef9440e898e1d625611942b30c4cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334040, "uuid": "fd4232b9-dc2b-40c7-aa81-6b0bfca22909", "comment": "Malware payload (Mirai)", "value": "154460b9936112793144035fb5cb1e88cd328e7586e1a7e261f893dc4aa1758a5d8677e08399e6220efedef42cf5fbef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334040, "uuid": "3b6ca957-746b-4d41-86e7-e9e64ce4bca2", "value": "T10E14D80AAB610FBBDCAFDD3702E90B0539CCA55722A43B363674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334040, "uuid": "73eb464c-773c-47f0-b2bf-3fd2c5198582", "value": "3072:JGX+rfkOpwWQZdN+z9+JjFx6KgcsyvWuTWMofe8HMR:JGX+vwWQZdN+zO6FcsGJo5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334040, "uuid": "26b8cd2a-89dc-4340-92df-055739ded292", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334040, "uuid": "490e1ca9-7176-47db-9726-5820b892d01d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334040, "uuid": "404f5176-35a1-4efa-b2c2-1ed2e7d6ebea", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b15785c-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1691311775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311775, "uuid": "5cd8ab74-b82b-4c9a-8b51-42b9fc71f1df", "comment": "Malware payload (Fabookie)", "value": "53bbcd119263f70fdeda86ddfd2c464e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311775, "uuid": "9c0ff56d-6f13-46f8-8d00-71ca0e0fcf60", "comment": "Malware payload (Fabookie)", "value": "645168fedeed9948b5103f10d52c9adf1133358e1b1ab4ac0893dd3bb73b2df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311775, "uuid": "cf530094-be82-432b-8f41-bb7303deeb4a", "comment": "Malware payload (Fabookie)", "value": "52da119b10a9f5b0bc3380e980c6eee4e7184ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311775, "uuid": "c0e81cc7-5fdc-4aa5-a753-4c48e01746bd", "comment": "Malware payload (Fabookie)", "value": "cf40cc3a8849d4f39340582f996abd755665926d29f987a11c887a79e5160e03978b241b6383f89824e75d77359fb039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311775, "uuid": "0b857f68-2eba-4c82-85f7-79c6a134f932", "value": "T185647C56F36440B7E1528035C593EBB2F6B27C562B20134F1790FB7A2F336626E29B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311775, "uuid": "3193b5e4-590f-4c1a-809e-511bba54dbf5", "value": "02a84429b024f8e8b499d5d5730c3f0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311775, "uuid": "881970f0-43a2-4c4b-8cd3-c87e35e41ce5", "value": "6144:hbkjiZH5huErWFoWdN46Ja6VWxtoloBj5rbx:5LbuEyNdN9J/VJ6Bj5rbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311775, "uuid": "47dcdadb-41e4-449d-a413-edd47ba45dac", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311775, "uuid": "3f5c975b-1a76-4166-af65-e1fbba826665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311775, "uuid": "ad9285a5-b7c1-4337-9644-fe700e08006a", "value": "53bbcd119263f70fdeda86ddfd2c464e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cf5336-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691311705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311705, "uuid": "1d6af9b1-ff04-45e2-aa7b-8022a1700ee8", "comment": "Malware payload", "value": "111a1f15e2b371a16483e7dcccd1a3fa", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311705, "uuid": "b97afd0a-763b-4121-ada0-eb73059802b9", "comment": "Malware payload", "value": "67e1005379e288b0bdd43153fbb0abf7d41f07280dd23fb8c3d2faf3526d42f9", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311705, "uuid": "6a860e60-755c-41e5-8b25-dd27bcabd286", "comment": "Malware payload", "value": "0970550068776cc1fd44d25b171e48e6653824c2", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311705, "uuid": "33a86a7d-460c-42c8-82c2-bd24999fd73b", "comment": "Malware payload", "value": "ed4402d72613594794425504fce96c5d4f91a3ca53a693a43c35f1abcf5bcb364e386cdbd9f5ecd8466bd66109f99642", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311705, "uuid": "110a3509-85fe-4dec-822b-d26cb9178cbb", "value": "T19E62AFAEF220D836D53DD47C925D0ABAE40D38A5172774AF7816E89D2350AC3439A7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311705, "uuid": "e87bde96-7722-4014-8ae3-a3cb66307b04", "value": "384:/br9Xuq6FsFuxGaPykEbx79VohXWq77bWa:fpuqUsFuTPyDxIWqjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311705, "uuid": "f47df31d-8e7d-449f-a444-3682c09189c2", "value": 15450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311705, "uuid": "aab5e190-42fd-4ca8-9c73-75b5cc3e4b71", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311705, "uuid": "2ea8a139-f12b-4438-85ec-a54470cf76da", "value": "ham.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74a601c-3414-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691297407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297407, "uuid": "39ee4cc2-570d-46e0-ac60-191e60433ca1", "comment": "Malware payload (Mirai)", "value": "485f5b7bb449c42fb2bf5d6622069509", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297407, "uuid": "2215ae61-1988-4bc5-b887-985743a737eb", "comment": "Malware payload (Mirai)", "value": "686b8be4d4b77785505ee36611399bc3be0c86540cec9023964a2db5e40f8f44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297407, "uuid": "a6b8a551-a486-482c-a4ca-1a8284ccb079", "comment": "Malware payload (Mirai)", "value": "b364839e6d6e7e525436593b8c3ced5698218281", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691297407, "uuid": "9bd23f99-4ec1-477d-afc9-c3323f13b550", "comment": "Malware payload (Mirai)", "value": "f05d32fa0bf6a50a164fbbfa8c9b41d9f75a824ed8cec36e70ee029883266daa722ec410ed29219edb6adcfc36b76858", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691297407, "uuid": "dd23e315-66a1-4b0b-9b7a-828d84b75451", "value": "T11D631895B8819A17CAD543BFFA0E42CD37266398E3DE3213DD255F1137CB92B0AAB111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691297407, "uuid": "fc651d2c-9814-4bc2-92e4-ea01ab5b5831", "value": "1536:n/ejoAS5DNY+OE10aZOm3wSz4pXHePKo+/vv3Pw:/e0AS5DNwsTUpXmPK3Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691297407, "uuid": "78d6f8d4-fd3e-4229-a0da-2cddb61472a9", "value": 72788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691297407, "uuid": "e32ee0b4-71f8-40f9-a062-30171c7e67ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691297407, "uuid": "0f7c6279-4551-4b20-9bb3-49fdcfb7945c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db0d0e8-34a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691360849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691360849, "uuid": "29711f68-f14d-41ac-aa99-38291e68d71c", "comment": "Malware payload", "value": "a8fdf691f612bb5983d5e356797586e7", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691360849, "uuid": "4d352a49-0d9d-41a4-aa46-3b75af590d5b", "comment": "Malware payload", "value": "68829e1be9bfec633131d6db9a1ac4c252ea6474265977c3b002c9d824454fc1", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691360849, "uuid": "f96de054-22c3-42f6-9c73-75c095164bb3", "comment": "Malware payload", "value": "fd3067a07a369243a21e45cae6fc7a988e7256ac", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691360849, "uuid": "4501b814-a42f-4d24-a466-9883bf2b5094", "comment": "Malware payload", "value": "45901977f88cdded86e13f89f4fcbda22e71cd724538d699afc109f87d2b91811af1cd66c722b37f5003075eb5450a69", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691360849, "uuid": "7fc70675-5f9a-4957-9beb-a43f40e349fa", "value": "T1E256230175C78136C5ED83744B17BABE30B17B28437242EB72E85ADF38F26A196B1947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691360849, "uuid": "0e17b9d4-ef60-43c7-b161-b0c3417e0f4c", "value": "98304:RYI0BAnFtxzSv/wfUlkltFs3aMf+A45xTyVQ9UfU4BFn4tMEA:j0BAnFt0v/wclkTYam+AEmVPJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691360849, "uuid": "7a307e17-09fb-4a8f-8a1d-11074c388790", "value": 6376448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691360849, "uuid": "9f516db4-f309-4657-b17f-5fd55c2a6782", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691360849, "uuid": "07c988fa-4cff-4696-8743-a96c68b9fcb1", "value": "FactArchivonuevo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef86fc0-33f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283005, "uuid": "32914739-46fe-4a0d-abf0-2a290a583cdd", "comment": "Malware payload (Mirai)", "value": "c9ff3cc17429c36d30461104a1478459", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283005, "uuid": "fa44c781-2532-41e9-993f-0e91f1a66529", "comment": "Malware payload (Mirai)", "value": "6aabb2ffecbd086873d52dca1d437aef5d0105f78d3efa5746cae0eed39370e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283005, "uuid": "5c6aa330-2f65-4685-b87e-a6d6b9227cac", "comment": "Malware payload (Mirai)", "value": "a70fcaaf9036cb17dc437995ef9635d774b289c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283005, "uuid": "72bf222c-c976-4789-b449-37f3b4fe29fe", "comment": "Malware payload (Mirai)", "value": "a93e84da0b799bd7a02c4968580bc6efe2d1a87db908772e3949cb1d7eb69069d496b817b2a5bd2e43984f9de4956ada", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283005, "uuid": "6bd36513-ecc2-4a02-958a-2d3dc6b8d7a9", "value": "T11DD34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699186FB43FC676E0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283005, "uuid": "89a56d7c-e40a-4316-905d-877f0a60581b", "value": "3072:igauByoyut3lfprYiMKJFz7rktQrSeDHUAMM/9zIYj:5auB3yut3lfNYKJFz7rMQ9HULM/9kYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283005, "uuid": "d78bfdfe-c385-4966-8bb2-55ebb20e6afc", "value": 136322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283005, "uuid": "1432fe71-006a-45fc-b162-7b633f0351ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283005, "uuid": "a66ffdc7-ba3a-49d2-a71c-658913fa5f75", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2326f45a-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1691334095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334095, "uuid": "4db17574-3596-4023-967b-5f41cce4f737", "comment": "Malware payload (RaccoonStealer)", "value": "c9c27c78979d5bf56240089bb88b0c56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334095, "uuid": "40f80a0a-3d7d-4e1d-87ea-e866fa1d66e5", "comment": "Malware payload (RaccoonStealer)", "value": "6bbec1195b67c774482b5b181107f3f2ea3d81cc6056aaa75f062a250fc1e418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334095, "uuid": "66ee0f96-ccee-4e51-8b6c-761d7bca5767", "comment": "Malware payload (RaccoonStealer)", "value": "5be89e4b0cf30ed84b8c0e2607eaabce9b40f261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334095, "uuid": "2c454d3b-0678-4048-98ce-e1a3f8c84447", "comment": "Malware payload (RaccoonStealer)", "value": "c0aa387e466ca29bb3d237f1de9d679054126a2b9dc24e98b1622dffb64e2e6472fd87a0d1aaffcf560eefd999241d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334095, "uuid": "ac4ce815-67f4-4b2a-a09c-3ae4770d6850", "value": "T18B5633B35198114CE4E9CC3EC937FED571F551779881E8B4689EBAC11A3A4E4E303AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334095, "uuid": "ba0bed0f-9c18-4846-96b3-bb1b176f4dc0", "value": "5655e27fdbf7c1df56e25a218a416f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334095, "uuid": "88232d23-cf2f-4eda-b2d4-cb2ab629a214", "value": "196608:jY3Po6I0IXGayvZmvgTC/F4T4RGJepngun:cfM5X65EUJeJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334095, "uuid": "c5ef0c59-6487-4f85-8f08-6def43501cfc", "value": 6376960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334095, "uuid": "812e7e3d-432a-444b-8444-f9e48071225a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334095, "uuid": "88713e28-4f06-4073-a3ec-b52d9f0e39a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2d0b9f-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283859, "uuid": "4a54291d-a17a-4b0e-8886-d339e3b7fe1e", "comment": "Malware payload (Mirai)", "value": "71cd6761a4f54b072a65e7437f134c94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283859, "uuid": "0d9e87d9-dab2-48d9-b70b-da1a1b4fdae2", "comment": "Malware payload (Mirai)", "value": "6bc5a33d2919aa02cd19e2bbc1b29463fe79d452deca4f52d9406ed914a1e84f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283859, "uuid": "4ad91683-fe3e-4fbb-900c-8545ce2d4087", "comment": "Malware payload (Mirai)", "value": "200d793a36cbdb267e6be155afe15e8b7d6938f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283859, "uuid": "188e74a8-9bd6-4436-967b-9efe82ae979f", "comment": "Malware payload (Mirai)", "value": "5dd222d73c43b4b9ae09bef3d8688f4843cb2560f12b4603ce91b68e3ebc893248abd5f4f72eca985c4681235e9baa54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283859, "uuid": "823c5460-8b3a-4b06-a0eb-09f8eda6195b", "value": "T10C53E59178819A17C5E422BBF96E018D373563F8D1DB3206CD226F6477CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283859, "uuid": "deec9acc-b0e7-4316-97c8-e4e860a88ff8", "value": "1536:OPcVNq5WxJ+HhMv1dVAUJkulG9WXiY1dBbd42+:OPCt9pk6G9Ai4dB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283859, "uuid": "6cdd5482-02f4-47e1-8885-aa945367d005", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283859, "uuid": "c4e8dae9-1517-4ba2-97ad-180f7f980538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283859, "uuid": "28577183-26bd-4f4e-bf1b-23ac44de474e", "value": "71cd6761a4f54b072a65e7437f134c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7650b49-349c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691355899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691355899, "uuid": "75467163-81fe-40fe-a72f-c591771faf2f", "comment": "Malware payload", "value": "3b032b54c9e62a8ec5f24721a9040b2b", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691355899, "uuid": "abf4a922-e6e5-4f7b-9630-285d3d8d25fb", "comment": "Malware payload", "value": "6cd9df022105775239a56ea46f7685572f1c7757f199144ea6ea1aa278212f7c", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691355899, "uuid": "6089601a-195f-4025-8d72-0bfe941e72a2", "comment": "Malware payload", "value": "f5dbd5fcffaec79b19ee2327f15ed13ca83b605e", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691355899, "uuid": "17e98675-d070-410c-9731-7c57c4ab9cf4", "comment": "Malware payload", "value": "68dc95392eeab5cc886d70299857a69a98e242ae9f12c783a81ae74fccca77ef058fc017a80b6094f876facb7f612baf", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691355899, "uuid": "94a74f5e-62f5-4fb6-83d4-37b24ee222e7", "value": "T16656231179D74D35D5EE87B40E17BFAE34A5261483B2009F62C81ACF29F27F056B2A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691355899, "uuid": "1e06d0b6-38a3-493a-9780-60d69566c271", "value": "196608:qGdqSr3aEpDP/mcr/TYphq8jeldNmzNTb:qq3au/ghraldNWNTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691355899, "uuid": "5ab83d1a-1702-4772-9bab-1aae178334ba", "value": 6417408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691355899, "uuid": "bddce01d-7abb-407c-bb59-013122c93adc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691355899, "uuid": "9a7696c6-3a10-47aa-8448-ec431a561768", "value": "SUNATfacturanopagada.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50188294-346e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335888, "uuid": "4e861e80-1e90-4b0a-a370-d1f20761974c", "comment": "Malware payload (Mirai)", "value": "85d29bd6ce25545d4c28e978eb9902fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335888, "uuid": "3ba9c824-729b-4f0d-a9d2-9fbdbe0624f4", "comment": "Malware payload (Mirai)", "value": "6cee3b93e65dec381f5dc710ac9db493746a9bddfba5c8044c057810cb769ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335888, "uuid": "77d88ee1-13b0-42a1-8e13-650be65ca149", "comment": "Malware payload (Mirai)", "value": "50730dfd70290b02d7cd77120616c0dccf658e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335888, "uuid": "c074fac3-ddf0-4711-81cc-e939430bce18", "comment": "Malware payload (Mirai)", "value": "27d57bbcb3a98b0c172beed125be3f3ff66ca83e2893f569679499c850f098506165bf4b44a8ddfe30fa8e9a99336144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335888, "uuid": "dd18feb9-59c1-4677-be9c-c43a2815fb87", "value": "T1EED2D12D1A4340ADEC50E07A6BD603E33D730F92E44699077459BA07ADEB8693937FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335888, "uuid": "1acbbe62-6141-40de-9e87-5cc3efe08f6a", "value": "768:Kspb+bq/kw1PwwRxQsJazljfj4AHG2yo3RJgGlzDpbuR1JR:Kib+bqXhbxQsJyd7l33jVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335888, "uuid": "51d7fed4-f567-4b22-b51a-89de97d8058a", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335888, "uuid": "8e9b8d91-77be-46d7-9bff-6ab8b126492a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335888, "uuid": "9d5a3556-1d43-4239-8eec-b7e416080e9e", "value": "SecuriteInfo.com.Linux.Siggen.9999.8121.25456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df94b73a-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691284160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284160, "uuid": "365d84db-9097-4d80-a415-91acaa85b407", "comment": "Malware payload (Mirai)", "value": "3ce5dcd8739a012f66dbdb7f73866ef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284160, "uuid": "2f521290-a7de-4a6b-8539-f8baac1711bc", "comment": "Malware payload (Mirai)", "value": "6f63fb7c7db8b87287e07a70ff630fd9b9dda80b295c745e6e101082dd21f54b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284160, "uuid": "b501de04-63e4-49e9-88c6-2be80889afee", "comment": "Malware payload (Mirai)", "value": "63ebe8b98aeec39e92a760acaa0c4baf71d7feac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284160, "uuid": "7f151771-6386-4ec6-8dc2-6bd634370bd0", "comment": "Malware payload (Mirai)", "value": "906cc5b35018696759700953e9dd6c7af81e9424112f9f3f2f82894212b1e9392fdd5819b8994b3b3dce803d721cc82b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284160, "uuid": "fbfe65d9-5924-4fae-82e7-ab90285c9871", "value": "T115534A217A792E17C4E4A07E25B38314B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284160, "uuid": "760217fe-b05b-4c99-91d7-9d89c1e91226", "value": "1536:IDK6bb9lTEFq1X6JySbe5/Tbrv0kCKpdYm+A:mKQ27be5/Tc9QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691284160, "uuid": "36b1acf5-6e8d-43b3-adcb-e21900845cc1", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691284160, "uuid": "2065241c-0ed5-4151-8f9a-be864f8987cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284160, "uuid": "266008e4-a885-44c7-ab5f-f16880cda568", "value": "3ce5dcd8739a012f66dbdb7f73866ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0401e61-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315434, "uuid": "2067d1bf-3e9b-4508-b128-bd16678af8da", "comment": "Malware payload (Mirai)", "value": "217e4dc03bed4b3f8a1de838c2e06a0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315434, "uuid": "c52ff022-36fe-40f9-90e2-b23caa3a7e3e", "comment": "Malware payload (Mirai)", "value": "700f7849ed879178e391f8959a898152a5fb65a353ffbfa8c5dbf0642f19ba6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315434, "uuid": "ff62d3a4-5b40-44f7-9007-792cf3c6c02b", "comment": "Malware payload (Mirai)", "value": "80c34754322dafbb40f1c72db3d0eef4aa6e851c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315434, "uuid": "50f9164d-2d5d-4e2c-b5c9-7f272d1a4826", "comment": "Malware payload (Mirai)", "value": "6bc37797a450137265da170a650fa31dce3853341d5a4fa9f201b102b8d7720711b63ebb634ad7f5e3477b3556291587", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315434, "uuid": "fb999dc7-e7cb-48b9-828a-9993100edd3c", "value": "T1E183AFB8CE5C1CA5CB620171A9E089799723EF856A132FF58D418FD55007ECCB13A7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315434, "uuid": "3343e67f-af03-42c8-9aee-3a254a5cc5e2", "value": "1536:c/OGzVSYU+qaPm1aHRJzanoTpDW9xRnrCpi:cGkidUeaHRJbNQxRnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315434, "uuid": "beb2e2c1-5eae-428e-8907-5b6fb0cf6ba9", "value": 83108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315434, "uuid": "980d7aa9-c1fd-44f2-a2da-1461ff55cd52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315434, "uuid": "44e65d79-2445-4adb-a59d-dfb05ecc9492", "value": "217e4dc03bed4b3f8a1de838c2e06a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fc6a8d-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326691, "uuid": "5f967bd0-2fb3-4664-b406-b9408d818a38", "comment": "Malware payload (Mirai)", "value": "223cf3c0038f5e87c5b49a5d23ed8136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326691, "uuid": "1a66d56a-cfce-4ab8-8f23-52e4b69f639e", "comment": "Malware payload (Mirai)", "value": "7178ecf54e30a78e2a508ee962ea63a033f2627a558dec0cf5267ed07f3e1fc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326691, "uuid": "e989e185-4548-4402-a4c2-16060f34b245", "comment": "Malware payload (Mirai)", "value": "71af4047ebeb5a3e2ff23f2dd3a19a0a9e9c2113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326691, "uuid": "dd24b354-a6a1-45f6-9005-011ec2903a22", "comment": "Malware payload (Mirai)", "value": "d25a6d8c3b7ccc63b0564f7b507809196faa706ae0c21940edc438e22085911ab8cb5028a9e98500b460ab1bca85e7ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326691, "uuid": "d4e33a41-11e7-4eb5-b502-eb439915ec81", "value": "T1CE536DCAB8119E7DF5CBE77E84220D0EB821722150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326691, "uuid": "3aadb7f2-3c6d-427f-b2ce-c51562fb9091", "value": "1536:nyyRgQF4TbSX5lxLepSGY5RFneOON2PPB+qG76E8l:nV1TjGxEVGOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326691, "uuid": "8e5d0ef1-699b-41e8-a157-93cd6ea3048e", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326691, "uuid": "c1a4dc83-74ec-47b1-ac35-d6b83e1a0767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326691, "uuid": "f608c300-e6b5-4f3a-aec6-58745d4e715e", "value": "223cf3c0038f5e87c5b49a5d23ed8136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f5538a-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334044, "uuid": "adaeac89-ec98-4151-8a09-f6c12139e38f", "comment": "Malware payload (Mirai)", "value": "1f0b09b9c619c70c49e073e8c9da0042", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334044, "uuid": "12d590ca-9024-4749-8f8a-8e707adb4a86", "comment": "Malware payload (Mirai)", "value": "7222a90feadd95d9535df51e0579a9d3ed46759f8149ef4f020e0e0ebaf60221", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334044, "uuid": "31e2538e-d707-416d-8622-e90cbd72719e", "comment": "Malware payload (Mirai)", "value": "3801a0c8382ee0c42d45838190270f72b27fe05d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334044, "uuid": "7e781308-c07b-422e-966f-435df9a0b826", "comment": "Malware payload (Mirai)", "value": "20e93802ffe6e13c44a372115ae72a5837358ea46898f41c258ab7eb142e61d9107c32f2b902d2907fa3fc2cec36dc5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334044, "uuid": "da60ac6b-e68c-49f5-9843-4da4d56978a6", "value": "T10C130955FC82857BC2E017BABA6E6B8C337663D5C2DF7323982017A1369621F1D22E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334044, "uuid": "586f6d92-8148-4add-85ee-e31c11eaf008", "value": "768:CUpROIcErJliIm5ghzKwG5rBKX827NIJ8fjPyLzLcEb2ukXohlhg+hBP1FzHNgwV:NpSEOIm5g5hG5r6XfTyL8Eb2uk8hLhxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334044, "uuid": "cc9171cf-d92b-4273-a4d6-07de68a56553", "value": 44564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334044, "uuid": "4705b2a3-3cfc-4321-8b59-bc5b24b864f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334044, "uuid": "61c4798d-562c-4c97-8387-a672f615eb09", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c00d6b-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334047, "uuid": "ebd3b63b-3d74-454e-9e31-75941e5e9f75", "comment": "Malware payload (Mirai)", "value": "2f58f286bc897dedac3a38a080c3ab3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334047, "uuid": "fbead5bd-6e62-4c0a-8a6b-ede5cee55082", "comment": "Malware payload (Mirai)", "value": "75c375da92d49b94cf02c410bef94f40da04ae6a769f12ec4c37f65baa81f5d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334047, "uuid": "b0d7b682-9ed7-4b88-97ba-7a1e9e21d6aa", "comment": "Malware payload (Mirai)", "value": "0b6777bf3c67741020b35c968f4cdd7c85a529ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334047, "uuid": "8e293ddd-ded4-4b54-9014-76a3f0b40c97", "comment": "Malware payload (Mirai)", "value": "93940abc00315e2a2c6ea86e512f01af2209193e73b7d102d9cd496aabee8dedcdee4b9909def66cab0ecd16207bf6a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334047, "uuid": "53bc472c-5ab3-401e-83a3-ada78cdf2691", "value": "T1F8E31845FC414B23C6C612BBFB5E428D7B2A17A8D3EE720399256F21378795B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334047, "uuid": "8b06614f-277d-4307-9f76-5e2e49f6b6e7", "value": "3072:sXpHmDCp/Q+yFea4Y5uoH6rrdYyskh29b:sX3pQQa4Y8oH6SVkhIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334047, "uuid": "33377184-0346-40d2-a82b-7490d3f9db95", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334047, "uuid": "0f35614c-1fb1-41c0-849a-4af9209f2a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334047, "uuid": "538614f0-e438-42e7-8c42-a7ae2f559c10", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973c7cf3-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329565, "uuid": "f64861df-3a30-4a51-bba1-420380b5abbd", "comment": "Malware payload (Mirai)", "value": "4819ec47b66afa9da2191e1884e0c63b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329565, "uuid": "4fe1640b-881b-40bc-a5f6-06d46fa48122", "comment": "Malware payload (Mirai)", "value": "75f055a97c871787bae6063ae5fd516f10435ff099c7fec50d96735d7b6a32a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329565, "uuid": "5469aa4f-bb37-403a-974f-830c7073c737", "comment": "Malware payload (Mirai)", "value": "e7e7f208c8eb9e5b266b66d11bf60bde8a129c13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329565, "uuid": "7563fad3-48c4-4759-a639-5a9b3b8e80f8", "comment": "Malware payload (Mirai)", "value": "a5b7acaddc4a9bb8ca6043f03e2d33693f0a2d76f1147b641f396c3e53d0389d8ef7c481e9fee3b8585b895d94694d47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329565, "uuid": "2edbe155-04ed-42b2-ae71-30abcd484098", "value": "T100032981732C0547C5B32EB0353B1BD1D7AFAE9222A4E389750FA74AC071E379946D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329565, "uuid": "8cea546e-4b81-45a1-8c22-19a4b9fa598d", "value": "768:PdDy5toO6C8gnnWegvzWuIJHjssmR8IBiRD:Pdj8JnrCCtDPQ8I8RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329565, "uuid": "69f12fe9-ca21-4626-b2c3-a8e5a9f81ab6", "value": 40376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329565, "uuid": "bbd35147-ce8a-4def-b97b-103187066eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329565, "uuid": "eeb1c4af-1d27-4f51-804d-91ba8a88cf53", "value": "4819ec47b66afa9da2191e1884e0c63b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e27d40-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691284177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284177, "uuid": "c3b720a2-0e32-47a3-8492-ee03e5c8559b", "comment": "Malware payload (Mirai)", "value": "28738f64e737cbba222e9152bf95063e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284177, "uuid": "0c856b10-7867-425f-aec4-4f676e9122c4", "comment": "Malware payload (Mirai)", "value": "78b02f0d869fb3832cf84fdf07c71dc67ed99c53aaaf095a261a88d851cdcd83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284177, "uuid": "3f9cbed5-0e4e-407e-aa12-062d49b6dc0c", "comment": "Malware payload (Mirai)", "value": "242a861faba07bf5a840f31d186bab565e204377", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284177, "uuid": "9f34d61f-e8f0-4923-96cd-b7d46f083cc8", "comment": "Malware payload (Mirai)", "value": "cf47d43bebc75f053960c3025411a46ac8b4a0a784ce3069e98961363a62f742fa211016654d3388e9a19cc38e1fed35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284177, "uuid": "efb9d816-ac07-4a4f-a2eb-788e14a9cec1", "value": "T1F9338D36C87F6DA8C5448638B82249342F63F50885A7AEFA9BC187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284177, "uuid": "059dbff9-c0ee-4ee7-9a42-e7e75114e96a", "value": "1536:0ndIcnkW5wtd44ZhTZJNexd+3+PkeEtCQOd42+:0nFnkW51EreO+Pke0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691284177, "uuid": "a5e8e338-32d2-4566-9928-ba54ffc4d54c", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691284177, "uuid": "fb0ab859-3037-4c49-a537-70a5e841fac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284177, "uuid": "58ce3d9f-693b-405e-920a-0b7e136ab573", "value": "28738f64e737cbba222e9152bf95063e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a647c89d-346c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335174, "uuid": "e95fe7a1-9d09-41f2-835d-501052e2b1d3", "comment": "Malware payload (Mirai)", "value": "34cfc94939b55f1e34a2fc941b5e856f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335174, "uuid": "c9a6bc1b-c696-4e1a-836b-ad3ca4963059", "comment": "Malware payload (Mirai)", "value": "7917138fac54741ec12ed4d79594f399854996b1abd81ae5fb040b14b8ff483c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335174, "uuid": "335465fe-5b1a-4c96-be40-43bf825cb821", "comment": "Malware payload (Mirai)", "value": "e66c47db9a550cbfebe9706c07ea0e3db22ed822", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335174, "uuid": "9d6c5d1c-6296-45af-a9e7-0639364a6eab", "comment": "Malware payload (Mirai)", "value": "4288c541785fbf0731edc521b8b798f08367e99b74c9dcf3fa352bcf0675d8307b41866cfdeb0866e1a7de1ea2e68069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335174, "uuid": "a356e628-fe36-473a-ace7-84b0361596ce", "value": "T154B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335174, "uuid": "cb039bca-734c-4442-a3c5-0314dcb1f391", "value": "3072:pC/4rdZHsXsZwwR9bNk5mm/QcuLmHniPNb:pCwrvHwsZwY9bOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335174, "uuid": "aaef2f08-b0dc-4986-b792-97accae5b554", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335174, "uuid": "faa54627-9c3b-4f36-82ca-168a5cc1f84b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335174, "uuid": "9c2cad8a-25f2-467a-9b27-9083c6a6346c", "value": "34cfc94939b55f1e34a2fc941b5e856f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0282964-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691315407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "bea8199e-47ae-4233-84f7-d6952b912e43", "comment": "Malware payload", "value": "fff3742aeb30e5aacac32f41111b2ea1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "f4784579-b926-407c-b2b9-6f4e66d7906e", "comment": "Malware payload", "value": "7a3a78ad2b4653cdbf464ac01fdc877e7b673e7412d1c3e6018b7b9ebc8f3382", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "16417a4c-abe0-4fa9-b70e-1d6328b482ca", "comment": "Malware payload", "value": "28b612061399a6c0622165277e69783882c196c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315407, "uuid": "2eb4bd5f-b466-42c2-a5ea-f91a76d38bd5", "comment": "Malware payload", "value": "9f6919f0cc921aefdc3240a1d02c05b46b0ece65b5de50634e22596066f092d9359ccf7fd5494c229125200384ffb166", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315407, "uuid": "63cd9261-e34e-4d96-ad5c-433cb7c1889d", "value": "T15333F1A073DE6904DBD12EB164B68D4D5A7271FAEE3F30195BB0972ED1E00D55FB8808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315407, "uuid": "80ffe7bc-2aab-4ad9-97c4-236a865c3886", "value": "1536:u21XJyi5NoAoExD3HgUGMBL3EoK5q8Vz5:L1LkAj5JL3EYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315407, "uuid": "c2ce0093-7681-4953-a0e2-6545d3f9c606", "value": 50184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315407, "uuid": "5f9680b5-4044-4c8c-8de4-35ab27a3ca14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315407, "uuid": "8a0b18e4-eb96-4bf4-ad23-0f7ca8bc5752", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3511a3d9-34a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691358606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358606, "uuid": "3528e9a7-f639-4b69-9823-ee11a93363c0", "comment": "Malware payload (Mirai)", "value": "40cb7e09286d8d088d4a976b90073e46", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358606, "uuid": "92bee6a3-c010-4254-9c6a-7c216d8db175", "comment": "Malware payload (Mirai)", "value": "7e15cec8dcd9083dd3cedabf2eb21e793ef71ff4d59026b85df81772265cf33b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358606, "uuid": "7bbe434f-112d-4a8a-a1bd-2d14a80a3471", "comment": "Malware payload (Mirai)", "value": "02c81680b68e597c421e4bb80a49ddf31383f6a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358606, "uuid": "0818f481-ad3b-4e72-9721-c0ebb8874136", "comment": "Malware payload (Mirai)", "value": "4e679b5218e4693324db1e18977ca38d714e10444137ea3cf60ff1e036dd3966d133194e8b670d3ba6e628d0dede6b03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358606, "uuid": "95f6255c-661b-47df-af74-1892c16e3f08", "value": "T1F5B3F8427881662AC2D223BBE6AF51CE332077E9D3DB7116CC201B647B8591F0D67F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358606, "uuid": "1c309e22-8076-4eb8-a1bc-1a6a9bd8ea92", "value": "1536:gCKgBMEtuJ8plNkKDBkmdYlCf07AXHmBDivnEtu/1RSuMa4cLjzILozPfQiDzKYy:FBjtuJ8t/yutLHjbiYBEM2pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691358606, "uuid": "efd85ec6-6aa3-480f-a869-732eae6b3f95", "value": 113196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691358606, "uuid": "2d1cf0d6-a3f4-45d1-8f5b-10a1dc9bbb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358606, "uuid": "37f98beb-67e2-40a8-9d91-2b3080cdb115", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d1489a-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691348406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348406, "uuid": "89c4b837-ce2e-441e-9d98-f1a245f65b6d", "comment": "Malware payload (Mirai)", "value": "50ef68440678a9b3359353bb205fa7ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348406, "uuid": "d249ad61-79bc-4fc1-8a1f-16c983a5fe52", "comment": "Malware payload (Mirai)", "value": "7e446fd82045eea5c497ae36457a9d936ec7d9d0fc6600f03c9837d1c22ded1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348406, "uuid": "e69ccae6-4ea1-4038-8020-2e9ebcbb178b", "comment": "Malware payload (Mirai)", "value": "4ead279598247ef38ca8e5bd8b687fcde7174032", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348406, "uuid": "c90a13bc-6b73-4906-ae66-af875b674dd1", "comment": "Malware payload (Mirai)", "value": "a90346adeb9269e5e627e004bcf5733c58e4128c2c634f75f444fa1cf41bcc06ab62e6bbecca0c676dfc41723070d7fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348406, "uuid": "7832953e-10be-452d-9c35-29ecdb39d071", "value": "T1B2C2E1F53E777A9BDA29013D746DCE3382B4A012D39EB653D200920C21171ADBB329DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348406, "uuid": "01ca6935-a799-4ca0-b454-442040d36c05", "value": "768:RMwoDZLFbBy6HQHRYfeAxdd8qoeIQfL0NN:RolcYfe6KZZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348406, "uuid": "b8471379-dddc-41c3-8710-209a1a74a492", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348406, "uuid": "7cb68da1-7a03-4fd5-b481-4ade9346bc69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348406, "uuid": "03d5a151-f47d-42f9-ae06-1cd6044537b7", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dfeec9-3446-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1691318723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318723, "uuid": "2a803991-1d9a-43f1-b3ee-b26a4f3e758c", "comment": "Malware payload (RiseProStealer)", "value": "b2838328e7d83b7d0c2cf12999c91128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318723, "uuid": "cbcbec4d-df6c-4977-aea1-bc5392e28486", "comment": "Malware payload (RiseProStealer)", "value": "7e93fa1eab66dd0436c705a8d5163e850d6e0a67374ca7aefb4c3cafd8145394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318723, "uuid": "d4434b35-cfb1-4c32-b1c1-2ea327d7040f", "comment": "Malware payload (RiseProStealer)", "value": "49f56337861f5bdd935e7ac5f5aa2dda7cc3d876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318723, "uuid": "f670289b-a377-44cc-9ad0-837e3bac9d29", "comment": "Malware payload (RiseProStealer)", "value": "cbf5ab3d23b3d2d406615c3dd536f8bbe5fcf646fc4aa35aedee6e3c78e6f1f91260888149192f91bd56eec0603860bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318723, "uuid": "3377ae84-cc00-4032-b4b3-6ebe45d10af2", "value": "T155459D5078D1C623DCE1137601ECA52471AEEC70DF278AE72EC596EBCE206D12BF6691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318723, "uuid": "b317fca9-f2ab-4410-b4e6-f1ee916e6ceb", "value": "beb59a48f2399bd993c41436bf734901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318723, "uuid": "3511acf8-8cd6-4b56-b93c-bb3ed201b97a", "value": "24576:kh4lq2g1rhvcfjGwsDPShRi9gQ1ADZslsbPbt:M44rhvcfjpDKOQ1APx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318723, "uuid": "1c49a3db-23fd-4017-8756-23af3f4e40ca", "value": 1219680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318723, "uuid": "e5551915-db0f-494b-9bd2-01c1be94cd08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318723, "uuid": "4044a674-baef-436d-ac06-371eead59f1e", "value": "b2838328e7d83b7d0c2cf12999c91128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d543195-3435-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691311510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311510, "uuid": "1ce93976-6008-4d5d-9ab7-21ad7ff03cd5", "comment": "Malware payload (Amadey)", "value": "6b1b547bb9116f48da100dc3d93fb9d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311510, "uuid": "fc672c72-1762-4ed4-bc54-facd0cae36c0", "comment": "Malware payload (Amadey)", "value": "7f1f582a1cd4d1883aef63d5f73b7cc514e3c9c3671c3c959b0f4964fdb52e38", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311510, "uuid": "468baf2e-d772-45de-9f96-ed013c2e3491", "comment": "Malware payload (Amadey)", "value": "95f37970762ea7d1bf15c1660a4347e031b4d514", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311510, "uuid": "239aa1c2-5885-484b-9baf-208b873b71c0", "comment": "Malware payload (Amadey)", "value": "2b2d0e5fc4b82ef4ff02b13b6217b22512eedc7dcb1be1d7509d1d04f7783c49701f9e97adb97d81bddf315667128c3e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311510, "uuid": "e09ed7d7-df22-4d4d-b0bd-5de5d862e0ce", "value": "T11064D70352E13D54FA265B738E2EC6E8F68EF550EF1937EA12199A2F05B11B2C273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311510, "uuid": "e5429fca-7e4d-4bbe-b294-7c05690b0ef0", "value": "4472ef7ff17466415618a97438e0e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311510, "uuid": "a0153954-eb40-404e-89d0-205305c18901", "value": "3072:TILhU6U84aJW7Ptj5/PqxN6msrHdfONeB+0LaioHY:s2R8l87P3az6msr92NeMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311510, "uuid": "f063d1e2-ad29-42fc-ad81-8a5f7a5250ab", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311510, "uuid": "5343212a-1c53-42ac-ad5f-a64b9be812d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311510, "uuid": "f6c3654f-9d15-4277-be32-4ce9d3733567", "value": "6b1b547bb9116f48da100dc3d93fb9d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05df7426-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334046, "uuid": "0f91591f-5edd-44db-85f5-8f49de87f86d", "comment": "Malware payload (Mirai)", "value": "82eba24064ad53b4194f0ce5caaffc65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334046, "uuid": "00249eb6-aac3-423a-a919-ee031f51c356", "comment": "Malware payload (Mirai)", "value": "8073a94ebc308cea0265aa249a619144cde4bfc47d6272c267334fc492ff3861", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334046, "uuid": "5e17955d-d41f-43d4-bf3b-00050e0baf27", "comment": "Malware payload (Mirai)", "value": "f877f2122175664beaa6f53887b00f0c0ed33a3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334046, "uuid": "c5245953-3ea1-4038-89df-93c714909c74", "comment": "Malware payload (Mirai)", "value": "11651ac8b9e5afd1557f2c4611eea215c0aee31393e582e649280f42edb9a8cc481d30f456e27e031c5ef124653e4dba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334046, "uuid": "a81d922d-2197-43d2-a052-a66c4ddef213", "value": "T1FD142A45EA414B13C0D727B9FA9F42053323A798D7EB73069928AFB43F8679E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334046, "uuid": "65038491-2ea0-48be-8f60-cc190ad8f9d3", "value": "6144:Q0yeZhVgeamaBChQ9ZLYmXNY8UrHzJM/RdX8SD:Q0yoVgeamaBChQ9Z1STzS/3X8SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334046, "uuid": "d2eda45b-f0a5-4b23-be6d-aa0c0b3491ec", "value": 204186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334046, "uuid": "6ff072da-735a-4240-ba05-0728df423065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334046, "uuid": "a4726fb2-eb6e-43b6-a2ce-0325f6bff8cb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad27ca0-340d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691294111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691294111, "uuid": "2d25a204-8990-4b7b-8c43-05ce7d0b363b", "comment": "Malware payload (Smoke Loader)", "value": "12c2f5c06632c07d3bfd902f32ad5479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691294111, "uuid": "3cbdbb04-9761-48e8-9437-40c31e5f5259", "comment": "Malware payload (Smoke Loader)", "value": "8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691294111, "uuid": "eda719f6-9a0e-4672-805b-5da413f13c89", "comment": "Malware payload (Smoke Loader)", "value": "27d85b01116806eba3554b9e3f1b891add2ca5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691294111, "uuid": "7447c170-954b-4625-ae40-3afa428e5358", "comment": "Malware payload (Smoke Loader)", "value": "6a8aa5b71cd9070dabdcb878420d1c6c777afd04432e757c58290739fe05f4379e0800c9161b021c8e849ced995bb216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691294111, "uuid": "0799a692-3267-41d2-a546-087faa62e7e8", "value": "T12964D81382A33D55E52ECB768E1E86F8761EF5508F5937AA3228AB2F04B11B3C173715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691294111, "uuid": "494d2e53-f82d-4840-badc-0b571e2bcb69", "value": "4472ef7ff17466415618a97438e0e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691294111, "uuid": "59bec8a5-8a87-44bd-a28b-484eb3a6a3ba", "value": "3072:tOS5UTiugV/l9Zj5T0S+oKgmnNtpkkltj3eIVa4Ml9T:MnmZdl9zAgmnFk6tze2ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691294111, "uuid": "83e1e4d7-7327-4c31-ae95-94fcfb8cdf71", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691294111, "uuid": "5536dbf3-a334-4aa6-9679-e30fa89fa2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691294111, "uuid": "e2bc3a8c-6300-4fe0-8dfb-0b4fb07aafc3", "value": "12c2f5c06632c07d3bfd902f32ad5479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583d8b36-3488-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691347069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347069, "uuid": "ecded7e5-fd9f-4f4b-9b94-94b567fbd364", "comment": "Malware payload", "value": "fe86be485d9e49178ca5ce3677e38cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347069, "uuid": "b3d4a6b4-f8e9-4f38-9b09-f8c115968f97", "comment": "Malware payload", "value": "81b2dcbb79c2896141772043e55e5a6c667c16f4fa3e387ac308268c192f9c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347069, "uuid": "5f1a0014-31b4-4cc5-a595-47b753e65398", "comment": "Malware payload", "value": "3e126d8c8edb2043d3d2b2c3a6ff87d8df522e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347069, "uuid": "8c4f9e31-d546-48bd-8a53-140ee9d8162b", "comment": "Malware payload", "value": "303725485e0db28830d9223a76cd95a5d4e2578c6d74bb900860e328550566e463889fb8fd0ebcffd4506a36c9d12d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347069, "uuid": "8af46dd4-20d2-4203-9d02-16124d9a9e9d", "value": "T173B45B1392A33D55E52ACB76CE1E86F8761EF5508F4937AA3228AB2F04B01B7C173715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347069, "uuid": "3e3daec8-6e2e-4952-b893-f167cbb71783", "value": "4472ef7ff17466415618a97438e0e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347069, "uuid": "b01ed437-4e1b-4abc-8d41-1f85a5179eba", "value": "6144:1V25Uzen4/t7rXvHcHwjrp9aCrfieuSvL1VHu1bRiUMTbbKVRX2e:1o5Uze4dgIfrNPvLe1li1TfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691347069, "uuid": "8853c8a8-9093-4c14-8f99-6303882cb8c4", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691347069, "uuid": "d34b45c1-cc99-4754-bc4e-6d25630815f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347069, "uuid": "be33e2c3-5070-4a72-aa27-727548ecd8b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e53e67-3466-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691332643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691332643, "uuid": "61728012-1114-4051-b2f9-cfb0cae93004", "comment": "Malware payload", "value": "1cb7273334e1f7669df71dee4bf9d99b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691332643, "uuid": "5c67afa9-b06e-450f-a571-c78b8f95b9a4", "comment": "Malware payload", "value": "82173e481da69e58688c5221a5ff8e260fd50f0bbb0e2064def8620dcd0d5214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691332643, "uuid": "7d8de719-9960-40e0-a374-f7c47bd84038", "comment": "Malware payload", "value": "4751acf52dc8edb0fe7ee22e35c5e8a9b89dc756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691332643, "uuid": "6d02655f-aa81-401f-95b9-21cfc96d0551", "comment": "Malware payload", "value": "2c22c89cc037b74510cfb708dab0891e884a43c53bac3b261d07b9add3a8a364d815646b32348eff3648843c227e175d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691332643, "uuid": "338fb883-74ab-4be1-95b8-3f364eb85d39", "value": "T1B2145C336C48D4C3DA288B7190F3A978057D9FE6FCF9A9A5640DF9A03B775C8210B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691332643, "uuid": "514318b3-ba1c-49c9-8275-f05fe6c073c5", "value": "3072:8I+SSSSSIBfSSxSatS9SSJwNmhRq3ZyW2woK2o5D7AVmpOasaZ3o:zsm8COzampOas23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691332643, "uuid": "d73fe126-c916-4859-b79a-d560d7e737d9", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691332643, "uuid": "9b7ac791-d76d-4378-9c88-4a5c9e20976e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691332643, "uuid": "949f2370-68a9-46bb-aeab-205c3bcd2862", "value": "Total Uninstall Professional.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d90bb7-33fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691286605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286605, "uuid": "d98cb3bd-74b7-47cd-b5af-be64c2d1264d", "comment": "Malware payload (Mirai)", "value": "77fccb2283f26e2519f3184a08aef8f3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286605, "uuid": "06682ace-0940-46c8-bf9e-1200b3ac10f1", "comment": "Malware payload (Mirai)", "value": "84249a68c5ab76c207a222c481acb49577495b31feb142880bf62a3e2a07fd5f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286605, "uuid": "c9532c7b-ab98-41a7-ba04-f475f5178890", "comment": "Malware payload (Mirai)", "value": "1dd6e0de146a1fc689a26a2c83dae673b707c98c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286605, "uuid": "5b580d6e-20ed-49ff-ae72-2bd92cb5ea21", "comment": "Malware payload (Mirai)", "value": "a555e6bbaa8796e18c3562660e929e2662e78186474fbced4f950d27efc4b513742a5bda25c4ceca3db41f82b4c683a9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286605, "uuid": "3f6cb004-5d81-4507-91ba-c25264a0c38e", "value": "T1CD8349272A92C93FC09757B42AEB9222D123B43C1B33515777D8BE6D6B76CC81D29302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286605, "uuid": "6ba80d03-cf15-4265-a78f-deefe8613b17", "value": "1536:tY8WYumkt+jc6wOw0f3w0o065fz/QYmKXoGzYSzCI4IJr:gYuRP2xo0CIrcrEQlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691286605, "uuid": "aa8323e3-56c8-4155-afa7-e6fbb7b04b99", "value": 84397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691286605, "uuid": "c25be9a0-74ae-4b79-a321-647603973cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286605, "uuid": "a7ba8ccd-0743-4484-b082-b7643b5ad497", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6556d46f-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335495, "uuid": "4e1d0b53-6461-4c4f-8a09-eaad25d62e4a", "comment": "Malware payload (Mirai)", "value": "18e772e24689a0da803247855c941b82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335495, "uuid": "c22c5a66-490c-4b99-9ca4-1c52a7b10097", "comment": "Malware payload (Mirai)", "value": "84d19f243cae6d14a15eced6cadd77f95dc494058f18a463fdcb18c0b382fe0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335495, "uuid": "ee9c99e4-449c-4f1d-b6b3-05166374105d", "comment": "Malware payload (Mirai)", "value": "df4697824dcfa53edd6951f63c39e87e21bfdbf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335495, "uuid": "cd504ad8-b4c2-4aab-b822-d970f61906b7", "comment": "Malware payload (Mirai)", "value": "6ae833c3febe290d99b056919b558a1c685502fe92ff1ea2fb803a6283986cd43be7536c46995dcdb6884738281537fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335495, "uuid": "c42f3281-5be1-45dc-8d88-7423ccaaf3ec", "value": "T142C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335495, "uuid": "10a0a4ac-b8e8-4e8d-bf9a-297c43d416a3", "value": "3072:6jVlyaL5JCrIpv04s9bttiEiTmP46aQyfPlfKsNb:yoCJCN4s9bHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335495, "uuid": "6fbba4cb-1f57-42c0-97f9-1a41c7aa42cf", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335495, "uuid": "45502dcc-ac54-494e-adfd-a9b53c77117e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335495, "uuid": "2bc05152-7614-43c6-979b-452f9fbe91f5", "value": "18e772e24689a0da803247855c941b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf49b42-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691311805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311805, "uuid": "a2aedbfb-9172-4ee6-a9d8-453dd8af1ecb", "comment": "Malware payload (Mirai)", "value": "9aa2366418dc6cd6e391e4052df271a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311805, "uuid": "cccc5795-cb6b-4f3b-8e02-2727763e9404", "comment": "Malware payload (Mirai)", "value": "8633db55d1782708679581d7a624e4ba7368dbdb60bc2f3e7e71e4c1a15208b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311805, "uuid": "2f91bec6-949b-49b9-ad9d-db52d4609cb2", "comment": "Malware payload (Mirai)", "value": "46f51cdf6dbeb04c2d9156529f2efe0d98d55091", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311805, "uuid": "12b5ef3e-9f8a-4551-9ad6-64b3fd655149", "comment": "Malware payload (Mirai)", "value": "6582d0bad8f48b6e4f1c3367b407948f7486d19dbde3b90a6d132790d65ebe4f95be87a54f0a5776ad9ca0e97761fe2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311805, "uuid": "1dfc7088-d61e-40c5-818a-da5c7bd0e2a4", "value": "T1E7E2F183D5BF4650D104B5FE2C9FB48E98A0A75DCCC846635BCC3919BD82F552EBCA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311805, "uuid": "d46bc64c-2f5e-4e51-af98-9d7709195b35", "value": "768:8YkJoyLVmfTPEHJgO/GnzH7unuilTOxnbcuyD7UVyqR:8lJtmfTsezHarJCnouy8sqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311805, "uuid": "3ca00464-7d2f-4a17-b3c9-83215af21383", "value": 32956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311805, "uuid": "a3ac7314-d032-4ed6-8dcf-b9a2a1b43502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311805, "uuid": "2f3d1e73-9925-443b-9511-8a48c61ba862", "value": "Chaosontopxd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d402f9e1-3499-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691354578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354578, "uuid": "2e2b52da-2972-4ec8-81d4-54d30e789b93", "comment": "Malware payload", "value": "f7fc1d813907f416595eac64d7d986c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354578, "uuid": "ea5a11d0-48ca-4eaf-8d34-aab7fd8d45d5", "comment": "Malware payload", "value": "87bde727af7beabcb4d733a41d258ee407d6e977e78c06a96ba2295431d53c23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354578, "uuid": "12a7af0a-fe13-4400-9840-c83712e62bb9", "comment": "Malware payload", "value": "68d8d47704331ee3a01455596b3d747f6b87c198", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354578, "uuid": "5ec0028d-4856-406b-b44e-af8c67c0f193", "comment": "Malware payload", "value": "ac9b03d4c11a3846e4cb17561c0a8908d2641b29fc69b62d4c6594c05f8081bdb6bbe4758115d22a7bd6cf9a387dae51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354578, "uuid": "ef58de57-11d0-4efb-a312-17692a3a5503", "value": "T1167307053AE18133FAF2F9B265B869E1587B7E541B287ADF00E8043E19275E25D30B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354578, "uuid": "26dd1b4c-546b-4e68-b54d-333a02659cf4", "value": "40306b615af659fc1f93cfb121cc38d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354578, "uuid": "9a091be4-1e7c-4654-b4a7-022c0ef86950", "value": "1536:UgSeGDjtQhnwmmB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:UMSjOnrmBbMqqMmr3IdE8we0Avu5r++N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691354578, "uuid": "a022cdc5-f21c-4f51-9ecd-d32ba4ef7d72", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691354578, "uuid": "e93e483d-f51f-41fb-9ace-570c388b0a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354578, "uuid": "4fe82bd5-5a74-4ae8-9c7f-790250f52ff8", "value": "2023-08-05_f7fc1d813907f416595eac64d7d986c6_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6af8aeb-3459-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691327122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691327122, "uuid": "b23be811-9d4b-4cbb-b8c6-f6a4cead669a", "comment": "Malware payload (QuasarRAT)", "value": "0a29ee64b40a3adb3f5a5e1815c5de53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691327122, "uuid": "5aa7476f-f6e0-4245-9b9c-f1ea8069f1b5", "comment": "Malware payload (QuasarRAT)", "value": "8811dde82b3c3bc28fba1619b7332ea654cb61f103f04e220e79402aa711ac37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691327122, "uuid": "a233ceec-3fb3-4dd7-adde-541d0d26e298", "comment": "Malware payload (QuasarRAT)", "value": "4df20df56276e475db53bf0507d8a5110da10aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691327122, "uuid": "e563e443-9f95-4a52-b92d-f7051c69ec46", "comment": "Malware payload (QuasarRAT)", "value": "c7309b59bb36284d0dfdc38f4788a58a0aa0dda03a98e4e75c68e7e7c5b8f3f798dce52b035af776bf510b33fbc26289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691327122, "uuid": "f57709d2-6bfd-4ce1-8d95-220d3c78e720", "value": "T11A74220EC24DAAACD7BA6A3E12BC6D154E1301EB0D479DF435684BD84E3B34C1C7A666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691327122, "uuid": "b1f25c02-e516-437e-a133-396bbdec1b1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691327122, "uuid": "b50d2421-640d-4224-903c-b5ba6316eda9", "value": "6144:f/eN68HKVbmmKoOdHzTE9B3cr7s1cbfj0uTEDWG48lfxKqDKrTBUtcwD6wF/Qs:fM2KbdHz0BUY1lrDH4UirNgxQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691327122, "uuid": "49583b69-4f76-4c1a-b027-dff0a018e8ef", "value": 350728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691327122, "uuid": "fc9b69c5-b5ee-475a-bb38-65c6800a8911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691327122, "uuid": "8adfd8c3-6003-4b99-818b-0572429b833c", "value": "0a29ee64b40a3adb3f5a5e1815c5de53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fad3955-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329553, "uuid": "56811a5c-892e-4f78-b963-816f178af549", "comment": "Malware payload (Mirai)", "value": "f775b0b907a4295c1eff1127a526d9f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329553, "uuid": "47dca654-76bf-4342-a1da-3a88adbe3db1", "comment": "Malware payload (Mirai)", "value": "896493ef8e0e7968cce08769e58568c0a7468ed8e179844ffdda58ef3ac0534e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329553, "uuid": "ead3af23-5080-40f2-ae38-f5b3606ec635", "comment": "Malware payload (Mirai)", "value": "cc3008825bcf3afe25d0507965909d1a43409344", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329553, "uuid": "7696ea59-1cba-4ed1-bac2-4900a01b08f3", "comment": "Malware payload (Mirai)", "value": "be4c45832dcba780adb03c68e18cbf8f11aab67188ea3002649727c3989ddf1046e38504b208597c9a1200b7e0e15c6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329553, "uuid": "7746b6db-10ac-4a1f-a412-eee471a40476", "value": "T1D7F28FA3CD6A2E68D2145574F1219F3C5B23EA19DA5B6FE78412C2B59003DDCF82D3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329553, "uuid": "61251cb3-ee02-4c57-8839-763fa842fb4f", "value": "768:EUcgBa7x4tItotAUhC+NME46IDoAhWoYCSFc:EDgcg+e7M+NMEHAZYCSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329553, "uuid": "1dbe0439-af0c-4899-903b-8dac1806a1fe", "value": 35540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329553, "uuid": "2b409ebb-86a9-45cf-b270-a7db222e7130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329553, "uuid": "ad95c9fc-8bee-49f0-aa01-6443672f75be", "value": "f775b0b907a4295c1eff1127a526d9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590b4717-3438-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691312711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312711, "uuid": "b8256c6a-0047-4c7f-b4ff-f9b06a9dc640", "comment": "Malware payload (GuLoader)", "value": "7418044f00199e4add2a6460ce07d884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312711, "uuid": "3e363d92-9e2e-494e-93f8-360a107ef2c4", "comment": "Malware payload (GuLoader)", "value": "8a09e86a04a6dbd37f88d21e450d3072d11f24ba2c2f3f724383859f89a3424c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312711, "uuid": "3d3342b3-50aa-48f5-b876-a695f7145819", "comment": "Malware payload (GuLoader)", "value": "6d1e64985025af52dfbf2dc3ba44b5f140841ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312711, "uuid": "7cc38e12-66f1-4b83-895a-4f8e02669c2f", "comment": "Malware payload (GuLoader)", "value": "e12a2e4b6b1cdf748896de2f60c38633d36255c4d9de177d80da9f1debf27108265b9121afcd6c4f977aa2bf720a6e80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312711, "uuid": "8145a0fe-b1f1-4dd4-a416-4cacfb472873", "value": "T10164E003B66C875FD3EA8AB2387A0371C658EF531640AE52BBD5FE1D293228D6D071D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312711, "uuid": "51911f5c-3ec3-4157-895e-e0d754719552", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312711, "uuid": "91eda867-2464-4d6f-a371-982ddcc13181", "value": "6144:TQ606x7lm/t8f1lglbvs+WJIQNzajm5dO8CNjnVxIpd4OOWo5QQKgl:3ot8f1lglbDWSHjm5dbCNh674CQKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312711, "uuid": "9aa245ae-63bd-41c8-a3d1-178556c3276e", "value": 309795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312711, "uuid": "f64001da-2285-4753-92b8-4a83921d5837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312711, "uuid": "45432539-0d93-470c-81b1-3dbf50552a5d", "value": "7418044f00199e4add2a6460ce07d884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f69b8d-3444-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691318068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318068, "uuid": "c23f1332-136f-40c4-b602-3ed8da641c31", "comment": "Malware payload (Mirai)", "value": "de3229defd108bd0d76b0f61f35e35f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318068, "uuid": "314f7414-c431-43a6-b596-7647a44417da", "comment": "Malware payload (Mirai)", "value": "8a8594ef391ca9a9e109bd0e17bb1ac89cd01007d03298bde8b4bb6b67978240", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318068, "uuid": "62a39082-a1f7-4e8d-a9af-71c31e7df67e", "comment": "Malware payload (Mirai)", "value": "e62c48b8722864abfda89810c8fd39ff014f5817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318068, "uuid": "9e55cdab-2ebf-470b-baf5-07c179da6bea", "comment": "Malware payload (Mirai)", "value": "bb40d202f6c035f367a43c9ca8c37d1ac3315ff99e2488d2fe4aebc8bfd59b0205598fd6167187f2a41e88a1b3022b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318068, "uuid": "b747a593-106a-49ee-9a81-9d40d3a9ae56", "value": "T138C2E138E0046DA7FF7CA7F454E3E1893B95499933F78AE26782EF52250742D8120BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318068, "uuid": "3b0e4ac5-4a54-4ec6-a1ca-9a959cbd3018", "value": "768:z8ifKr8ULU66vf7AZECjkHeqBSGSN4uVcqgw09U:/fKrHLSfCxkhBFi4u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318068, "uuid": "293e1e3e-55c9-4999-bfd1-559bb65e6efd", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318068, "uuid": "1266806f-b78a-413d-aa20-57cf619f39df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318068, "uuid": "204867e3-6478-491d-b31d-f51d232fbcf0", "value": "de3229defd108bd0d76b0f61f35e35f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245c9cdf-347a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691340969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340969, "uuid": "ad1e638d-96c6-4c5a-85e8-c6acd1bf6278", "comment": "Malware payload (Mirai)", "value": "561693c4030340caa5ff3b4543d3cc39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340969, "uuid": "66bc0403-0cbb-42bb-962f-d851038782b6", "comment": "Malware payload (Mirai)", "value": "8a9e07d2a5d3f9b55c6df7a12af72b4ecea7d21143c89ca6e8acc92c98719e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340969, "uuid": "013e6f0f-cdc3-45b3-8215-63e6b7d122bb", "comment": "Malware payload (Mirai)", "value": "4d8c84a5fa89d7eeceb44cf794e40772464b93a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340969, "uuid": "dbd7eebe-83be-43ff-8dc4-08fc1f5a651e", "comment": "Malware payload (Mirai)", "value": "da245c82445a58aeaca2e824286a6aa67dd1f54fcabf0fb899d8225deb66896144aa0c81781cc1f1fd4a8944202c31bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340969, "uuid": "7802999c-294c-4337-b447-20c7cd7db4a0", "value": "T14FC2E03108DB7E51CF600832A81CA5CF6B438FFDD2EA79223B5C06512EA15079A2DF57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340969, "uuid": "696c4e61-84f1-4b4f-b560-cd9e82f81de4", "value": "768:u1Xolkz/z+XMt8W4W/ZgRS8H2I89q3UELj2X:2zKXtLW/Zn85FLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691340969, "uuid": "5dfc62f9-796b-457a-a36b-3302d59a6ce0", "value": 28252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691340969, "uuid": "14ae67e9-4d8a-445d-b76f-3195e3309910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340969, "uuid": "a9d9ba33-fad3-4f7e-bde6-5f147ee07041", "value": "561693c4030340caa5ff3b4543d3cc39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ee7913-3429-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691306181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306181, "uuid": "d9924786-aecb-4d86-a7d7-37eb7367b097", "comment": "Malware payload (Rhadamanthys)", "value": "d9a555072f290689af8e44c33d470bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306181, "uuid": "0137fd5c-bf64-4c92-92a9-baa44da13a10", "comment": "Malware payload (Rhadamanthys)", "value": "8ba72f675acf5bc12805d4fff0bda437ea419d15e4237c916554a7f7df1b0b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306181, "uuid": "b5a3fbc7-ced1-4dd5-a74a-f6e3c8aed269", "comment": "Malware payload (Rhadamanthys)", "value": "f8fdb18d2a01cad9570ecb2b1d28939dc9c94f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306181, "uuid": "163703b2-2ea2-4408-a9bf-bd15095c1880", "comment": "Malware payload (Rhadamanthys)", "value": "485d5a62563d28e70b071cef190ae3fc85f9e83a759bd0ac1014fd6b6de8e3198c380d2a687de4a72996afacda54c269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306181, "uuid": "f7cdeb07-18f3-4153-bd19-8d5f4abd280e", "value": "T1ED759E03B7A789E1E2855736C59B150003ABD9C937ABD71E798F2B9B184B7BADC00707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306181, "uuid": "12761d7e-a6a9-4fd6-b4bd-0cd5a3d6702f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306181, "uuid": "f717ad47-01f7-494b-939b-a3b69e9dc405", "value": "24576:PuX2P/5aGXGzXlHD19jl6RnTHMV2x1jXYbNdiPxqHhpkqgBToq4cneO23wSS1zyI:SHrKoV2kbgxqBpkXBacnj23wS6zTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691306181, "uuid": "7fd812bc-cc72-4f26-86d4-4e666ea6e388", "value": 1600512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691306181, "uuid": "cc680c7c-9814-4f68-816c-f84fe1ca852a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306181, "uuid": "7c32cf19-aa63-4fc1-ac6b-ce9d2fc0309c", "value": "d9a555072f290689af8e44c33d470bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffa199b-33f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "0395b9f9-4f68-4fc7-a206-f1f643338ad7", "comment": "Malware payload (Mirai)", "value": "1630a11ed6d4c7b233d2c3a5b78dfafd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "2e0327d5-d9a0-4f77-ab19-32eb0393a138", "comment": "Malware payload (Mirai)", "value": "8d408dbea225402b3ad7ee82258e887a9996715ef9d422531d872942e8844af9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "2596fd17-0a33-4b0e-a18d-c3954a190b03", "comment": "Malware payload (Mirai)", "value": "e245f0111a2d5e7556dc43775086c37d2038b46f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283007, "uuid": "cfc1f317-4a14-4409-9e40-0a7fef93ce6c", "comment": "Malware payload (Mirai)", "value": "c5b33b1d82a9a8ef84341535e2603285e4112f9fc70e0320c1f6930d7f45499f56c1eb0cf0b0b81347eeaa6ddde86409", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283007, "uuid": "b19e26a3-01f6-4752-97f0-9016ede742aa", "value": "T12843D555B8C25A2BC1E423BBEA6E518D3331A3F8D1DF3217CC111B24B68952F0DA7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283007, "uuid": "f13080f0-b997-4cc8-9fc3-d2de9d33c484", "value": "1536:ztdJZAUw6iOYyX8zL5zI2MbrEQvzalG9WnSfxHqd42+:zHJZE88U2MbhvSG9MSJHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283007, "uuid": "e5e88be2-e26f-4840-8e36-80689d2cf230", "value": 55560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283007, "uuid": "54996ca3-2a1c-45ee-b2c2-e7c75595f061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283007, "uuid": "426e9035-867d-4cd5-a477-29ee16516848", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c68620f-3429-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691306140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306140, "uuid": "2a3c0730-15bd-4568-ae82-92500edc3bcb", "comment": "Malware payload (RedLineStealer)", "value": "737307862171267fd72a88c78c79ba14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306140, "uuid": "c1169922-5bba-4e87-808f-05b5f43eec00", "comment": "Malware payload (RedLineStealer)", "value": "8deda3f9f857a91d1d9b3f420a3d9102a091849696a8f34b91e9413fc954a82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306140, "uuid": "5fabcf2b-f09c-4c38-a79b-71582f61e172", "comment": "Malware payload (RedLineStealer)", "value": "9576e06d485497f9aacb25fc6820281e50b82350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691306140, "uuid": "98a57e10-b0c8-4746-9250-a24436821079", "comment": "Malware payload (RedLineStealer)", "value": "a50651488b7bfbf973bbb764e4afd1b25232c186446f63249c0cedb6587f05a8d1320e0cd4735d92721a7b0f6b39d824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306140, "uuid": "d5c4b288-b17e-41d7-9ff9-97e25073841e", "value": "T1E884B45AFBB610E0E5BAC13895A2312AFC7138A54738E7D797854A0B1B31BE4ED3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306140, "uuid": "be76ef5c-70b8-4c74-8a09-5a5f1501880a", "value": "bdab1795e81f15648da5f6f48846ef91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306140, "uuid": "d29fcc00-4ec3-43b2-8953-8f316dc9dd9d", "value": "6144:tFwR799OIQPd+iXhq+RaoIPqg3oHBcw3v9IliGS16dSg:tFO7DOIQPd+iXhq+RPR9IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691306140, "uuid": "f4881985-e1bd-484c-90b3-9ae001862b60", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691306140, "uuid": "7910a901-a4fc-4635-a1f0-e88c26932929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691306140, "uuid": "07d55dc6-e1b6-4b35-a7a8-21bdfed75658", "value": "737307862171267fd72a88c78c79ba14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff16fd1-33fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691286603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "7601465d-380c-42bf-b7ad-eb32c83bc8af", "comment": "Malware payload (Mirai)", "value": "a639a42d97757a185740aa7cd9b7e99f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "df6bcf5a-ae6e-4054-9a80-92513ed91aae", "comment": "Malware payload (Mirai)", "value": "8f3d893725f862e249e366cc1dc1a18ab4e27c13b5006634161db6c896e9d2da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "b1a921eb-64c9-48bb-8649-5c6fd7344b82", "comment": "Malware payload (Mirai)", "value": "941d2685418fc16f5e44b7f02fb53fb5ec8d65e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "de823385-3a91-403b-bb2e-8a8025c2dfef", "comment": "Malware payload (Mirai)", "value": "7bef2c97d1f345c7b7d068f31211ae8c78b0b5836043a33ad1118d3d34a98d7199d52ead8af9f8ebab6f22c4d1e5d6db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286603, "uuid": "4920760b-52f3-4ae6-b6a2-898b148c9c8f", "value": "T12663E75AF9819F11D4D522BEFE0E518D332367ACE3EE7112DD215B2467CA92B0B7B402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286603, "uuid": "b61a0a69-7496-42b4-a268-b0bab374a928", "value": "1536:+FnCxu9O4VkGeX3IPpVBN3SUYlMYOYlG9lf1icGx2Fv:149XSj3e7BJSUYlMYOlnGxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691286603, "uuid": "c26c0967-c4ee-4efc-b2c4-f1ff44117be0", "value": 70188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691286603, "uuid": "9f779197-bcab-4bd3-8d77-54c0968aebaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286603, "uuid": "f852c945-f425-4ad2-88a5-f3d29d3f60a0", "value": "la.bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6df0dd-3445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691318332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318332, "uuid": "2328ad40-7c87-438e-9679-ac30068a27a8", "comment": "Malware payload (Mirai)", "value": "4f8a75539f5314079e07d3ad440c1c2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318332, "uuid": "ae6bc82b-6875-4528-867a-3cb00972027e", "comment": "Malware payload (Mirai)", "value": "939f58cd32524e3a4cdb4701080475c3c7c3d47a6c8430eaa3c834888b13473d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318332, "uuid": "f86e54dd-9b1a-45c1-b073-31dfcdb357b2", "comment": "Malware payload (Mirai)", "value": "6a700cd5682d3d3d43814b2461796f31e63ff510", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318332, "uuid": "db914093-946a-4ff5-bf50-4c031c58ce80", "comment": "Malware payload (Mirai)", "value": "2d19361a432f292cdabe2650de6205b8789275448cefdef5a13ded9e3ecbf943f94f51f614baacf57a4b5ec04528c923", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318332, "uuid": "75c7a222-672c-4353-bca6-e27ec42abbc3", "value": "T198539EB5C5B8BE98CF699278B61088389723900565A33DFAE741C796D00BEEDF04D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318332, "uuid": "0e373edc-2820-402c-8ac3-2c4556c8f899", "value": "1536:h/bib8hun2a2wt44luZosLlNB06yYZfs3wtggc18o/CxV2:hji52dulelNBFf+ym18o/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318332, "uuid": "87a9c091-57a6-467f-8b88-57b3e4ec3919", "value": 64356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318332, "uuid": "04d42d2d-290e-4819-a078-0dc2ae501e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318332, "uuid": "40367183-ffc9-4bc9-89c9-f54f499e57f8", "value": "4f8a75539f5314079e07d3ad440c1c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cb123d-3445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1691318421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318421, "uuid": "e3cd2181-2b2f-4267-9c20-240eef1bf113", "comment": "Malware payload (NanoCore)", "value": "f6b28746c5c34743bd7b20377817b27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318421, "uuid": "6c51d987-9eb3-4e89-ab5f-21bd2f5b4cf6", "comment": "Malware payload (NanoCore)", "value": "93e080fc54f12414da2606f38855227f8e90bb50345a3bbd082395ee359bfc4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318421, "uuid": "2979d94f-3554-4d45-bc3b-9b2fd4675811", "comment": "Malware payload (NanoCore)", "value": "4b312325f7e828cf64969b4ac284d0100603c4b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318421, "uuid": "313070d7-0c24-4208-9fdc-9b3d7b173999", "comment": "Malware payload (NanoCore)", "value": "e53b80613a1b9b5fb2c8f82ae6d1a298263a49f2020cdc019838516d3887474146dd9bb07040f56a2a4557b5919b7bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318421, "uuid": "b59ce22c-6090-41a6-950e-cc00603e2002", "value": "T1A8648C9C726072DFC86BD472DEA86CA8FA50647B531F4203A42316ADEE4C997DF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318421, "uuid": "abc8090c-ab90-4a13-950a-f66bc4bff481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318421, "uuid": "a729bcc2-94f6-431d-a5a8-185c744fbba4", "value": "6144:9zu6tBAgLleLEYTz0/aDw8UVmILLLSmyUeDcSs7bciZRAjbq7Rs37qE7RYHmPLL2:9zRwLEYTzZw8SGDct74iAbq7wqE7RYHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318421, "uuid": "4bfa7543-cbc0-4cf2-9651-fcd513f47ca5", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318421, "uuid": "27ba4242-8733-47bc-8c36-88f3ad229a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318421, "uuid": "a0a097a2-460b-48e2-86bd-1deaf8d9b04e", "value": "HEUR-Trojan-Spy.MSIL.Bobik.gen-93e080fc54f124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6a91b6-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315456, "uuid": "ad98b7b5-0b65-4c1e-ac7b-217b939d4dc6", "comment": "Malware payload (Mirai)", "value": "9a16fed0617b86683730493dcf625ac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315456, "uuid": "2fe7432f-36d7-49e3-9440-3443a3c9a197", "comment": "Malware payload (Mirai)", "value": "9694f7fe36d62c20af41b8ec3be37a75dcf216ddc15a78c96da6e6a426268ea2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315456, "uuid": "324cf134-c248-4991-8d8b-23da5046f3ca", "comment": "Malware payload (Mirai)", "value": "d0f2dd69931afa4d3eac1c7ce3b4892ee8ef0fb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315456, "uuid": "e671886f-94b3-4667-a8ed-06c7ab7fda8b", "comment": "Malware payload (Mirai)", "value": "d288b7b6be0aee81a884b7f96165b807429eec6783b3996173e22ea2acfafc004bf0bb5f5cfcaf86f1ef57e145f8d93a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315456, "uuid": "ed840289-4484-4336-923f-f74432b88a3b", "value": "T153C2E13442DD60B2DFD01C7291FC95C917E6D2F0EAA53231557133BDF99A15421AC722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315456, "uuid": "e5b52f7a-5795-4e3e-970c-2ebacef64b3d", "value": "768:AZ0LvyCiIjO7T+9TNqgLJuWsSG4owbBgb12ozSQ4tGFT3Ux:A2Lnin+kgoSdXFoytGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315456, "uuid": "d4a77e59-343e-4afa-a8e0-fbd0310a8557", "value": 27984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315456, "uuid": "73d5646c-7056-4d31-a7fb-122cb0edb9e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315456, "uuid": "d583fc75-3ded-49d0-838b-a2cb1593aa25", "value": "9a16fed0617b86683730493dcf625ac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef29f064-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691326706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326706, "uuid": "96ec4626-33a6-45dc-8fb0-71065ea62444", "comment": "Malware payload (SnakeKeylogger)", "value": "fe2c051a9160b6207a186110b585a5b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326706, "uuid": "0381aedc-3de4-49e3-9a73-429a8cd3e95f", "comment": "Malware payload (SnakeKeylogger)", "value": "96a6df07b7d331cd6fb9f97e7d3f2162e56f03b7f2b7cdad58193ac1d778e025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326706, "uuid": "9b2d633b-7f2a-4334-bc5d-32d218d2ffd8", "comment": "Malware payload (SnakeKeylogger)", "value": "2b8b55fc8831150639c3dd3f531dd41cbec5408c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326706, "uuid": "7e2d88db-3695-46d0-b2e8-7ed294b80de1", "comment": "Malware payload (SnakeKeylogger)", "value": "7cf65d2ae3a7d5f1047879afef8068e87fefc9b82edf9e85a9ed49c717c1e36a094cc5bafc2ded070a216dc2a4de0864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326706, "uuid": "1d8499c1-fdf7-4b27-9057-03b21c40cc85", "value": "T164D4D02663A4DE05D0BF037D8152562183F0ED258607E75E1B8970FEBDB3362CE666E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326706, "uuid": "82bc9306-fe16-49e4-9d71-bfc21be38939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326706, "uuid": "305dbf0d-6775-45fb-8d00-66e6b6870297", "value": "12288:sJwCjrhy3QCS3hDCKzgLAq4dEBRdotb4qhObg6Qd4wlTVeoMbSn:EwCjrhy3QCSBzm44oF45H0bmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326706, "uuid": "16c09655-6e67-4b23-893f-676079f67494", "value": 623632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326706, "uuid": "49e4971c-d3a2-4eb4-8eb9-58b2e926b372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326706, "uuid": "2534ced5-7842-4d08-a130-4ff83866a065", "value": "fe2c051a9160b6207a186110b585a5b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95403a8a-3487-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691346742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346742, "uuid": "111163a7-fa4b-4d0f-992f-7e254339ba2b", "comment": "Malware payload (CoinMiner)", "value": "e4f6273b9485bcc92958aeebae874db5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346742, "uuid": "4d763eee-33fe-46dd-9415-b8b9b63934fb", "comment": "Malware payload (CoinMiner)", "value": "973e5dc9e25de27e159223abdc7c33c572bd689b7eb01519558268513b655658", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346742, "uuid": "8bbe82be-1fc7-495a-88f2-be4d1ebf858e", "comment": "Malware payload (CoinMiner)", "value": "2c46e1444fadd78b6573bdec8c903cba6485b4cb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346742, "uuid": "0a1b5f47-e84f-4a8b-b76e-b35e9264a8e6", "comment": "Malware payload (CoinMiner)", "value": "be911b94c1f0bfbe40bb9d56c4d36caef2b0abce455c555b0a6f06e41f3a940a1f44b204ee8f85bef4a80ee159f58e50", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346742, "uuid": "9f8f9d63-1958-41a1-8d16-cd230697099a", "value": "T18B546C1362E16860F6374A338E2AC6F8EA1FF951FF1577EB12589A2F09711E1C672311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346742, "uuid": "d29e93fc-6482-46e0-8320-0057f41a7aff", "value": "088cd9e5d803c1f11555296e944be32d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346742, "uuid": "82d43891-b1f2-4966-af01-0db363ba364b", "value": "3072:GDAfqOMgB90/J4uHwaeREmzKSKkvEL6tDKqrkbeMkFlg23uN:kRngBg41BEQKk8L0D/4bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691346742, "uuid": "6b9c8e45-620a-49b6-9d2f-56572eeaa6c9", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691346742, "uuid": "964eb594-cffb-49a2-a659-faeae58352e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346742, "uuid": "5fe64c78-9732-44b3-8363-36163bfd0f01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71c3f8c-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315445, "uuid": "a471b3a0-b601-46b6-85c3-119feab71492", "comment": "Malware payload (Mirai)", "value": "40ff3b26ca248e8fc2b376f4603e9abe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315445, "uuid": "d76f3bae-30d3-4a98-873c-823cd1ff4015", "comment": "Malware payload (Mirai)", "value": "97bfb54932f760fdc9f094340fc5256078c1210ffc34d44f371ffda2b4897553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315445, "uuid": "6eed3642-016f-4eb0-abd6-0d87a6484304", "comment": "Malware payload (Mirai)", "value": "80c2d79165a4308ecab08e7274eb491d4c326c00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315445, "uuid": "139b361a-c097-47d7-acd5-362fb5588b25", "comment": "Malware payload (Mirai)", "value": "1e302389875726ad103c424d7c3b6a2e98adc809fb10c581cc5ec6e877b1ec18fbe1babe1e02e5ebe54b345474a10627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315445, "uuid": "d75f959c-46e6-4933-99ff-57f4ba2efa1c", "value": "T18AB33BD784061E6CF4EEC1B6E30B0B097451921C8FE50E2BE761BD9F6E711A6F94AE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315445, "uuid": "3d493e6f-0109-426a-a426-3bfb4cd13d7b", "value": "3072:hbpM/DzgS6w0JKZLUreiTbXq3YPGtm1VPKU7/zlMwkA:hOL8MwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315445, "uuid": "45256f0c-70e4-4967-bfdf-471efb4f5f39", "value": 108524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315445, "uuid": "87a37414-f099-4b4a-8858-df80f6c40723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315445, "uuid": "4642b715-7d97-4a03-9fd5-ddc46603c200", "value": "40ff3b26ca248e8fc2b376f4603e9abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013c2dec-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334038, "uuid": "9a324f7e-9d34-4f9b-b564-5c85436c325c", "comment": "Malware payload (Mirai)", "value": "6e1c7a1717d14aa07e3208b83c5e1bfb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334038, "uuid": "27e68466-8560-4561-bcc9-d4066641aece", "comment": "Malware payload (Mirai)", "value": "9ccb28dbb56c1b6a631624a474e78264451226f9e44336477658b0c56bd9c7f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334038, "uuid": "9f8cc3f9-0b25-43c5-9c02-ed8afbfa60dc", "comment": "Malware payload (Mirai)", "value": "3fcae6ee865fbe21aec5a3e0bc3dbb6fb0780121", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334038, "uuid": "83eba93c-daf5-4ec4-9ae5-1f9b92dd8b0e", "comment": "Malware payload (Mirai)", "value": "007995c7244f9a318e53131439ce43db9a777da11a646dce8625760833831b76c0bbea21b20b48ff353898826ccf8506", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334038, "uuid": "ba1f930f-cb26-49df-bae5-7b99bd7dfec6", "value": "T1B314981E6E228F7DF268C73047B74E25976923D627E1D684E2ACC1105E6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334038, "uuid": "d81a942c-ae3f-40c2-9b39-af9fafbbe495", "value": "3072:x36ZrQ1yHNGjNmX6JTHPcp6sZYVR2eHJwW4BZHsh:x36FtMmX6CYZA4wWQZMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334038, "uuid": "ebe19a00-3f9e-4240-8222-166fb6814242", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334038, "uuid": "1d10ba8b-38d9-435e-912f-e2d0b13b6252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334038, "uuid": "f97266db-6bcb-4654-b899-ee056456f894", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17db377-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326683, "uuid": "45f40597-a18e-46af-b9f3-010abfbc1d3d", "comment": "Malware payload (Mirai)", "value": "f37246c4764c1384ea337cadcaf80f59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326683, "uuid": "3e89fd3c-6efd-418c-a3d1-3711ff8321c7", "comment": "Malware payload (Mirai)", "value": "9fbd8c6362ad6066d5fd26840b6d0a89755b06ab64bcd11409b26dc7a12a1e15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326683, "uuid": "8df0a427-86ed-43dc-896d-b60e967cb3d9", "comment": "Malware payload (Mirai)", "value": "8aad0df0c1ad8331c2553a681dce056f5cd1f330", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326683, "uuid": "92b5e6fe-b5b0-4786-a60c-f4b2e4daf77a", "comment": "Malware payload (Mirai)", "value": "1726c998de687fef3e9bac8b374f4f6cd240ee688b77378fc05c072e9ec368c08ced3a4bff39755845b5bd3bebd5ca79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326683, "uuid": "f05b77ec-f4ac-4b63-bca9-3fe8e1bd7b73", "value": "T14EB2D070609E1271C63058BF7EA98324B6AA02F5B5FA7E22B414077DAEC76472260393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326683, "uuid": "a1fac036-c5dd-4242-8506-0958375919d6", "value": "384:4CTKz9PkfZD5KdUgf3wdysmiENBMyENcO9OBXxx0G8+iuLhymdGUop5hu7h:4CTK+B5KdUg/wctv/JENcO9OBXxdpps8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326683, "uuid": "7f15c974-0043-424c-ba42-f0da873ac3b1", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326683, "uuid": "a70ce64b-f590-4d9c-935f-1792b8fbd8de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326683, "uuid": "43e17f71-1c57-4d9c-9fd3-c9520d37745c", "value": "f37246c4764c1384ea337cadcaf80f59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d958eb7f-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326670, "uuid": "110d644f-7bb3-44b2-b57f-bfb7923314ad", "comment": "Malware payload (Mirai)", "value": "106224563845bcd615da70766a3c2e40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326670, "uuid": "f919db24-b9c1-4954-a4b5-d5a9ae7d1142", "comment": "Malware payload (Mirai)", "value": "a05e8fbd806859dbacecce46c61d2a3420501d61741a914158ed3a1c7d75f15e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326670, "uuid": "27182d9a-f9cb-4a14-a59d-273fdb048f65", "comment": "Malware payload (Mirai)", "value": "d853cc7706ce3406b5c4e097437e3a0e5fcc54ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326670, "uuid": "5566b9dc-4801-439d-872a-ea03fe02c956", "comment": "Malware payload (Mirai)", "value": "df56f8a3d7f1314338e27e30e7926c60f814fc9215cc26845a3791c2d1ca607b5526a7d40e1589dcff7a11626032ce7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326670, "uuid": "72eafdc8-ea54-4c11-8f76-e36e8b846d6e", "value": "T11FD2E10E76AD915B8F6D8EBA5EFEF0E6B021A0724255070A7504DC435DBF351DB4C88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326670, "uuid": "2790c785-47a5-4ffc-8193-b79c844d15d9", "value": "384:MIdXExEykqH/Khlq7vN8usYf23S1BNF+XjmKvCeGSYXgcxHnYwtFo4fxNXYyXBUs:bixIqH/iYfBOX2eMQcxHY4CsxZL2PaGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326670, "uuid": "c7fe1261-17e8-42dd-809d-8f0d4fd19666", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326670, "uuid": "d8b7a157-1086-4889-b5ce-2ed182611020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326670, "uuid": "a7f626e3-4dbc-44d6-a5c4-6fbb7395a8b2", "value": "106224563845bcd615da70766a3c2e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c987a-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "e3f5502a-8690-41f9-92d1-c8c0d658f655", "comment": "Malware payload (Mirai)", "value": "c89a38f9b9a5f7185006e47b549db2e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "0507dd85-9940-45df-aeda-051ef661cb0f", "comment": "Malware payload (Mirai)", "value": "a0f7fd0778ab85796d370e8ba24bce1bbb5466d3f7112d05b8666f074fdddac3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "522ae40c-d50a-4ba2-9e0b-28e1ca4d8de0", "comment": "Malware payload (Mirai)", "value": "0348779d436ef8f63fa3c0180f0377b806f3a3b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "f3e07cb2-3687-4494-aebd-57f6a244c1cb", "comment": "Malware payload (Mirai)", "value": "336da40fb5d706362b0a1c36a822f070b9c13bb8812f471227d20c4a703b4136998bdfeac6aa9f9b32c9daf2465289ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315404, "uuid": "33af2349-6ebe-4cd2-a703-721d44ec3088", "value": "T17123F123F1FC8891D4D980313BEA36475E10B24F915CFB592E9E607A8DCAB6C798435E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315404, "uuid": "0bc0df27-522a-43f1-ab7e-8821dc4510ad", "value": "768:vWyi5uDGqnYVsxpkO0FVbLLyk/0qpt9WBQE33QzfKRtgVEdYpDQ4Yo29nbcuyD7a:vVi/q6sXaVGzIwBQJfKRtgVCYpDQ4YtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315404, "uuid": "000f0dd2-994c-4759-b4b2-d4962fa8bfd1", "value": 46360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315404, "uuid": "79ed4a24-77a3-4734-aefc-1cb1d499846e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315404, "uuid": "40e3de83-4185-4d9e-8300-ed58a1ddcc6f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922e252c-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329557, "uuid": "7510fe2b-3323-405a-bb06-ee59d6e91adc", "comment": "Malware payload (Mirai)", "value": "9214d3e9009eb55c5de73d7a33e259dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329557, "uuid": "04a376a1-dc24-4771-ace9-96fc1ae69009", "comment": "Malware payload (Mirai)", "value": "a32a244969eb549bfe7664785917babf4bedf532787ef9206644f95ca62f434a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329557, "uuid": "d5c9b7e5-6149-4949-ab9e-5ddf86119af3", "comment": "Malware payload (Mirai)", "value": "3a13ceb2e29813413c2db64c5bcc02543e39d7a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329557, "uuid": "ea6d789e-e0d9-47e2-bce9-81dc2fb410e6", "comment": "Malware payload (Mirai)", "value": "18d95ee767305206468822ee25537a60db603303e2d43c943d46d4ba28be1a91a9917396faaf90cfe363d9af5c5797e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329557, "uuid": "a49359c5-34ce-4251-828c-ee20c18a32a3", "value": "T1B593B449FA64AB29C7E232FEFB4D028E332B1BA8B3E67015DD305B4523C8B965535121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329557, "uuid": "7a4e572e-cf60-4de9-b4a2-c48ea5b34e3c", "value": "1536:yQnVg3JGupwcCrQ0Cx3BICKnyEXw0GBFQaFYcMiHzLa2lFyd0iRIwermnnnPHv:r6Eup/mQ0CJnEgJQaFYcMiHyXIwQmn/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329557, "uuid": "8cccc30e-3ea1-4b49-8f12-6a114360fc59", "value": 96436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329557, "uuid": "5d853d1a-9c72-4863-a60c-321b7f623be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329557, "uuid": "cc48956a-e754-4443-9032-d086e40d4371", "value": "9214d3e9009eb55c5de73d7a33e259dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3317dd84-34a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691358603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358603, "uuid": "99ee3df4-bb03-4252-a34a-9dd3ce9a8139", "comment": "Malware payload (Mirai)", "value": "bfa298844de755b6a8884a4c29492a32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358603, "uuid": "54061420-7474-4765-b31f-3ee7850e4c42", "comment": "Malware payload (Mirai)", "value": "a3f8f798f52a4363c10d9eb260a6162c099a359cb27f72932e09af3aad583d01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358603, "uuid": "e81d0031-2aa9-4013-82c4-f2551009f8bc", "comment": "Malware payload (Mirai)", "value": "d45d01827c1bf48369e1bf5d41c6dc78cd327a2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691358603, "uuid": "74f51a4e-afbd-47c9-8416-d501949ac62d", "comment": "Malware payload (Mirai)", "value": "13ee6fd6bd5ce696c3e96421e2276da68c7b44812bb7763df091f826e8922af369e8482fb2501555d7ad44d9c6d0d353", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358603, "uuid": "73330e05-8acc-4049-85df-4604e176feff", "value": "T1F5C339C1B593E8F1DC1546B8312AEB325E77B07B613BD987E3E85E636C80A41C4076AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358603, "uuid": "40ce51a3-27cc-4c81-829e-8d08b3949f37", "value": "3072:Vbz33/sH/7kzsljKElz/QJpLMfs5DNNM0ryNNSsWV9Fc5zsm:V/3EfwAhDh/QJpLMfs5DvHryNddR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691358603, "uuid": "4be1a76d-6a35-4f39-a181-8c862c63bf15", "value": 123696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691358603, "uuid": "b9a57cce-99be-48a8-b591-cb915d4b32ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691358603, "uuid": "23ecb5da-77c5-413d-984b-84da2b23f821", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3a10d5-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326678, "uuid": "056bc321-2b80-4c52-85c8-fd31a46d6462", "comment": "Malware payload (Mirai)", "value": "1b9d6be41115ddc57856980134b55491", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326678, "uuid": "af447ee3-8c38-4a09-b715-c46bce9aea59", "comment": "Malware payload (Mirai)", "value": "a4110df5324760bf0708b6f5bace5b102c99db415c5e0543f7d54477f3ffa584", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326678, "uuid": "f63d88f6-06d5-427a-9a4a-82f45552c822", "comment": "Malware payload (Mirai)", "value": "8108df2a3d8e69ca0cfe36a8bb43d17ca8b5a747", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326678, "uuid": "0d1373de-c959-4cab-851d-dcf703a0f51b", "comment": "Malware payload (Mirai)", "value": "bdbf9100b97f7fded2f76454982655993ac5e8a097f2758cb79f1bb936e1f8b037734de9632eceaa9b027d28a46c7aa6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326678, "uuid": "0625dea2-203b-4e41-81f3-e0588df083c4", "value": "T121D2E0E755BB62B5C036FC70746046D8FB3C3507E22A0B6F05DAFC686EB50550BB0A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326678, "uuid": "e26b3a0a-5286-4d3b-b456-7547dc85f6fc", "value": "384:NuYRQoX9/JZ+WkZYkg3h5B5xnmZPSa6mHSNeWECF/PHSw/bGP1RaYSAKnUxaVXAC:8YSoXdJZ5U05VxmHSNJ3PdGdRUfSx0sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326678, "uuid": "741d8ce7-1763-4f55-808d-e546f4112b68", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326678, "uuid": "8d78522c-1fb7-4991-b5f8-6abf9da7190e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326678, "uuid": "5fa094e7-c354-48df-8ab5-9371b03fb22d", "value": "1b9d6be41115ddc57856980134b55491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549c6520-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691348351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348351, "uuid": "0aeed783-2371-4973-a1ce-c11f4b62c05e", "comment": "Malware payload", "value": "959846099a5a81b73471d8dc92c09d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348351, "uuid": "952d53af-dc7e-4bda-bb96-3daff3f74f81", "comment": "Malware payload", "value": "a426128d628b2a674fac2338837129c873dfdd26bcaf9b320efc4f0f614283be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348351, "uuid": "66277bb9-3418-4abc-a6d7-233b83fd3042", "comment": "Malware payload", "value": "978d85f92553dec494d027a0f3e3f95273a59006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348351, "uuid": "f61962c7-39da-4726-88a7-0c317b16f712", "comment": "Malware payload", "value": "acca2043fab1bf1bcb38b2c60e55d158bf678077e20a029df61b1513aaa0732c44652801d06be1b51555a9419193a9b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348351, "uuid": "f28ad4fb-a0d1-4269-bab7-63bb25c7409a", "value": "T106F533079CA234EDEF015836BDC9CBCC27081E795F98703A7B28F3D59A694EC9522635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348351, "uuid": "89418b4c-43b0-4c7c-8da6-4dcdcc3742bc", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348351, "uuid": "68dfe8ce-ded7-4944-b757-9a0e146c6a63", "value": "98304:OmZFNT6G57EQYH5uwRhNJ6PNr1X/MC/+nNB:VNT6GZkH0ChW+nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348351, "uuid": "e390a904-c38d-479a-886e-34ed9f720ea9", "value": 3550720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348351, "uuid": "d60f4ef8-f5e7-4883-9a44-f3ef7455d8d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348351, "uuid": "79d67d7c-4e09-49b7-bf29-0df48aecb268", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1b06cb-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691311803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311803, "uuid": "bcec926b-ce53-4d99-a4bd-460549048845", "comment": "Malware payload (Mirai)", "value": "3483773df2b9169a1c059299a454248f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311803, "uuid": "5e10b42a-cbc2-466c-a99c-af8230a09dec", "comment": "Malware payload (Mirai)", "value": "a5414158130444792bbe40babc13e863001fc2691bc84c93c3205e3fece3e861", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311803, "uuid": "c8f3efc2-cfb0-4e0b-9f9e-858ad28e0a37", "comment": "Malware payload (Mirai)", "value": "fd941d8bc0bb163f5749ac13299c33cbeb2b00bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311803, "uuid": "69399907-1dd8-4f8f-8a08-0d0bed0bb078", "comment": "Malware payload (Mirai)", "value": "bc7897f9f247013bc12d27293d2930fd6720c5cc02d79105421091f4b37d9ed5f92d84ffd222cec46510ece5d138a521", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311803, "uuid": "1dcc6490-4a4d-4b92-9b8e-73233f498d1e", "value": "T150430264A582D6B6DCA2E8306940D3AFF3800FF6C0973838527646376642A4AF7ED54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311803, "uuid": "bbc5996d-475a-4e5e-b032-b37de0c05c00", "value": "1536:GKlwB0ThaMjO8OIVVHcdS9JbfusJs+SzTYrCVs1:GwxhAIVBcdyJg8Cq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311803, "uuid": "f5ae5a72-4135-4f97-930e-d525fbaaafd4", "value": 57288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311803, "uuid": "43a57baf-b898-411e-aa64-937c1e9fdd1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311803, "uuid": "204a7199-ce4f-465e-940a-c2102adb4e4a", "value": "Chaosontopxd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e23b3e4-341c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691300720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691300720, "uuid": "f8091fa8-1cfc-4f49-a682-b2a202a85e83", "comment": "Malware payload (Loki)", "value": "d543eac20fd42042a6f353ce50ee7b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691300720, "uuid": "74333b5a-fdf2-40c7-ae9c-cbe2c32d2998", "comment": "Malware payload (Loki)", "value": "a5d9266bd64b0bb3fc1fa6fe9da781141bc7867d6381601056823cb2d80a655a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691300720, "uuid": "7fa0ee97-f32b-40cc-b625-53f90f0379e3", "comment": "Malware payload (Loki)", "value": "67e5cbca958fb237ff8735425ba0ec3227fd0e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691300720, "uuid": "5849c671-391b-47f7-b364-514e295350bf", "comment": "Malware payload (Loki)", "value": "1fec4e4b7e711f0ebb8f8f7b7f1d1859a911e64f912567faf08e5238e183cddd97a91dc4e9fd6263f15fad00438c8b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691300720, "uuid": "984e0751-ffed-4e6f-9084-1354fdff9605", "value": "T1DCE45BF8F5A998B1C54DCB72D794ACAEEB2211FE5243092C06B9DA8C1F0379E9F5C444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691300720, "uuid": "81d6bc0f-6260-4656-a816-95604c0b76be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691300720, "uuid": "53bea81d-4ea1-4fbc-b6c6-4d3b865dbf89", "value": "6144:yQpCbw7ucBT+OQ7Rn42FKOG7k1TxBfZp079qiPVOcL963R4RCKON3CX4a34b/3md:ygBvTwRnhFbGg1TT077PvBsCCuoaomi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691300720, "uuid": "e88222c3-383c-4ae0-99e2-c437a269002e", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691300720, "uuid": "a6d6c1fd-265d-4a40-869a-3b1e7be87d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691300720, "uuid": "027675b2-a97d-4669-b25c-42907c8f8c1e", "value": "HEUR-Trojan-Spy.MSIL.Noon.gen-a5d9266bd64b0bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d64fc60-3483-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691344823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344823, "uuid": "3ee64ed0-280d-4647-b980-89987cf79e4f", "comment": "Malware payload (RedLineStealer)", "value": "76c2c540441ddce7bc1aa9891366e5fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344823, "uuid": "f98cfc43-8854-4688-864e-2ec0b8a699bb", "comment": "Malware payload (RedLineStealer)", "value": "a61f4ffa1c4ed9273c8e353f0c63e908a8304755577b7bed086a4978be7a20c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344823, "uuid": "8ac39ab9-4a62-4040-ab8a-e4e2a8ce1be4", "comment": "Malware payload (RedLineStealer)", "value": "79e153e5225f5bcbb7cb285c4d6402c40e85e712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344823, "uuid": "38d99360-76d1-4061-9ebe-bc81e1efb5d1", "comment": "Malware payload (RedLineStealer)", "value": "9ee50c7d9e9e4d4643e6d4061470ba3e881cb618ff29ee85d794703d3e0a62c6488d8e497c98341621b66f29d24d3856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344823, "uuid": "7de606e9-908b-4515-96be-841674a40f7e", "value": "T1093407B64E85991FDFD3F63DE41D0BC63CAA9B6232CC400679067DDD8A69EA4422D331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344823, "uuid": "1ccda7ed-052b-4404-b5e3-ba2774e6b67c", "value": "035152f08fc01104c539a9694e78d939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344823, "uuid": "503bd168-ee44-4185-8699-3bc66b68f4a9", "value": "3072:OndsJfmxVje3RWyjdKAKYrOW4ic9sTbbSpIpEf13dDKdLAmodP9z2pkFw5zstHtH:H9mxVjeBxO7wbbSpIpEldDKdLAmoBcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691344823, "uuid": "8aa8a704-b89b-4b15-9f02-dd5b70829c0e", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691344823, "uuid": "67365402-bcf7-422d-b01b-1cab545b1241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344823, "uuid": "f7795083-776f-4079-8a75-41c1e5ef722f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dcf446-347a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691340975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340975, "uuid": "1e4ac5e8-0f94-449b-a415-6a79185fecea", "comment": "Malware payload (Mirai)", "value": "bf32b654a8a2dc7c07f532af2e90b545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340975, "uuid": "363483d7-07a9-4b17-9590-73e7a0bcad91", "comment": "Malware payload (Mirai)", "value": "ab365de284337f9530d34ad825a6fb17e1b1decca84d0e1977169a9cc33749c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340975, "uuid": "6384be4d-1ca0-4c46-b01e-32182354a13d", "comment": "Malware payload (Mirai)", "value": "f5f675c5aec8604f64285234493c9b19f3f3fff8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340975, "uuid": "36dbe26f-86b5-495a-9b00-d45b910c1e83", "comment": "Malware payload (Mirai)", "value": "14e67c5708214f58997f6a8439661650354a1623abd6e3b2c6885b68ce5114af74de1e2444581d5c3ec593fb9f4b0902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340975, "uuid": "f5074314-8b80-43a1-8424-e194e8bc240b", "value": "T17CA2C05193DBEC71C2702574DA9C8A86731B3731B0EBB272252803A41195D4AF6FDED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340975, "uuid": "0cb338e6-1099-4096-be44-f06e8224dd97", "value": "384:KPybssAoRZlZVMV8yxXs/STDOlJU8eD8U21Af9TSLuASzthymdGUop5h7:6uXhRZ7VMVbKeDuSFTSuzts3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691340975, "uuid": "7d94cded-303d-43a4-a01b-47488b9693fb", "value": 23376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691340975, "uuid": "cc34b038-2f0a-4b94-843f-473e271a3edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340975, "uuid": "0e7a545c-458d-4ee7-8a63-e309de691a3c", "value": "bf32b654a8a2dc7c07f532af2e90b545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61666117-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335488, "uuid": "79aed7e5-6494-4132-9855-8c1742a708ac", "comment": "Malware payload (Mirai)", "value": "f68d4f719b219da255f2d3d552140e58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335488, "uuid": "f06cd322-d4ec-43d4-b055-9a6416e7f01a", "comment": "Malware payload (Mirai)", "value": "ac0151ff4434a5bb31a4ecbfecc0ba66a6deaf344b6a10a9abf7cce7f6eb094a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335488, "uuid": "f89f9bb6-2b2a-4b0e-85fd-a5cbebd8db91", "comment": "Malware payload (Mirai)", "value": "9ed4c1c16a9e9d952e1c7745e12db83a2b78e04b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335488, "uuid": "0b039834-6911-4745-9392-0feaa6ae3a50", "comment": "Malware payload (Mirai)", "value": "c11109f7201c14a5e327e8ec928b0b07b9e1e86ca5f443a68d3023063f28603b6b10264b6e9a90c6f1234518107882b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335488, "uuid": "36177c55-4cb4-4e62-b55b-12f7226bf6f0", "value": "T18CB31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335488, "uuid": "533c8a37-b528-49dc-bdf3-77dbecbc1157", "value": "3072:MDVLSItJP+Xsp4JlN3HZjmH1cuEgvniuN/:MDV+ItJH2l3HZjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335488, "uuid": "21099963-965c-4170-a249-82a7eb140259", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335488, "uuid": "87a98957-8204-410c-b06b-7bffba609b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335488, "uuid": "7068e8ae-3e78-417a-a8cc-8386b898557e", "value": "f68d4f719b219da255f2d3d552140e58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4466b503-3436-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691311817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311817, "uuid": "1139d8d6-a975-49a6-a4d7-fb4f8a21ec7e", "comment": "Malware payload (Mirai)", "value": "9ef51cfa65abb2a58b38e351c60ecece", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311817, "uuid": "235420f5-6e59-45c2-b4cc-e52acd1baed0", "comment": "Malware payload (Mirai)", "value": "ac9c41b97f1a108bd9983bbd33388391830d4d6399d8a4000af85d88b3e45e6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311817, "uuid": "3c2c0b64-7359-4f93-8a47-4ee8318fa64e", "comment": "Malware payload (Mirai)", "value": "ae225727375c2627cc9703780c729aebc10a0ba4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311817, "uuid": "2cb84194-17f9-467b-94b7-3c54ccc0d3ff", "comment": "Malware payload (Mirai)", "value": "925c861db8f937cacbca0965ead83f4e663f48d48ebff31a4ca0e3bddc35396ceb8c10336f371f4cce6ffa7d5eb43e14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311817, "uuid": "ef556680-83be-4b65-ae70-db7530957779", "value": "T119E2E1254B4CB855D5A10C77F2A34D077E39BC7DA0CAE1F2368A933E83E551015DFA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311817, "uuid": "e004fbde-9b41-4a96-ab95-cd0911b67c9a", "value": "768:A5PsVyPSza5RIgXVTYuC1sQbROOHzoTENzIr/Pgmu3U9:A5PsVt8NC1jbRZ90rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311817, "uuid": "5dd82721-86e7-4d47-9960-12b98bbda52a", "value": 32184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311817, "uuid": "ea3993b6-23e3-4014-83ed-bcf696970a4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311817, "uuid": "2f2523cc-856d-4121-96f7-a18e197bc835", "value": "Chaosontopxd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ff4586-343f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315762, "uuid": "ca820aa2-b822-4af2-a997-fdc9f04a64ee", "comment": "Malware payload (Mirai)", "value": "7ecfdf3103d74333cadc284b7acdd1fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315762, "uuid": "c4e007b3-4a1f-428b-b0c1-bfae1f6e5d6e", "comment": "Malware payload (Mirai)", "value": "ad91fa5ec5a148ddf1ba97215aa15a17b914fb73c01b7b056a8e9918e08b5e05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315762, "uuid": "32d3d2a3-dca2-4a91-99e8-2bebd3abda00", "comment": "Malware payload (Mirai)", "value": "c99e63916ae623c22b9d3f314b2427e51404bf10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315762, "uuid": "bdb49a8a-5ff2-4c27-9a4a-a6b698af7a1a", "comment": "Malware payload (Mirai)", "value": "2cf71293e922237191f230dc4d5eab23e0b21d049e217fd2f441c7d7489751b2b43f82525dce770e283bdb386a1fc858", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315762, "uuid": "6c2e2a83-69b3-4bad-ac30-74919f5507df", "value": "T1A8F2F150EBD68923D7421476791704079B6D676EC1BE3271836C2CDDCBEA952C1F234A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315762, "uuid": "9eaef7d0-0fec-471d-be1b-bdfffccf4c82", "value": "768:HHFISj91tGfdUeBPsIBnKicsRifMsHCRMgNQ1qQtdk+JleJRJq3UI24:FR91tmVB0IhcaifvH8MirEe2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315762, "uuid": "3e8666f8-05c4-4a6d-a2e6-d6678c801058", "value": 37096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315762, "uuid": "cea4eec8-0ac4-40fc-9c65-c998c8cddea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315762, "uuid": "01efe3c1-7a24-40f2-a292-72b328ea45bd", "value": "7ecfdf3103d74333cadc284b7acdd1fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bf0740-3411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691296069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296069, "uuid": "6c52b889-6a50-44be-8699-5d36ddaa8393", "comment": "Malware payload", "value": "82f185e53580dc611c7eafc6dbfd52d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296069, "uuid": "f653d376-aeae-46bd-913f-488782d43317", "comment": "Malware payload", "value": "ade5b4704e03f16abadeff8ae9429477fde63f575ac8df4f440fd5375877a777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296069, "uuid": "05d8a989-b5da-478e-8fc4-4a2473c9f828", "comment": "Malware payload", "value": "00354b55bf9c46633f626a73a55272ee1b580d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296069, "uuid": "e673abe6-621d-4cd4-a014-7b6b06c3feef", "comment": "Malware payload", "value": "b07f0c803e020e01f3a4b48acdc07b1ed0561a923980bd2f1e2d0f298f290e7ae70d9c9da17044ac9aea33c27779a18b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296069, "uuid": "b1bcd378-73ad-4923-b60b-d49a0c647f1d", "value": "T1C4034C7B2151C4BCC49AC2B4AA9AE676FA3371390371B11D23E4BD276F6DDA01E6D201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296069, "uuid": "b82dddf3-1ebe-4cad-b677-22726c3d2984", "value": "768:1kmHxTbpkoiXpQFtzCKERoNZbLiJ+owyiJNaetW/a3ckrI8n1:Gmdbpk7XqFtzCHRoNRiJ+nJNaetWar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691296069, "uuid": "3a406f2b-0fdd-4924-8a29-43387f26b55e", "value": 39008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691296069, "uuid": "de086091-e4fe-4c9b-ac83-6f899ec0355f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296069, "uuid": "1cf011a7-cbea-482a-ad1b-2ec84f0470fb", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.16037.19140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee40da6-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283864, "uuid": "626a6ec6-c9e7-4a98-8722-95917baafbed", "comment": "Malware payload (Mirai)", "value": "e7524365a1ebd56771204a3eefe61648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283864, "uuid": "bcd5c4e0-bcd8-41a8-9228-469057750505", "comment": "Malware payload (Mirai)", "value": "ae1a5b9451f7e32001cf2e7d574114f4d45845c6b52c865a885a38ec837b1815", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283864, "uuid": "c9008d87-6c89-4b92-b38c-8bd26df0ae8c", "comment": "Malware payload (Mirai)", "value": "7c63e027d2e99515d4be731912126f2c7f1bfa11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283864, "uuid": "416acc9a-9fe1-42d8-86a4-d354f0c4486a", "comment": "Malware payload (Mirai)", "value": "85f9a5b0ccdda0ac94f3e74f3e4bcae966c584cff42163c93ad02e042703ecb0dc896806b60405c28c65f2de34f74021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283864, "uuid": "a62f0aec-3179-47c9-9620-909638902c1f", "value": "T16E730946B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283864, "uuid": "709b8ddd-8cd9-4ffb-8019-c3dd21b4fcc4", "value": "1536:CNn3N/UWjwGh8JzFIcwMstHCfI5WzRdZvNmSV31sOZz1IhiJ4oe/e5d42+:a/UW9hozFIiod5WVY03N4oe/eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283864, "uuid": "c7ce5e2b-c667-47e1-a056-0a65482ef670", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283864, "uuid": "c8cf9467-0590-48d7-930a-8e6f3d8f64e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283864, "uuid": "8c2ffdbc-492c-4fb3-b4b5-02050ac14cc1", "value": "e7524365a1ebd56771204a3eefe61648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ef4d99-3411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691296066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296066, "uuid": "1bed416d-6cb1-4198-87c4-4a78d3911704", "comment": "Malware payload", "value": "e239fc7685bacf3e333e2725948b2c54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296066, "uuid": "ef07398b-d741-4098-b446-ea5b6543c5b9", "comment": "Malware payload", "value": "aecca85047ae2d5afa0f8a386114c5f46466a9f0ddd960748c4747b256b2d053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296066, "uuid": "ac25a582-6d0f-4636-a0b8-eb7ed7d652fc", "comment": "Malware payload", "value": "f0463826f61234503fd006eb3a25e06e85777ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296066, "uuid": "cd3679fd-6b1a-46a7-bff7-22c5cbff1422", "comment": "Malware payload", "value": "db003ab60a915d81c51f98db86a6acdeb678d5338cd0977efe30ef74c204e4a6a63d2d4ca6fc2509f2cfe9980885ae16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296066, "uuid": "aba2cc86-4064-4341-91bc-88ba257518bb", "value": "T18943F949F9506B25D6D162BBFA0D128F33270B6CF3DE72365E345A2133C6A7B0A39815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296066, "uuid": "2801a651-5c36-4b32-aa10-958aede83681", "value": "1536:O5neO5qpB9Wa7aIe5DM7iuloQYZtT55wYr:IqxWaHloQYZtT5+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691296066, "uuid": "00ef0fcb-4fd5-42c7-8591-cc396084ef4d", "value": 58792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691296066, "uuid": "a6bb2bfd-29b1-4b2b-ab41-f4dab33a905b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296066, "uuid": "b74acc52-fd9c-4dfc-b08f-0b17952aea3b", "value": "SecuriteInfo.com.Backdoor.Linux.Mirai.DA.MTB.7095.13780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d39a12-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329570, "uuid": "8a3dd43d-0c26-45c8-9dca-82e268ddf803", "comment": "Malware payload (Mirai)", "value": "6521492bf1a4516d1aa289873957d983", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329570, "uuid": "3f95e6ed-d05e-4b58-b459-6e324cc61457", "comment": "Malware payload (Mirai)", "value": "afe88778d20ce3f082539df910b838a69a7d9e9128532a8b63fc37c5d105c1ac", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329570, "uuid": "733c585a-1d54-4e3e-a618-971d227452f1", "comment": "Malware payload (Mirai)", "value": "0ddd5a96ea9b9e3face9ed9c528ff4062beb8da9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329570, "uuid": "811911f3-2fb2-4372-8364-eee2d09646e1", "comment": "Malware payload (Mirai)", "value": "dda6f2e79b68b96054a6478f6ac4b55ae1745a74b824f662693e8e59b705fcf38b0b9dab61b02f899905b700f9cf04cd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329570, "uuid": "a4963092-7f1d-4807-88bd-39a4d8199d3a", "value": "T1941308132990C0FDC56EC2709A7FA62BD523F07D2235BB4933E47E266E5AE201E1F549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329570, "uuid": "4d0e36d4-2569-4caa-8b05-87ea2afbdcde", "value": "768:fiC52+ADoPeLvMyk+1TN6m7lRhBQ2gkU02mPL7spT:352F0PT1lm7llzXU057spT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329570, "uuid": "ce70ceab-bc6d-4d6f-8e01-7fafef8c91d2", "value": 42240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329570, "uuid": "09fbe17e-6829-42f9-9d35-186c3db53a60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329570, "uuid": "dc0e560b-0d49-4d09-8325-2a35cd37d1b0", "value": "6521492bf1a4516d1aa289873957d983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe888a23-33fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OskiStealer)", "timestamp": 1691287219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691287219, "uuid": "1ed24aea-658d-4278-b00e-728c32b8baa0", "comment": "Malware payload (OskiStealer)", "value": "b40a86d86b0b2eb794da2090b8ea1535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691287219, "uuid": "f6b5c41f-a46d-488c-993a-c73536f81c06", "comment": "Malware payload (OskiStealer)", "value": "b008e6b92de9b7d2e18fe2712c1c0f2d86fbe86e70093e4c54c490161818992c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691287219, "uuid": "eebf05da-dc8c-469a-aada-48a7737ecd32", "comment": "Malware payload (OskiStealer)", "value": "4d059b2cd846cad3cb1f53447bd5d14a2e648480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691287219, "uuid": "f9b020da-9c6f-4610-b9af-fb6c2ae6079b", "comment": "Malware payload (OskiStealer)", "value": "28f67d89f36ed4baf3da23f59d0c869627ba41559896f02223844b62ae595fa07b1399278e4908444f3a79e6e17479dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691287219, "uuid": "c35051c9-5506-46f2-b5b1-0e426a4c8e57", "value": "T17D146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691287219, "uuid": "e7b6d778-aed3-4db4-b35b-f9bd9c006be3", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691287219, "uuid": "5f6c5b19-5684-4023-a882-99de47062fc3", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIE1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNt1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691287219, "uuid": "0f728a35-43ad-4519-b46a-9fb01c98c7a0", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691287219, "uuid": "8357a7ef-ac30-48b8-8f20-ab0ed65171fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691287219, "uuid": "71cba9b6-678d-40a4-b6d1-707f65bdba7a", "value": "HEUR-Trojan-PSW.Win32.Vidar.gen-b008e6b92de9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ac9fbc-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691348407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348407, "uuid": "a0219aaa-4c8c-45e2-a691-90c79b723715", "comment": "Malware payload (Mirai)", "value": "757a6eaecdadaded9b2b6a25a935306d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348407, "uuid": "376c15bb-17d0-4ef6-b298-84997667a117", "comment": "Malware payload (Mirai)", "value": "b03ad3fcddc994d90028e0f846617af7e3d11ee24303e3a12266b9b7d8bcaed7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348407, "uuid": "26791cd9-5d8f-4a9c-bc81-1caa94120f32", "comment": "Malware payload (Mirai)", "value": "42dff19bbe6cbd0526c3b480b05a70a7d84de275", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348407, "uuid": "7335f747-71a6-4f27-808a-08fb92698fdf", "comment": "Malware payload (Mirai)", "value": "f8396c3d723ba71429ae4335e4359f7c89b13af2bea5caee570c139d9bd2db6263748936f401fd659e3fbbf9965341d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348407, "uuid": "37860aa8-e4ae-4c87-be8d-e392fb675608", "value": "T1A7C2D130A7BD1CB5C6600532F7B856C9BE530FBDEAFA389011009BBA7981D052DDA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348407, "uuid": "0ca9268f-0e94-4609-9d4e-43115c904ed7", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE+aLhymdGUop5h4:ESsoTAZ3alkXLvFh8nNE1s3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348407, "uuid": "0aa01e95-ab05-4f3d-b28c-ba1ee243010a", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348407, "uuid": "6930378e-85d2-487a-a986-dc584bc639d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348407, "uuid": "80fd905f-c347-4da8-9596-ccdcb181efa3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7dfca0-3479-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691340604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340604, "uuid": "43f53554-0e1b-44a5-911c-7c0a323b646d", "comment": "Malware payload (Mirai)", "value": "192aeec4d1de9e9a53350eda9b714605", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340604, "uuid": "8a524dbf-67eb-47cf-92ff-98d457eca456", "comment": "Malware payload (Mirai)", "value": "b1b52f3cc8845090c855a17a5bafdb55df2347a1e6f8dca5fddce7f72dac710e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340604, "uuid": "37cb04a2-bbf5-4e05-a19b-576a9ee50e7f", "comment": "Malware payload (Mirai)", "value": "16c6c234b84371e731e4bbc0a6dab8e936ac7fb6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340604, "uuid": "29abac76-b6dd-4710-b8ef-84c1c57a93ec", "comment": "Malware payload (Mirai)", "value": "f01564f56dc2dcbb8201ebd8c0e0e3466ce14adc98fc760fa8bdcb3f2d27d44034ca514ff0ace92de16099133d5404b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340604, "uuid": "e31f05a0-5e8a-4cf8-abc1-6691c8802d89", "value": "T11BA2E18942EF2566E31053B722D7C93EBEB588648F27817427ED6DC43396173D81C86D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340604, "uuid": "f5ba318f-a029-4167-ba12-a9831d6abef5", "value": "384:MAjvJ3/+8lpCjXwFLTzWmqio/lF1+TJ8a0kZpDgSNyT5Sr1bIv1Rk:fRlkjXwFDMz/lrra0QcSOMUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691340604, "uuid": "a4c62cdb-fd71-4245-8ea5-1dac1aad5845", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691340604, "uuid": "f8a047d6-a666-4fb7-95b5-54b484f5b1d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340604, "uuid": "882e5466-4c00-4b5d-826c-f7ea88b9decf", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c96583-34b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691366303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366303, "uuid": "5a0ba9ad-9d55-4578-960d-203d82382dca", "comment": "Malware payload", "value": "df7eedf5e792339f152bfccf71e5c35f", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366303, "uuid": "9f71a895-32b6-4450-b4c4-0b5165a3f2dd", "comment": "Malware payload", "value": "b22d19557f12b2d3efe7d4797fb78107de0c0a338b5a378ae485dbca3345c2e2", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366303, "uuid": "e02bf3c1-5b07-4a64-a693-1adfdb300b75", "comment": "Malware payload", "value": "ba9ae60e144db4f19326d39422f62f618043d25c", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366303, "uuid": "7a98cdb3-1a3b-45d4-80b0-36b7de66697e", "comment": "Malware payload", "value": "b154c5261d44efd107885663ab9cd169470b5feda7bf0def57e1b586396972b45da25aecda06bd00d4f0531fb605afa4", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366303, "uuid": "aec7b4c2-cfcb-4109-a2ce-12ec5066b895", "value": "T1BA319C3732F4070CD6B5593B58B1BA13972AB40CD90B8B8E32515EB81C5859CE925F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366303, "uuid": "1f13eaf5-c862-40d2-a88b-2e476a1b2226", "value": "24:8NeZsxqsCEBN7oK4BaghW8MA+W/2+/CWbyUECp1cel7pEQeyTppTpZab/2XT:8C5gjc4Uv467iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366303, "uuid": "d016c44b-6828-4eb9-91cc-665b8755576f", "value": 1571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366303, "uuid": "b5e09398-eb6a-4ee9-bbf3-10d5ab0ac501", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366303, "uuid": "5764c81b-bbbf-4172-bb8d-24dad24a0ece", "value": "enterprise-build.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb849e34-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315453, "uuid": "f7215d5b-feaa-4016-8aaa-6e58c7fdf3a8", "comment": "Malware payload (Mirai)", "value": "950907810a7a45c1bdc51cd653d03224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315453, "uuid": "8973315a-81f8-4632-b609-319e96f440b2", "comment": "Malware payload (Mirai)", "value": "b282715e366ad39e4c29bc6122a017dfe64087b01158b0afdf5ada61b211355e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315453, "uuid": "b7548118-6e74-44a9-a443-994ce778417d", "comment": "Malware payload (Mirai)", "value": "d72b89b48af5a3a0bc37f0938de746dc818bf0aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315453, "uuid": "c60f38e0-c17c-4d07-b7d2-0335ff29983f", "comment": "Malware payload (Mirai)", "value": "53fe50d64455b3f5a961737eae31fe09cbe214ecae72c548c3e4de3379e73ae4731d77c07dacafc5882ca0baf0e5f5e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315453, "uuid": "4f33096b-e0de-48b0-99bd-f2f2c8c65179", "value": "T19BE2E1D3D2E12AADD1B7423718FD3C4E0A907F0DE1892BAB27D8A46D9D33E18552485F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315453, "uuid": "0e232f04-b2e4-4641-99e0-60d7a9ce06d7", "value": "768:VienxIi1r/CFBZ4XZU0ci9jj68R00MEEkkwYkzPbqpzI05nbcuyD7UVyqi:Vi0xI8bCEpZJ2G/JEkXyn5nouy8sqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315453, "uuid": "dd5663ee-a84b-4cb2-b136-25e16da9b5c6", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315453, "uuid": "4a197199-16dd-43f5-b86c-9ba0a8b19e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315453, "uuid": "9dbb14c0-0c8c-4eb3-b904-96a230ee9112", "value": "950907810a7a45c1bdc51cd653d03224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6cf556-3499-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691354619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354619, "uuid": "57c7ce84-bb4e-4d15-b0d2-0c41c602217b", "comment": "Malware payload", "value": "ff29fab1b2ae1ab5030787c5644579db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354619, "uuid": "1d1445ae-3596-482d-b7a7-37648358b6cf", "comment": "Malware payload", "value": "b461a8b55374c8d202501d4d898cf5eaf3b45c5249bcb0eb9c367dd6fe93df29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354619, "uuid": "23712645-0b91-4e7f-8b37-06d9427ef59d", "comment": "Malware payload", "value": "b57f74276b0bf1eed4c89ad78baeeeb6f424af1f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691354619, "uuid": "988c5c28-5b2b-407b-896a-2399498c6d84", "comment": "Malware payload", "value": "270bce237f9fd0738465e4117c7241bbb2962316850da78907b3ccff8bc9605a1e2360e33056afc91003dbe6f2a6977b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354619, "uuid": "5823bf75-d7f1-4ad8-953e-b5ca55550f7d", "value": "T190F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354619, "uuid": "d54f4c3d-64fb-4231-8cbd-48d7668f8397", "value": "ba23a556ac1d6444f7f76feafd6c8867", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354619, "uuid": "f2a1b5ae-1681-425d-9840-3b132e0cbb25", "value": "1536:1EGh0orlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0orlqOPOe2MUVg3Ve+rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691354619, "uuid": "698c561e-48e6-4a14-9bed-08f394d67047", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691354619, "uuid": "5b5e813c-ab57-40c8-b817-a47a392b0810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691354619, "uuid": "916e611d-f454-4c97-9a7d-c279110ea31c", "value": "2023-08-05_ff29fab1b2ae1ab5030787c5644579db_goldeneye", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe0ee6a-3442-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691316910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316910, "uuid": "a7976747-212a-4150-ba92-80038a0192d8", "comment": "Malware payload (RedLineStealer)", "value": "40e3e72ebd0927d0d5b0e1cf98b9f676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316910, "uuid": "8848c534-613f-4c2c-9f6f-a5d04d5d8146", "comment": "Malware payload (RedLineStealer)", "value": "b4d16c2fc236efc013f248a71bfae9854bd54265ed7ec7039dd3941303aa5c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316910, "uuid": "583c9274-9828-4c1f-b1f8-3f783f29b0ae", "comment": "Malware payload (RedLineStealer)", "value": "93dadde6cebf44812ea9ee4fe021766aa9b86d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691316910, "uuid": "f9b7015a-2b72-49be-8787-380399762208", "comment": "Malware payload (RedLineStealer)", "value": "ff49718eb9dd85ba36b760a418559d4682bb8eca0536c676f40e0b4bcf94609f2e6648fda4b7eedcccb1512dd274fc5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316910, "uuid": "c0390b8d-d311-4891-9dab-17cdb88e5767", "value": "T15C64D81392A33D51E52ACB768F1E86F8761EF5508F4977AA3228AB2F04B11B3C173715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316910, "uuid": "961c4909-d089-4e33-8e72-61d63f2f0513", "value": "4472ef7ff17466415618a97438e0e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316910, "uuid": "6981bdfc-07c1-468c-82f2-af1f220c89e5", "value": "3072:GjP9UiyNgxBex9j5PK5i5u7dUcBwjp/6v+gqMl9T:IOzGzexnAb7dUwwJzne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691316910, "uuid": "f7e38d88-2202-4924-aef8-28ed4c750383", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691316910, "uuid": "42b06cf6-89b8-4e52-b591-b8a007c546ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691316910, "uuid": "a189c8dd-1f8b-45b1-906f-165fef65bde2", "value": "40e3e72ebd0927d0d5b0e1cf98b9f676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72f0dd0-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315472, "uuid": "55438ffa-a0a3-4694-89ce-649bb434fa22", "comment": "Malware payload (Mirai)", "value": "f28605099e29f5189dd1cb0f8093784e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315472, "uuid": "78b0d966-accb-4a23-9a60-6d31e4a13d4e", "comment": "Malware payload (Mirai)", "value": "b50615cb5386089d53287edf61a4632b632ca018cc4e87a0574981d9a273ca72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315472, "uuid": "aa792316-2ea6-4714-923c-a07c3e6a10bf", "comment": "Malware payload (Mirai)", "value": "a7a56589e493496e81048f30018aaef702a8664d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315472, "uuid": "4dc293fd-8cbc-40e0-848d-c6d4ada50848", "comment": "Malware payload (Mirai)", "value": "32341036af59e805b0ac612f3f2e309d60ca6de10a5baca56f6d645d846868fa87bea1960b16451a128fd3d46bd2dfe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315472, "uuid": "4762212c-6812-4ec9-8dc2-3ee7b659e41f", "value": "T130F33FA2A84CC6C7D0166279A0DD8F3BDE7E72D72745CE027DD120368E91EDB291BD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315472, "uuid": "91dd6611-12c0-4caa-9652-924b748a6a00", "value": "3072:r90C0vqJo4RL33q8Q6ZHh7nSEmdejObWNTYzpoAz0DVopw8sEyEjVTNijZ:raC0vqJo4RLHRQ6ZHh7nSEmdejObWNTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315472, "uuid": "6d02972d-b496-480b-9ec7-3bc23598f4cc", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315472, "uuid": "e1050c7f-6e26-42df-a7aa-b03f083ea54d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315472, "uuid": "30474f17-2aa5-433a-bb92-80cd8919dc17", "value": "f28605099e29f5189dd1cb0f8093784e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0058a6ca-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334037, "uuid": "7396e3dc-2da2-4029-9afe-198ec136fac0", "comment": "Malware payload (Mirai)", "value": "84bbd3206bcc4a483cbe07b222680e55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334037, "uuid": "241422da-831c-4089-8b7c-a3ca16f0dc85", "comment": "Malware payload (Mirai)", "value": "b88e25d96e48241f56e6a5db555847a02a62588a50e0601c7254c63944426f02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334037, "uuid": "a86416e4-293c-4462-84d4-c7ef7d5eb797", "comment": "Malware payload (Mirai)", "value": "768b72743861c4ddd5ad7b3820affbcd32e481c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334037, "uuid": "58a4c9c1-8aac-494d-8fb4-62ed480d4547", "comment": "Malware payload (Mirai)", "value": "9470d3f03f1485b7ecba7f9421060f21fe0d3faf49c7d9539614379050479cf9035b22a992df083813afe0b64835969f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334037, "uuid": "1ea4905b-cf8b-4931-9ea4-64c4af536db5", "value": "T1A2A37DC4F643D0F6E85305B15077AB369B32E4B5202ADB42D3759E32EC62911EA1FB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334037, "uuid": "8f5856a8-733d-463e-a22d-f62e869c2f32", "value": "1536:m3YQ38LN2aKyiBqSLLhch8yQ/m3slqwjSqt2gl6oJkSjxIr/:aT38LqykqSXeJam3AqwjFEgXxjo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334037, "uuid": "5a64b0ce-7cb4-4b25-8b39-f0cc64964cf0", "value": 105484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334037, "uuid": "091a418e-f9ae-457b-aaf7-de1d448f6e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334037, "uuid": "04f51e26-90fe-4059-b884-a98dcdba7188", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff2f4c0-33fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691286603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "4e68e73e-f992-41f6-bcb5-0364c5418f34", "comment": "Malware payload (Mirai)", "value": "bfb69ca0588c4073c5c18a94ac5decfe", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "274ba0ac-49e6-4180-9d78-a5ec58bb5828", "comment": "Malware payload (Mirai)", "value": "b8ab6f63e813823e65313507933400016179c288ed2ca85f255e2d0a37879726", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "bce0246e-3bd5-4e67-b79f-817eaf324964", "comment": "Malware payload (Mirai)", "value": "b68b2505c24ec784b143a5e4f2ad16a329b3de89", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691286603, "uuid": "0f0ae14c-4d8d-40c2-9c99-17dc874e1d61", "comment": "Malware payload (Mirai)", "value": "8594bf4fb3392ccc68cf171df98962dc3d0ab9c02dac96bd5cca3457546fc711c0082db97aab326d1ba38056f2ef3047", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286603, "uuid": "049e4a41-b2e6-4891-ba15-93219210927b", "value": "T172E34C08E7405757C2E227BAEB9B428E33339B54B7E7330559386AB43FC2BA94D36115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286603, "uuid": "f6fe4ec4-08a2-4f29-b620-bfdfbb3e88ec", "value": "3072:h6Bg4rr6kX9abJ12jc2yIAT8wsttjesvM/9r5V11:h+g4Xx9abJ12jfyIKutjekM/9tV11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691286603, "uuid": "5bce2472-3966-43ca-815a-da45102ae8c0", "value": 154336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691286603, "uuid": "affdedc5-75a3-47b3-9cbe-4a7c8c64c941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691286603, "uuid": "b431993c-a574-41bd-85e4-a46ecd5ef005", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa69ba7c-346c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335181, "uuid": "4b96c768-c85e-4283-9403-da509e5f998e", "comment": "Malware payload (Mirai)", "value": "514d390d6ec9870b004df9402eef9d14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335181, "uuid": "9266f71a-108a-4d9d-bd1c-9ec21c795857", "comment": "Malware payload (Mirai)", "value": "b95c0e0ba3004f72e0da0f618fe230d5053b8ddd402fdb17088e1ad6e605ef4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335181, "uuid": "bdd6c3e3-604f-42ad-8e32-75d472c170b2", "comment": "Malware payload (Mirai)", "value": "1efd7e47f25310dee24b23e8aadebb835b95523c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335181, "uuid": "52b6891c-f23e-429a-8c80-d65e8c5f615b", "comment": "Malware payload (Mirai)", "value": "4699892893d73b3b33fa5b88ceb450334a427ef49dfa5dd5020402635c60fa13767458063668d0ed69d31d5fb8a69653", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335181, "uuid": "8f3b2b10-6fdb-4e10-a557-109cc797f846", "value": "T19BE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335181, "uuid": "09e27cbc-193b-4519-b09e-f16f243bc935", "value": "3072:dgZc9h1jlnLA2PiXYeyCcfVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZfVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335181, "uuid": "a5ce72a3-b234-42a6-8271-ff2895c746f2", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335181, "uuid": "79a02c5c-cb14-4c2c-be60-b7a57fbcb1d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335181, "uuid": "aadff173-a476-40a5-a47c-49f51c319ba7", "value": "514d390d6ec9870b004df9402eef9d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79419095-3407-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691291719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691291719, "uuid": "071abd13-2f92-4c5f-872d-840e82836a5f", "comment": "Malware payload (Loki)", "value": "bf37ed340770102309554be2789becc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691291719, "uuid": "6e4ba686-e3d7-4e6e-a2ba-263e44a8b0cb", "comment": "Malware payload (Loki)", "value": "ba2fdc59950c64afa4429a28ff4036f496e519a867c3182e322d78c0eef27952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691291719, "uuid": "d287ade1-9e5f-4161-8703-16bc0e13c72e", "comment": "Malware payload (Loki)", "value": "9710046d98ca399fa2ced91060acd98a126e56b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691291719, "uuid": "65398ae8-29f4-4f7a-b6e0-3ee780616ccf", "comment": "Malware payload (Loki)", "value": "50851bf09a18e318dad5e1b62047c2f8ca38424560af7d749fcf144a7ac668868d419474f05147e36d6a9e4e43c1a302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691291719, "uuid": "3346887b-8cd1-4452-a1a0-97e8bb8b3543", "value": "T1E6D49E22F2A04433D1B3567D9C1B9778E826FE513938A9472BE4DC4C6F39381797A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691291719, "uuid": "f1405931-0e7e-40a2-9c25-005ec5153a5a", "value": "e69d91ce4b5556e616458c5a122c112e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691291719, "uuid": "f6d1f883-bfee-4969-a558-99f75987b3e1", "value": "12288:MC1TxYROXXH+NrZEb3StxjYr5CEsa5Zhb+Z5:ltPHeO3q21Cla57by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691291719, "uuid": "b7eb9747-7497-4e79-bf59-63f3bb1470ac", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691291719, "uuid": "ad47b4b0-fbc4-464f-b7b7-45af133d9997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691291719, "uuid": "6a0eceb6-f774-4549-8198-306cde2276a0", "value": "HEUR-Trojan.Win32.Kryptik.gen-ba2fdc59950c64a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dc663c-347f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691343440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343440, "uuid": "c623c162-1851-4407-be7c-939aa1ab8766", "comment": "Malware payload", "value": "93b7b720bc5c6400075a3e19553a8d61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343440, "uuid": "a272ccc1-a8f4-4de2-b9e0-21f8e73f78ee", "comment": "Malware payload", "value": "ba82a9c832160874c537f1907f246ed9ae136c2c42ed07125c6761c2973a47d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343440, "uuid": "4df24c2e-4160-44d3-9cd6-c09160e1f1c2", "comment": "Malware payload", "value": "7805ea5c17351dcc5794da4bbda2da04e31d0fa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343440, "uuid": "0d72defd-5ca7-4059-a749-c2c1a25562d6", "comment": "Malware payload", "value": "983a0669f22493d5fc32655e66a5026fe9ecde1f69dd985018169e2225c57b566317859ebbc72b30e6ca495049793a85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343440, "uuid": "061d3d28-8cf8-4de0-a81d-d12381be6382", "value": "T1B1452382B592E0C4E9340E36F46BAAF01E217D5DEF6261AF3281FB0B35371116D5BC5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343440, "uuid": "cbfe893e-9508-42ce-8f4a-53e06d36fa11", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343440, "uuid": "576c5dd4-6f75-4562-b4ef-a5b4e57c4d31", "value": "24576:S/BQJxZzIJ6yPbSRMDpTpvDIVeU/cbBjOWwludmSzADY6KNlg:S/SJ7IJ6WbJlVtljOWP0uuSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691343440, "uuid": "6103766a-bd0f-4cec-92f1-2036afee58c2", "value": 1267752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691343440, "uuid": "3130f839-d04d-419c-adc4-519b6abbc682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343440, "uuid": "6e100b03-3c06-4415-a912-8d8fffea5888", "value": "dllhost.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56605b70-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335470, "uuid": "3e226819-982d-435f-ad8e-450bfc78dc69", "comment": "Malware payload (Mirai)", "value": "f03591770993dff87dcfbfca25ebd240", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335470, "uuid": "2168d77c-3976-48dd-a089-c82b41f6ecf9", "comment": "Malware payload (Mirai)", "value": "ba9fb1bd399b2e87b7514e9e0f1f5112254daf94965485b6213f509350f4ce30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335470, "uuid": "aaf60160-f674-46c3-920b-ef4fe8b5995f", "comment": "Malware payload (Mirai)", "value": "b791419fda8eb44c55ebbbf9004a5522bebb1ef0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335470, "uuid": "b172cc1a-ec10-46f6-beaf-161e69e30387", "comment": "Malware payload (Mirai)", "value": "e5e943db70f8573d955dad1d5a0b8f6af71d31e62db78cdadf7d94173c208b9e1da064bad673e2b937bdee10b76719d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335470, "uuid": "66f562ea-df64-44b6-84d0-d777d8adc407", "value": "T15BE32A02B30C0A47D2632DF43A3F2BE193EFEA8121E4F645655FAB8A9171D325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335470, "uuid": "534f7ced-7d63-41ee-88ad-88e2b92d8cbe", "value": "1536:25TSLtsgjsIWgrkm0xpuvE09BCwwUq9mR6nkpS0UKYAqvAIYfGk9D6gVb1BgAxd:FAm0xccIY66ISb+I8gAxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335470, "uuid": "ec206892-2356-4221-916a-a510a735d9dd", "value": 150392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335470, "uuid": "3dc24c8d-f138-449b-803f-212357ab7296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335470, "uuid": "7c66a256-6044-4621-9bb1-79f8ace7e96f", "value": "f03591770993dff87dcfbfca25ebd240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4e8431-347a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691340979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340979, "uuid": "8afa2b7c-bdde-42c4-92ac-c11f538066b7", "comment": "Malware payload (Mirai)", "value": "f8a1ae7b3dd07a0b01d7e65597593d35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340979, "uuid": "8eb57fc7-6bf3-4076-8814-1c4975415aba", "comment": "Malware payload (Mirai)", "value": "bd50e9d7b72445a955fc14de4ba77d0c589f071905e92ad2e0cd38bf8b55836e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340979, "uuid": "30e999d3-eb3e-44f4-8e8a-01ebc1650f20", "comment": "Malware payload (Mirai)", "value": "9783f34acf6404c558d7c4608a6c1e169e8320db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340979, "uuid": "cd1c05af-45ea-4d64-83b1-5a627a5cf845", "comment": "Malware payload (Mirai)", "value": "75f95c0b00514be2b35d3c613afa771b459eadec9eb50167fb458ccf94c5ff06f02b5c05274e19f666fd388056f919ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340979, "uuid": "8c041870-3359-4c97-a397-9a4b49447ea7", "value": "T1C2B2D09C66D16927CD4C0CB962CE0F7ADAA532C2334D0655B3A39C98FF4191EB89E478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340979, "uuid": "0adb6209-460b-4520-9146-a2870ee09e67", "value": "384:7Y4zjiaQ1Ykx1xtxiUp0W7sOnOJoiWG8kZM7ZzS4DWViep7bORWGVCz0NvRN:7Bzji1cW7mJoirRM7hepKWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691340979, "uuid": "cf8ca4a1-8c11-4d62-90f3-a1f282031833", "value": 25672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691340979, "uuid": "e3652c35-9c28-484a-a056-8f7682ea4045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340979, "uuid": "7fc3b6b4-541d-4782-b6ca-9777db77beab", "value": "f8a1ae7b3dd07a0b01d7e65597593d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf64e54-346c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335187, "uuid": "c5a16b1f-9e7b-42f0-8013-303398e734bf", "comment": "Malware payload (Mirai)", "value": "95db5347a04994297e0d994a1de2b872", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335187, "uuid": "12a6bc86-9f14-4786-8334-60bce7cd33e7", "comment": "Malware payload (Mirai)", "value": "be98fcecb03b2638632ebb05c1274d276918408b5f6543c6c7f57c80a7802e98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335187, "uuid": "7db10afd-7447-4bd9-b230-37801eb6b025", "comment": "Malware payload (Mirai)", "value": "193f5b4a7e18f9d5b21e9354a77f366e59f77216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335187, "uuid": "50095f8c-d09f-43a6-8ca6-dd5f7b1eb00e", "comment": "Malware payload (Mirai)", "value": "51705660f9e07843e5404720cd1e3aa3990a0073c4ff44d4ca3a1e3882541d8ce0b7a6545f1ba16176fd0c2f8f9eb891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335187, "uuid": "8c4cd953-378f-4789-8079-d1d137c3dc64", "value": "T16BC3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335187, "uuid": "40814d0d-dec9-4142-b8ea-b3188fe88a42", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP4L7ymm/QMurB1nKGNb:SMQplV4amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335187, "uuid": "d8b4f070-7da6-4ebd-90f1-06a28b50e8fb", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335187, "uuid": "b9077eee-5854-41c2-acdf-0e4bef5eddf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335187, "uuid": "ee60db2c-e659-40a0-8ec4-dccd3f3b7f97", "value": "95db5347a04994297e0d994a1de2b872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c85c32e-346d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335507, "uuid": "70b769e5-81c6-4026-b899-8379c6149973", "comment": "Malware payload (Mirai)", "value": "5afd380f2ca51ad827db1b3fa46e8909", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335507, "uuid": "5b363ad6-e699-4e2d-a20e-72d55c39aa19", "comment": "Malware payload (Mirai)", "value": "bf4178df292e66a5b2eca7a70df0feb76dfb4463cf70d92ee27d71c77af24f2d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335507, "uuid": "8bfff708-c366-4714-8146-a897a6d90924", "comment": "Malware payload (Mirai)", "value": "6a926f9a2ce3ca18effec95dcaad84e0026b148d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335507, "uuid": "10fd529b-25c3-4bfc-a946-6d5bd800f30e", "comment": "Malware payload (Mirai)", "value": "5b61deb91a4062e46f93a9ab24628008a00e78ee49c5e67e746fa316e5cbda3fd74aa28eed66e90948e1d60564e4e2e6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335507, "uuid": "ab4afd3c-71a8-4fe3-822c-8e00ee7c36d7", "value": "T163B33B376251C97AC08356F426EBC5729D13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335507, "uuid": "b20d513e-d0bd-4805-b3ff-c4c1b74442af", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAh+TRCm7FnVqfJXFWbNb:T9a2aLqkrM8sm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335507, "uuid": "804b9665-88dc-4177-a8d9-3c1e8ed5c0e7", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335507, "uuid": "5b6c8ad0-8fac-4478-a0a1-c36f24079901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335507, "uuid": "e5d280a1-17d9-4f25-a2c3-cf0128118c24", "value": "5afd380f2ca51ad827db1b3fa46e8909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc32821c-3483-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691345143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345143, "uuid": "31d86e30-a754-4e20-87bd-9e4fe85d2573", "comment": "Malware payload (RedLineStealer)", "value": "f2e1d6e8a228ce00ca187e008d36d8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345143, "uuid": "1044b47b-6500-45ef-bf53-58504b5217e8", "comment": "Malware payload (RedLineStealer)", "value": "c4dd212e80e44d05c45658aa172cf438abd791e89096f1b512fd67684951b0a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345143, "uuid": "3c59855c-03ef-41f9-889d-7ecbb108a7f9", "comment": "Malware payload (RedLineStealer)", "value": "c2018f2e5688d22ea7153259a61c1e807cf0174a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345143, "uuid": "ee4dbd98-26c2-41bc-8971-5e57572fd2b2", "comment": "Malware payload (RedLineStealer)", "value": "6b99a3b3744516eb8658e7a539b868b93e927de25f5b541d57ae2b882b8026a4e50c3b86d4e7d1ef8e333cdb91ec4ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345143, "uuid": "707fb1fa-be22-4599-afee-b10096518f59", "value": "T1CF849E1362E56CA1F6334A338E2AC6E8EB1FB951FF1577DB12589A2F09711E1C672301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345143, "uuid": "984f0932-d4cf-4fa7-a3b3-0c288cdc7716", "value": "088cd9e5d803c1f11555296e944be32d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345143, "uuid": "8b7a2bcc-a5e4-4d0c-9b0c-00a001b36a21", "value": "6144:i6IQEvs+2ShV2OU+kggGIl74UAyYDsTf:il7U+xV2OUNdjbAy8sL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691345143, "uuid": "7a405d2d-63d1-4313-bcad-5790c93622f8", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691345143, "uuid": "aae21748-faba-43ac-84c0-a15b91d1ab8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345143, "uuid": "4055b74f-eed7-449b-9c48-a623df2f85a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b630e6f-3479-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691340605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340605, "uuid": "b8c555c1-10cc-4b2f-bfa5-58499dc4dc60", "comment": "Malware payload (Mirai)", "value": "0ba219e47480e4631b4164d70839e236", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340605, "uuid": "04a490be-cae7-4fc4-a7b7-70de7564b857", "comment": "Malware payload (Mirai)", "value": "c5370bee47466f1c98deb1061a9b27bff97bd96451befeb3da855b7132acbc5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340605, "uuid": "4aedb74d-58d1-47a4-aed9-e370fb7eb6b6", "comment": "Malware payload (Mirai)", "value": "823afe3547101973313a116a0aa8a7a9143c4b53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691340605, "uuid": "da411327-284d-4b16-93f5-2e68549cf9e0", "comment": "Malware payload (Mirai)", "value": "00d35e00d26ef5b3c52d3b69799cdca0f784f0d197ded286af9d30e128e4ee60f8778216007cc119f6af21bb71aeba6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340605, "uuid": "2aecf781-a17d-4b83-b1a6-d4f4681665f2", "value": "T1D32302E60A6868B2C5F05A33FDF5C1C1373A07B4D1FA625AD1909B04A8A2F47F7E9147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340605, "uuid": "f95bcfdd-c5ac-48c7-8f58-eb0924da10ec", "value": "768:+PiLOg0T54FUTshR0m947w1LUEToGIH10fLyfoNF9q3UEL46xcR6J2JesSbU/+qX:+qKH5UuuRV942oH0fUyYLy0J2ssSbmpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691340605, "uuid": "dc489585-420c-42e3-a535-b2597a92fe65", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691340605, "uuid": "aeb22250-3c5c-4fb6-8d83-fd80af856c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691340605, "uuid": "12a12a1b-1d63-40a5-9ce0-d6bac00e3078", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c200059c-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691315464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315464, "uuid": "57b63685-9edb-41c7-ae7a-eec203c176c4", "comment": "Malware payload (Gafgyt)", "value": "da6dfbd9a0a631768da9e2f96c3700af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315464, "uuid": "b914f4ba-e731-40b9-97e0-abdf8b130931", "comment": "Malware payload (Gafgyt)", "value": "c6097c51004e7dbc22949a363e9b16c8bfbbf2a3e223e63a81a79a036431b47b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315464, "uuid": "6221aa95-5b8a-4953-a049-b35284bbe75e", "comment": "Malware payload (Gafgyt)", "value": "868107b4246baa8710fa71a22be169136b5f9034", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315464, "uuid": "838bc644-28d1-40cd-9796-8a54b5ce5b97", "comment": "Malware payload (Gafgyt)", "value": "96f5375bde1778cefcd6666a42c4db54a8144cdf6cfcf04b2eed1d89e954f6fffe1a116ee8493196c00d32ea33ef2e96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315464, "uuid": "0514c01e-2081-464a-bb53-b37de075f374", "value": "T15BE3C972544CC6C7C02652B9A0DC9F3ACF7E72C7274A8D22BCD551354A83EAF790AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315464, "uuid": "a0cab202-aa74-49b9-8623-cb31b02ca358", "value": "1536:UxjyJNRWftRibBNNKi9qfk7OPC2/Cf7bTlK+pK7DKrtwp+Vp+wEi55/z:ejy/Ryt6UiR7OPmbTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315464, "uuid": "52ae7b04-3642-4e4d-9872-30d34bf268b1", "value": 145504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315464, "uuid": "11f9aea9-2323-4816-b803-d0aa920cb677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315464, "uuid": "8665c6b3-ad18-4ad2-9049-7730a4278c15", "value": "da6dfbd9a0a631768da9e2f96c3700af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896dba1c-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329542, "uuid": "0fa4f42f-ce2f-4f8e-b921-5b4bae7f4c6c", "comment": "Malware payload (Mirai)", "value": "11f9a837817f596df0a2202a012207d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329542, "uuid": "84fb4eda-1043-417f-8d9a-5b4f6d5b33c7", "comment": "Malware payload (Mirai)", "value": "c83003619f722c9de687326f96bb49e8c9426ad54a9b210d08bcfdfd511e66e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329542, "uuid": "c99e294c-c0c9-4748-b3a3-e49d2489d28b", "comment": "Malware payload (Mirai)", "value": "ffc962f478df7780d8ef39f6b424837706da3355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329542, "uuid": "94511fd7-d041-4dc3-b74a-22cc41425187", "comment": "Malware payload (Mirai)", "value": "192755a2b780f08f0b87a8473c5746f11ce30d57685ea217d52ad057031556446386da092f101980122891d2f992f09f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329542, "uuid": "9684adf0-d987-4155-b7a0-a99a35957695", "value": "T1CA13E684B882DA1AC6D4137BFA0E83DD3B2973DCE2DD3307DD256B51378A92B096B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329542, "uuid": "6dd9fa3f-00b4-4d57-a5c4-1f989486d566", "value": "768:efHKXhNW85co6Qo3Nos10fv7PrElZuz8R4I9JbmLCTtNG3+om/mMWfO:evKX6N310r8ZuzSEUUIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329542, "uuid": "942d9ced-3ade-462d-8da7-24938838e448", "value": 43236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329542, "uuid": "a232282e-3469-4532-a7c3-fb65f619aecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329542, "uuid": "2d160d66-5ec0-43e7-af35-0fa749a8e0b9", "value": "11f9a837817f596df0a2202a012207d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4911a98-3486-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691346419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346419, "uuid": "5f5dd72e-8d4a-4f61-ae4c-b175358fac21", "comment": "Malware payload", "value": "40d79ce24067898b34884b9acca74a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346419, "uuid": "ec708894-8fed-4ae4-9738-26efb135fb7d", "comment": "Malware payload", "value": "c9572d79e0d88e05a9d9ac152b06dea01905f3abdaf972736d3a300bbcd4bf34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346419, "uuid": "ae0ebfb8-2837-4273-bc48-77771d3b53b7", "comment": "Malware payload", "value": "fdbbb14daf63ca011027cecaf4006433b28cbcb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346419, "uuid": "50cdf42f-0b9e-41d8-b324-b03518287219", "comment": "Malware payload", "value": "e847ee26488cc4af47c3a1f4c4be907c977b51c33b785c396fc669a284290c7e9ee346c285760cb81e40099cf9df5de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346419, "uuid": "de575c60-0eb9-4052-81fe-259d0cb8e4a7", "value": "T16194CF0362E16861F6734A738E2AC6F8EA1FF851FF517BEB12589A2F09711E1C671311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346419, "uuid": "c50ac350-46c5-47d7-bf5c-b64ac28f9f17", "value": "088cd9e5d803c1f11555296e944be32d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346419, "uuid": "7a47eb50-c361-4c86-b4b8-db517b4a4d91", "value": "6144:xy+frNwhjxwBBzHUcxmkBZv72XwMTfQYSSbDUxLWEm0N:xXpwBxoocse72XwM6SDsLWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691346419, "uuid": "f6790b04-3f2d-4800-b876-b0ff1911fd2b", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691346419, "uuid": "b2244453-7414-4f8d-ac02-df4f6f300190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346419, "uuid": "a9efab1e-3dd1-4b40-a6d6-ba9c6036edf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7046d27d-3481-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691344103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344103, "uuid": "c3d334df-3cc7-4baa-bb12-e4dc411707d1", "comment": "Malware payload (Stop)", "value": "b96e50ff577d62c4e8f0b4849bde6ccc", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344103, "uuid": "70cb1781-0273-4ab6-9230-6a90cd839a24", "comment": "Malware payload (Stop)", "value": "caba93d49e832da3f1df247f0d1c0affc6e3c6d4915781edfcf0a8ba58a39a87", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344103, "uuid": "2192dbbd-5075-40d6-9341-496d0ec21fb7", "comment": "Malware payload (Stop)", "value": "0b45e3f2a49bd437bd28474590e425dbc06ed9ae", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344103, "uuid": "76f7b0cc-0839-431e-96bc-a123ac128303", "comment": "Malware payload (Stop)", "value": "78ebe7801c0adb2a744c31e565d5e921f1ed4b9dbeb736e74a49ea49c4c50be33a70801eea96376fefd8b5bead530c74", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344103, "uuid": "3dceb9ae-f087-45fa-85e3-5635fddfe1e0", "value": "T1FC05F10351D07D95E6228B769E2EC5F83A5EF950CF48BF9A1218BE2F05B11B2C673712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344103, "uuid": "3813431a-df41-4f8e-a3f4-78017a3b714e", "value": "85ce740324cd186ebe76660c5a8bb101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344103, "uuid": "96869ae9-1c26-48fc-946d-b82ca6a4de6b", "value": "12288:QgtdVJfqowBSotxoCvBrvQWlEC1vmWHhYQELkRRCNXDNvjaBZ4JW6ezh34Iryur:Q+JioStxloWWClm8HMNTBhezh34e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691344103, "uuid": "dd1a6592-0d46-4fd2-bc1e-4fde1f8b7520", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691344103, "uuid": "a044746d-d25a-4934-b667-367ed19c5674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344103, "uuid": "3f1373b9-8f0c-4ced-b7e5-0937c2fe8baf", "value": "2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c526a99d-3457-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326206, "uuid": "1ea0939f-04ab-4b3e-8b52-1122bec0e8d6", "comment": "Malware payload (Mirai)", "value": "f0d7dd912ac91ce076ceb45b15666c7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326206, "uuid": "894b1e6c-3da1-41bb-924c-01d8ebfdceed", "comment": "Malware payload (Mirai)", "value": "cb4e5caa9bd474b85f2af2ddf47f1c18496953f6fec44ee5756d28c131694b18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326206, "uuid": "f742d533-480a-4907-9441-9acd90f077e0", "comment": "Malware payload (Mirai)", "value": "a83f870751b19462083884d74753f8f191565d97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326206, "uuid": "8f4775a2-83a0-4f46-9315-16be421d9e29", "comment": "Malware payload (Mirai)", "value": "4cb6998d6ff6266dbbc443e18be3ea86a31d8e87dc2a5738d6c8748ee9181b3b4f066eebd7893443d121036d10f514c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326206, "uuid": "7a5c59ed-3d8b-4825-8a5b-df4068b16ff7", "value": "T12FC2E1F1E19EB831D671A4F1E9EE85D33E234B68E0FD3623256413A09B95809527A9C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326206, "uuid": "b0825ad3-2bc7-478c-b060-fe25abd3b6ce", "value": "768:UFNfg1Tvi8CV+WMmW8Jn48FNFb8pTXdMs3UozD:UFq1TMVvlJzNFb8LJzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326206, "uuid": "a7640323-e56d-4fa0-8f2f-f5078067ae2e", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326206, "uuid": "795389fe-067f-44b4-a03e-33a33bcbabdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326206, "uuid": "e6b3eb80-ab30-4257-b4d0-61edcb602bbe", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6241aede-3438-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691312726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312726, "uuid": "a5c173ed-b105-4cd3-8419-ddd1025a24e1", "comment": "Malware payload (Mirai)", "value": "e0e49c241db2ab8ec5b90014390d10de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312726, "uuid": "c187693f-0c54-4665-b78b-31f1823365ca", "comment": "Malware payload (Mirai)", "value": "cde4d02239828a665e5dd3417a3f25939433d10793a852f488710a3a5087a3a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312726, "uuid": "652123f5-71ca-4783-83eb-99682e3d60bb", "comment": "Malware payload (Mirai)", "value": "fa2109ca0ac1ac335d1b37c92c3a0210c020000d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312726, "uuid": "c198b39a-20bb-482c-88b2-6f3171956bae", "comment": "Malware payload (Mirai)", "value": "1c4086739b7188b5e97d26e83089ed0269210ba7294bdee5664a365e9c5582fd67f01cf9558a21c401c93fff74210065", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312726, "uuid": "e8444bf0-fcdc-41fa-aae7-07f38e702dc5", "value": "T14DC2D120A76304F0C1A11C37E3ED0B075B551EAD999A7166B53C26B9C7E98DA83FD213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312726, "uuid": "71bb6352-28e0-4d2c-a9d9-f2be54fd6d4d", "value": "768:VrWBcTtk9RbK36xFZGMsFquagLQjqeW3UK:VCiTSRG3OZGlFXaSTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312726, "uuid": "e15673af-43c0-4167-85fb-ab07e49cd0fe", "value": 27988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312726, "uuid": "19814236-d861-4a6a-b157-9676204cf59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312726, "uuid": "bac45de8-ad19-4a2b-8276-667644447555", "value": "e0e49c241db2ab8ec5b90014390d10de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e36d45d-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691348233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348233, "uuid": "d4b37dfd-d3cd-4343-a4ae-7604f5b107d0", "comment": "Malware payload", "value": "1892cf6d2f8c65a138bce8e3037f9dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348233, "uuid": "d81b333c-3f0a-4d7d-bedf-6c445cecdc6f", "comment": "Malware payload", "value": "ce05ff463261e36f40c9d8d93f1205e1b2b949fef3a1f9c32da3b331d4c815d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348233, "uuid": "ef24f496-b2ff-4757-b11c-863729c3e48f", "comment": "Malware payload", "value": "940a27832ae02b6c2b97c39255f8c4e0272175ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348233, "uuid": "20cd6a34-1032-4c66-b150-c16ddabdb5d9", "comment": "Malware payload", "value": "c948928dbf72f25fe5492b83208916346ff9f2af246ab9ccaed189f25af9d19625d7e9995b695e6ec0489304b8983b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348233, "uuid": "0f357c23-fb8a-473c-8918-17899b555a92", "value": "T1CEC5AE3179C58172EEF330B646ECB63682ADE4B0072955CB16D85FEED6206C26F325C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348233, "uuid": "3bcdb5f4-6ca9-4c7e-93ff-e2fbb61489b9", "value": "bd4fa5e280a70415dc5e5880b51e1515", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348233, "uuid": "09192b1d-69dc-4353-92e5-e085f3932b20", "value": "12288:2/OTq5UHWo/FjMWM0LG2JHpILRNpXSr3m0yAu4HFTp1eTv3uIZkUw/w5q:Dq5UHWo/FjMHfgHpILHZS62I2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348233, "uuid": "83b48cb3-e804-4fa7-aa20-ac52fe82638a", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348233, "uuid": "09f47790-af3b-4f1e-98d1-9e01889edc7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348233, "uuid": "370dc5a2-2b5f-4ba4-839c-35095a082bd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c489bd20-3480-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Sodinokibi)", "timestamp": 1691343815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343815, "uuid": "57a89d82-7bc3-4b6f-99c3-ac9fa3f2c5f0", "comment": "Malware payload (Sodinokibi)", "value": "6b391f91c63765876e2571e87fe46575", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343815, "uuid": "d17dc57f-09d5-4396-9b36-f6603c93492c", "comment": "Malware payload (Sodinokibi)", "value": "d09338f3248b7c43b4c58274d453732fca910a0cee2ca50a2b72fe0364fb615c", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343815, "uuid": "65d428af-0ce6-4d0a-a10b-e47d31ae2282", "comment": "Malware payload (Sodinokibi)", "value": "d508632ca452af6325c06434b29883cfa55d7948", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343815, "uuid": "c3baab89-a02f-4480-93d0-3aabc1f97847", "comment": "Malware payload (Sodinokibi)", "value": "642cd91ac6c977991d0168732ba7e2a2d2fbeb2e37c617dc64c5cc57a02262a8316542a6bbc7b7017bdeb3e0b632dcf0", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343815, "uuid": "1de751ca-de89-49be-98a4-a6414a101f6a", "value": "T19FF3E122EE9143B3D5C3D1F3132F2F67A8BCFE3411096657DBE0C6445A5A892E60B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343815, "uuid": "9d30c5e2-88ac-4410-97f3-62cc86567c33", "value": "c88f20b29592f2107a629e815db6afae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343815, "uuid": "4827bee1-12de-4f6f-b16b-c329deee4f47", "value": "3072:pEa2d8CfSXceqmPDu7lvspW0kAo0BQhyI0hQMnnsJ:5CqlPDuBkJpoQQgdnns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691343815, "uuid": "180dde48-8447-4179-8913-162711301a4f", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691343815, "uuid": "f88f114d-96ec-4234-94fe-4370f23f81bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343815, "uuid": "27eb0d42-7f09-408f-9ff9-e59e00f7003f", "value": "d09338f3248b7c43b4c58274d453732fca910a0cee2ca50a2b72fe0364fb615c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45f4df4-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691315468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315468, "uuid": "2b9a54a8-478c-40d7-9cfd-7ab04c548c14", "comment": "Malware payload", "value": "8cfc19497733294226ff42c2b1f27076", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315468, "uuid": "f895214c-1378-4266-ac70-bd32dd1d3792", "comment": "Malware payload", "value": "d0c3e40c8bc1b80a5cc5ab8c6cc21dd2890ce0660398b33f9afb7833a4c0cda4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315468, "uuid": "80290191-6a4b-45a4-b3db-5240516415e1", "comment": "Malware payload", "value": "4457eb16900114ea403bd8497487be18682e86f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315468, "uuid": "d7aed8bb-6974-4865-b772-2f895e0c4945", "comment": "Malware payload", "value": "284a71de0373b732b3b867feb5cb6e78db5edf0cbfd2cf0e0886e3d5ee6a75672e38e4749dac6baa51ec2c824293456d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315468, "uuid": "04264ae6-7101-4744-9ead-25d1d2b3ae7a", "value": "T13D33E0CFE4C37D49EFFF0DBD91BD1231A2D1708060AD859557049C219AB7C97B9CA82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315468, "uuid": "6826603b-8bfa-4f29-a10d-4481ff279fe5", "value": "1536:gYlT2wMACvm9ejzlVZQV1LhmnS+n/jy/AK4JK:DtSAKhu5JiGoKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315468, "uuid": "97ea525b-8ca0-40b8-8fa7-bcf7969b07c9", "value": 51776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315468, "uuid": "700c9ced-3adf-4c9a-a787-fdcb11f6f345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315468, "uuid": "ed9b21b7-ccc1-42f7-abbf-b4ae218605c8", "value": "8cfc19497733294226ff42c2b1f27076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0455f5e8-3488-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691346928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346928, "uuid": "a5764e3e-ff64-4fa1-a59d-fc588f559a96", "comment": "Malware payload (Loki)", "value": "1d282a1902409c9ed62914b0e3df5c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346928, "uuid": "24d520e7-f802-4654-bbfb-fd26bc227839", "comment": "Malware payload (Loki)", "value": "d0fc326696e4fb8bece5473bfbbd7958fcb61b70eb05d5d7fa0e09aaef5e056f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346928, "uuid": "284ec564-17ed-43da-9bcb-17ccc06a86e5", "comment": "Malware payload (Loki)", "value": "9fdc134b96c3de1cd33ce2ce50e39be4238e861e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346928, "uuid": "380c1e41-e148-4d3b-b098-f15a34765557", "comment": "Malware payload (Loki)", "value": "ca246cc21def2a15daa8bf709ebcb5b509c34995de0ca9682542fa59b51d6ba11795f4599d8e3ddf7e4a4ac7715767c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346928, "uuid": "4079200f-0856-4b31-aa52-6366325a315f", "value": "T19E75172167E804E5F5B35E36887B5175AAB7B8216F21C68FC5A0C70D0F72BC89D36326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346928, "uuid": "53b17829-39c1-47f3-88cd-eaae08ede513", "value": "f01e0f86270b7f3e5d91b31f21985535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346928, "uuid": "b96cfd11-7127-4fb9-8755-14951aefbe41", "value": "24576:7xSJvObTV37m98qGWvNRXP2rRkY+uO1WSEnXfYB7vEs1yN:7xIwBL1qGGRXurCuO18fYB7vEs1yN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691346928, "uuid": "5ee43d06-88f0-4ba9-bde3-4a9459c8087d", "value": 1678848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691346928, "uuid": "5d598489-9509-44ec-938e-90e2bffc711f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346928, "uuid": "1f39c8d8-2c0d-4a5c-9ee7-35d37014093f", "value": "1d282a1902409c9ed62914b0e3df5c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e55d6f-3468-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691333241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333241, "uuid": "c36641f0-aea9-4f92-8a11-d040187fa832", "comment": "Malware payload", "value": "137e1a9af35d19b9423b7ced2f2932eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333241, "uuid": "0ad43b2f-2318-482e-9e45-2225a1f795c1", "comment": "Malware payload", "value": "d1af210da33a983119b6097fa9de93da84ecb99843d454d740da81a8c5b059e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333241, "uuid": "0e1b9858-978f-4a69-bb1d-68b1013938c7", "comment": "Malware payload", "value": "1cd52492f4be0a05e8b732daca4fe963b881d137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691333241, "uuid": "a0ded6d1-6405-40f7-af02-f214117a339e", "comment": "Malware payload", "value": "7ac66a5eec029914475c205245fc9e2e2bf0999ed050f44e800eb654ae300ea7c2ea768fe73c07002f5dfd7567691cba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333241, "uuid": "c29f09f2-c991-4aa8-a6d1-8f89508d7ea8", "value": "T10647332BF268A53ED5AA0A3209729250597B7F60A9578C1F07FC790CCF765302F3661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333241, "uuid": "52ba5388-f3d2-40ff-ad59-b80116365e5b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333241, "uuid": "2f92baed-b74e-4bac-bdb4-4c7bab0b51fd", "value": "393216:gMBXpfk2VHAMepuu8BzGmwZoF67oR+vC4YNboo8YcU9CRZsZPGi4A:gMB5HVgMhu8NwZA6xvqoCyS+dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691333241, "uuid": "af034ce4-4684-4ca7-9857-8005c18ea401", "value": 25435448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691333241, "uuid": "4aa6b117-4cf9-4732-abda-b8bbf25007de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691333241, "uuid": "c6a40e2f-e08f-4ec8-8edf-d43decebd9f9", "value": "TotalUninstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d8fcf8-3498-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691353994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691353994, "uuid": "02530b1c-55c9-4dcf-aa8b-dea7ca19047f", "comment": "Malware payload", "value": "22943d9ceda4a9116856822a73c1bcc8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691353994, "uuid": "d2915db2-fc53-48e6-96a0-b2b0915de60c", "comment": "Malware payload", "value": "d1dcf4c2165f3cf5729ba76e1ee80f4709d8e7eca7a6c29ceffc5fc6b09660fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691353994, "uuid": "9c3f3b95-a9c3-466f-8de2-26879a14e9e5", "comment": "Malware payload", "value": "53e2ea3389a721127b29572b905699c0c5b887b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691353994, "uuid": "0cd0deaa-b5ea-43ff-8144-86ecab7ea539", "comment": "Malware payload", "value": "c6a36d424aa1869117249d91687b3b2de74d0840d573150415d7b6981863cd3b57fce63cd8e35012a3b5542373a5a045", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691353994, "uuid": "d735b45d-451b-400b-82fc-981d9b751dfd", "value": "T1E5A37D1375D0D572D0311E34ADF2AAA186EDF8B09CB1865B338C027E6EB25C18EB5797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691353994, "uuid": "d1fdbb60-53a0-47fe-a373-26c01d13a3e8", "value": "31553623c43827d554ad9e1b7dfa6a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691353994, "uuid": "8c61567c-2301-4f84-ba57-f59371f20a96", "value": "1536:MFUM9BznKRGInshht34/TXQHMTuyqGRyq19MWDamFMfMBVOr8xx:JeRn0GInGt3mDQAjRyWC0aSMf4sgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691353994, "uuid": "b2d22c6f-5e53-4034-a1ef-4b0f62b04de6", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691353994, "uuid": "ad289b93-2f79-46ec-8697-1ae873196641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691353994, "uuid": "78f4bc88-4af2-451e-a23b-2229ab8f541b", "value": "2023-08-05_22943d9ceda4a9116856822a73c1bcc8_locky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c344ec4b-3457-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326203, "uuid": "7612b602-dcb3-4320-92bf-bc10890e31fb", "comment": "Malware payload (Mirai)", "value": "920f55816fb8fcfe899263f08d7096c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326203, "uuid": "cb95e14c-a110-441c-a9a4-f9765e44e3d1", "comment": "Malware payload (Mirai)", "value": "d22a5b7d0af942c12e91c5b1159e44cc09eb840cfdf61c795ab0734747223f5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326203, "uuid": "2944a825-22c6-4c6c-bb4a-779cf7c15371", "comment": "Malware payload (Mirai)", "value": "0e455d99f9ac41cd0a7c75fb373d1d8d08acc41e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326203, "uuid": "e0e8169b-feaa-4351-bc45-f299d93319e8", "comment": "Malware payload (Mirai)", "value": "f947377918825f500e6163ff57184799fa2d0cbe3a044d0e271913a9f2da544fcf296e6f80e56990a47865a0c43b336a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326203, "uuid": "2285e58a-baeb-4d37-b778-8b7d7ecda1c0", "value": "T1D033F1B02BA6FBE1E131B237B42E0A15F1ABD7C410FA319590E59E1D7DEF10619A60C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326203, "uuid": "9628e24c-4e0f-4fe7-846a-183f51409a95", "value": "1536:Gul4c4o/mUm5+Q2QIidnk8HyPLcPqF1aBexo4opKZZaXKQ:l/obwidnk9LGqFUFraQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326203, "uuid": "3b95cbb5-55be-4ba8-bf0f-09d9e01d81b6", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326203, "uuid": "f406c414-b83c-44d5-9554-9fa032d70c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326203, "uuid": "971cf097-bd73-456c-b123-0f5cef659c22", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70dd3a7-344c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1691321512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321512, "uuid": "5c25ba99-8d0b-4446-b44f-bac0146e77da", "comment": "Malware payload (Havoc)", "value": "42ac2bba9af99081defe93ce797a3412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321512, "uuid": "b0198d5e-2670-4799-a4a4-f429623d7707", "comment": "Malware payload (Havoc)", "value": "d4163f1179d58f842ba3b9cd28cd315de031669b93d87111c40fbc13167e42ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321512, "uuid": "b1bc4a10-8b09-4470-b596-411be011d4ca", "comment": "Malware payload (Havoc)", "value": "3a1e245f87c5da61aadb7c58488bb24948ca6f19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321512, "uuid": "19978a1b-2fc5-4c78-92e2-f0ac62c01cf8", "comment": "Malware payload (Havoc)", "value": "c7eccc80d86828035b6f80a5b3f90efc88b9975f1034de9ab9254d1c8df608091e1be8cde64e46651ddd858dac93d3c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321512, "uuid": "ae0b7b6b-b372-4f60-bb9b-4695c3511efe", "value": "T1C093C516E16330FDC5BAC2704B9FBA32FA72F45C59745F0A5B24CB192F10A70662EA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321512, "uuid": "89e3116c-ed72-4374-95ce-4eadfdec4067", "value": "768:+IR0tFOAQJfLWMQyvh5+kI25cBvgpYybW8vK9/vdKircuudDTt1WfpMVKk5hqM1Q:jGFiQyr6rPhvdKbtDj57gbOsRBFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691321512, "uuid": "49e3f287-9d9a-44d4-bdef-eebb835fc204", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691321512, "uuid": "1ed2af26-2dac-4162-a4f1-c2d876f881c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321512, "uuid": "445b0e33-bc28-49b0-80e0-bc3ef04e5016", "value": "SecuriteInfo.com.Win64.Evo-gen.14912.5635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3cd5bc-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "ea74d4b1-6d06-4937-a492-7abdef6f59e4", "comment": "Malware payload (Mirai)", "value": "b4cbb074e78f6a87e8358f18aa3ed742", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "c4b4fb61-521e-4447-a1c0-43787afe8f69", "comment": "Malware payload (Mirai)", "value": "d452275f0dfbb6cad2ec0c5e1b3f528b9179dbe5948b3ece439510f30977bd89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "b07bc724-d0d1-4af1-9ec3-ecd325d0a965", "comment": "Malware payload (Mirai)", "value": "cecb1a7a30c37a0fbed798424d65b82cbb55e611", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315404, "uuid": "c5709069-a1f8-4e4d-bbf2-4b1a2a52fd85", "comment": "Malware payload (Mirai)", "value": "fb1cf9ec363903f096a2e3759840c7562a617cbbee24040667c0244e59bdb2f869b547895c34c0f6f158d5b885b1856b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315404, "uuid": "07ea9eb6-1794-4ffb-9a91-b3cfc13a2898", "value": "T1B33302A00919FD3E46500DB3DD2158AA372E1F98A6777BB1170456F862F41A8337DDD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315404, "uuid": "d4e4db8e-f4ac-4aa0-9c62-cac07320a7d1", "value": "768:FLHdXeSA4k8z6qwObxueyERvK418WrgMmrcejP0a89q3UEL3Os8qMLPVhBocFNgD:XOSsmhV4eyiT18WrZsXLcVToKep6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315404, "uuid": "9a2119b9-c3f2-496e-81dc-0db5f5a9303e", "value": 53648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315404, "uuid": "a1e84859-1f9b-495c-997e-72c586f66cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315404, "uuid": "0ab77ad5-1394-4039-ae95-f4130e9e51ac", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97546f97-3411-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691296065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296065, "uuid": "8c06eada-2b02-4567-b2aa-935c93235de0", "comment": "Malware payload", "value": "6feb5102d990f8cefad921299f3f3ac3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296065, "uuid": "1f68dadc-5e6e-46bb-9fb0-1b5051d29054", "comment": "Malware payload", "value": "d50d6b1ea7609937cd64824472641c2419dc6a16d375bf15e6333c7f96a8b690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296065, "uuid": "7e86f13c-8619-42c0-ba6e-b6f23458b345", "comment": "Malware payload", "value": "0b1d42333c81395205f25457f9b0eac7555a3d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691296065, "uuid": "be260983-5859-4711-bc51-e801f384872a", "comment": "Malware payload", "value": "5442ed49430a124f27eccf217eefd120162910040fd9a291f801c0a5f6871e50030de6643fa2a6913c6170c798cce8df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296065, "uuid": "722e4f92-54b5-4e03-a668-036112115ecf", "value": "T195134C87A70C0747D07B5EF43E3B27E0975FAA9012D892C4610EDEC69372A306656FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296065, "uuid": "52e1097f-b5c5-4765-87ad-0c4b733e278c", "value": "768:owtSG3g/a/sxvOl79sCu292QzY4Y8mFaOtRQqIH:owtrV/Rs32EsY4NlOD/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691296065, "uuid": "1c25089a-2806-44d2-9005-2111fb6a8825", "value": 42940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691296065, "uuid": "8188c551-9fa7-405f-9297-73cebb011ef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691296065, "uuid": "73071da1-0aee-45f4-9441-f935f3fb7b21", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.7888.27735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccf6063-3445-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691318327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318327, "uuid": "78ddeb2c-dd6f-4452-bb3d-4305b0681980", "comment": "Malware payload (Mirai)", "value": "9290e6f4672832b8acca1bcd8a12b5cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318327, "uuid": "9f5ae8cf-557f-46d6-8100-c05d529e1f06", "comment": "Malware payload (Mirai)", "value": "d510215f246e415195f7f70e943aaff5d7a09206a52aced8c45728423a0ee774", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318327, "uuid": "ea21a9d5-d6ac-41e0-a4bc-4c742db87906", "comment": "Malware payload (Mirai)", "value": "db7cdbeedf04238dd17085f7e9b7867b059f9b1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691318327, "uuid": "89a98518-2e2b-4efb-8bf4-615b3378667f", "comment": "Malware payload (Mirai)", "value": "274d8ca9326e8d99db04675fbcebd8408a2ba52b649b12a6ea56d65a613c14575a5eb7f5837e766888a2c6dfab4a1615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318327, "uuid": "065f0529-66f4-4df2-8f8c-2105c46443c7", "value": "T174535CD9B4119E7CF9CBEABE88224E0DF821221150931B37BAB7FD937D321949C56D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318327, "uuid": "47b22e5d-828d-4b77-b403-00ce1b658667", "value": "1536:T0GpfwJ/meLj9OI0dtC7B8og1pYlqtFFLHV2y/6CV7lu4NX8X:TU91Z8NpYYXJHV2y/Huus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691318327, "uuid": "677aa74d-5ccc-447a-9d7e-162b4883b1a8", "value": 65936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691318327, "uuid": "3bf8befc-4643-4380-a702-35d443e1c261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691318327, "uuid": "16ff1738-b97b-4e99-ab18-58cc6dbb0d8f", "value": "9290e6f4672832b8acca1bcd8a12b5cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d492c730-344c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1691321508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321508, "uuid": "d99c74c7-18a0-42b4-8e1b-eace9d55b9e1", "comment": "Malware payload (Havoc)", "value": "9f395db62d14a0ef40d90404de9e6a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321508, "uuid": "5a20dbbc-c868-495a-8ee4-fdde6bd0e8c3", "comment": "Malware payload (Havoc)", "value": "d6a1a23efa1aa9e632f9e111e21070f0390678592d94fc75370d4325f45cf5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321508, "uuid": "2e88446d-fc29-4578-99b8-2dfb1e6199ee", "comment": "Malware payload (Havoc)", "value": "2c6ad76aeebb98ba68482d23c4966010aeb7d9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321508, "uuid": "5cef89f1-6d89-4c96-83a9-01b2ccaa8029", "comment": "Malware payload (Havoc)", "value": "adf92bb55cfb9a25b8d106a095daa6feb9587bb4286c597063bb1847691d15f8e996393cc10f4562a46544c38964db62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321508, "uuid": "849a7668-827d-490a-85ab-c75cc866b99b", "value": "T1B393C516E16330FDC5BAC2704B9FBA32FA72F45C59745F0A5B24CB192F10A70662EA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321508, "uuid": "cc0d70bf-9e30-40d0-adaf-9b7fd07d20e2", "value": "768:EIR0tFOAQJfLWMQyvh5+kI25cBvgpYybW8vK9/vdKircuudDTt1WfpMVKk5hqM1Q:xGFiQyr6rPhvdKbtDj57gbOsRBFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691321508, "uuid": "02a86f54-2ef6-4c93-96b4-6cb03a2c3606", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691321508, "uuid": "80cc5dcc-6ea0-4a3b-8b02-4faf91247161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321508, "uuid": "a2a8e622-d776-4832-93ef-5215d9df3831", "value": "SecuriteInfo.com.Win64.Evo-gen.4270.16496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd996aa6-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1691334408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334408, "uuid": "5d3339bc-726f-44c2-a4e5-8325f2c4dc33", "comment": "Malware payload (Vidar)", "value": "f2e35af2013a8cf04a5ab63348b6958d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334408, "uuid": "cf136966-f15c-4a19-bc38-c62b3af1a8b5", "comment": "Malware payload (Vidar)", "value": "d6a373eb8f771884afc984fba23ff81b034146282f9285e5beaf5eb31d886366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334408, "uuid": "2f7e6e73-63d3-4c36-9cee-2cfedc8e7732", "comment": "Malware payload (Vidar)", "value": "eca2a467462ff167d3511ca0fdd5373228612718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334408, "uuid": "536bfeec-7824-46d2-9d02-0e1cf40e3230", "comment": "Malware payload (Vidar)", "value": "f2e06b68746fb4ed0da117d5970e571ea875813cd77ec622039f12b86bb08f019a00d5c7bb889cf47e30b3141ba6d540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334408, "uuid": "698171f1-d029-4b9d-999c-a947ded4c0c6", "value": "T14AD4F103F9C18972C52219311A3EA741A97DB9100F18CADFE3F94E6DAA351E17635EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334408, "uuid": "2f0d2c71-1229-4682-abd9-5bb178ebed3c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334408, "uuid": "55040550-1803-4574-8b60-fd390ed24e22", "value": "12288:0hqxSLo5C1Ps4XhAjN8GVNoBlR+m651ItSpDvg6q/BCOg:0HLmCiIhoB7oFSzIYtUxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334408, "uuid": "5b9cf82a-fd7f-4ec0-9e3c-6f4874619156", "value": 628886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334408, "uuid": "829246c0-22db-47c9-9fee-bcb43582cd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334408, "uuid": "c0ba845a-6af1-49bc-bedb-208946771d4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5b86ac-3410-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691295697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691295697, "uuid": "6121d5e2-4abf-4d0d-9c83-11fadcddc61d", "comment": "Malware payload (GuLoader)", "value": "f4c7f6f75b0bd401889447acb3d9c91b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691295697, "uuid": "92bc06be-f65d-4a30-9e6a-fe157a8cb4ed", "comment": "Malware payload (GuLoader)", "value": "d7aca49508336bd02576d53e3808504befccf7b241fe99ce0193fb74d81205d4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691295697, "uuid": "a84e71c4-4473-423c-ac11-fa6ddd959d05", "comment": "Malware payload (GuLoader)", "value": "1b5f9cd58bc817eebe91275b55558a2b11508af8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691295697, "uuid": "c19ef385-432b-4b4c-b097-ce278175e37b", "comment": "Malware payload (GuLoader)", "value": "77e1276d7d107da73ff2f4f6508a6d86013add25081693c2ad6e823d9bc861a1f9ad8ada785d81b66ea831fdf6cb2ceb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691295697, "uuid": "a344eea3-b9e5-45ac-8b36-c264c02010e9", "value": "T170238D6DD34F02A9CF525277AB1A1A4442FDBB7EB38552B1305C433933EEC2D91292B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691295697, "uuid": "b910a15e-44ce-4236-8253-e16b21d2c2d5", "value": "768:JwAbZSibMX9gRWjcM9ecJX3vArL+ARGDfJxNOCASN:JwAlRzifArMDtASN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691295697, "uuid": "a824230d-670a-405d-bc1c-93898eb7f2e2", "value": 46073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691295697, "uuid": "9f2cf0a0-e0ee-4609-8e35-c01e3de344b2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691295697, "uuid": "ec90a251-7644-44f4-a78c-5c5fae26850e", "value": "f4c7f6f75b0bd401889447acb3d9c91b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc84fef-3480-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691343559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343559, "uuid": "5913aa28-0621-437a-aad2-9f5c49fd663c", "comment": "Malware payload", "value": "9c23d472126cbfe7f0da44f8795ded04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343559, "uuid": "8a5a13f9-a5dd-481a-a4b3-8191a1aa2b0e", "comment": "Malware payload", "value": "daff7ba0e08e663f81f9b13a759221cb626b0e5cf45a6b17bb4d65663023cf78", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343559, "uuid": "dea21268-7288-48c3-ad39-120580c7f763", "comment": "Malware payload", "value": "fb5d57360c7740a0aa56e2708374933c5f966fec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691343559, "uuid": "17c0699e-e526-4985-8818-eb907fe39997", "comment": "Malware payload", "value": "e33300721fa44501a20e17e95d19d4e581c68b96bfeb2423fda7f4b3df339cf4b85e22ef85593cc611bc0f2b037fd55f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343559, "uuid": "d5820218-ccd6-431a-8f5a-a0398881f3bc", "value": "T1D1E37E21B212D0B3C8371CF13736B572F39E4D2C19A96917DAE80F59BCA48136F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343559, "uuid": "0e85093e-03f0-48ae-9b60-eff6d78c35ca", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343559, "uuid": "81d298c8-eaca-4cf8-86ee-b2da7ced87af", "value": "3072:Z6glyuxE4GsUPnliByocWeppf/mp7Lh+G0uDA9:Z6gDBGpvEByocWebXS3hD9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691343559, "uuid": "a738e66d-54ab-44af-a9ea-5b8ab19bb23e", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691343559, "uuid": "de8a5382-5f72-4643-a7b9-5620cae04c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691343559, "uuid": "4ad160aa-b846-4c2d-a3e6-420b8acd3276", "value": "RW.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86156d6e-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691348434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348434, "uuid": "d742790e-70a2-4cb7-b6d4-2bf4dffa7b3e", "comment": "Malware payload (njrat)", "value": "1dc0a9c68746a672c23f5ec22458f4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348434, "uuid": "b048ed31-e8dd-45d0-8f4a-c7502c6145e7", "comment": "Malware payload (njrat)", "value": "dccb7a5a2bc02efd94d2cff4bd1bb869fcca6e557d537625e481e215193d3a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348434, "uuid": "118cd19e-3228-4b63-8b86-8c1b8955fb6b", "comment": "Malware payload (njrat)", "value": "d2b97bf905a93f049e0330becca922ee9b4d82c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348434, "uuid": "0e3338f7-2269-48b2-a993-66ca737b0b21", "comment": "Malware payload (njrat)", "value": "ab4788c1eb309d17e745d849a85e2025023cd2bb1dbeb98748d5f7bd5f03d6856fa94b8dbba415cf38791650a3b0cd63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348434, "uuid": "550c8279-bed9-4c58-8683-47a4370fbd04", "value": "T171033A4D7FE18168C5FD057B05B2D42207BAE04F6E23D91E8EE564EA37636C08B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348434, "uuid": "e9f9e7b6-de6b-4c52-b75e-2a4a101e2638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348434, "uuid": "44574322-3e14-4a1c-a875-a527992355bf", "value": "384:oSxcaCisP/WRdL5kyc/5kvHHng6sZ8UrAF+rMRTyN/0L+EcoinblneHQM3epzXjg:5xckD5nc/5k/VsxrM+rMRa8Nu1Czt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348434, "uuid": "f4295da2-11d4-413c-91b5-d3d004dc28a5", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348434, "uuid": "a15683d6-21c3-40ae-9b65-c12be40450a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348434, "uuid": "a6914e5d-b0ad-4c0d-a2d0-f86a93306965", "value": "1dc0a9c68746a672c23f5ec22458f4bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93d1469-3435-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691311664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311664, "uuid": "496f3984-4fc1-423d-84fc-9d190f1fa421", "comment": "Malware payload (AgentTesla)", "value": "8272d730e43ac6e2bce1780264bb96f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311664, "uuid": "fe59544d-c0e1-4aa7-8854-d090fea5049d", "comment": "Malware payload (AgentTesla)", "value": "dd6d6790b18937e7f2ca0a99e4a7dca9a4f268aa3245ef319ba943d2f432a0fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311664, "uuid": "33db40c7-8942-47a4-b0be-66749b069390", "comment": "Malware payload (AgentTesla)", "value": "022269eea4b4609b5439d71cb23452fb8f2e91e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691311664, "uuid": "0a531d15-5ef3-49fb-8671-63709b90e8fb", "comment": "Malware payload (AgentTesla)", "value": "bc1ff0a8b045fd7d94f8095954bbe4ec68f58e90110e38eb5e76115a125e9bc67dd71d726c711e204ec27e4b4436947c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311664, "uuid": "40c4cd2d-d695-4371-98af-f887c3aab700", "value": "T1A7159E2072A58F1BE23E67FB5680A04843FA5EAA717ED6590DD271DB22B2F045F40F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311664, "uuid": "a913bbdd-f6a6-4e46-84ea-fc91c3afc185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311664, "uuid": "fc37db60-b114-495e-9457-07622bec7eef", "value": "12288:8QdOXTXhQjOnnKPoVOK20ovgZJ2CFBrq82WC+aI/gQsCGSqBM9n:+teOKgV32hCze82RVIgQsCG89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691311664, "uuid": "f03f30b3-c75b-440d-8270-d68b034d5ce1", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691311664, "uuid": "0d8e331a-cd96-4dc0-9853-342d1767a625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691311664, "uuid": "3ec97ca8-c9f1-4295-80b6-1160dc2d59c6", "value": "Hesap Hareketleri 03-08-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0cdb66-33f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283003, "uuid": "b1f446bf-49da-48c6-b395-bad8998e3856", "comment": "Malware payload (Mirai)", "value": "74a3c7ef9b2ad328a28944c63f083847", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283003, "uuid": "46072071-65cf-40f5-a24e-1cd176383850", "comment": "Malware payload (Mirai)", "value": "ddb27286ef835c7995594cbfc9a4d0843887c80627f890494394e797b1faed95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283003, "uuid": "d874eff3-7b5a-4336-b007-325027d187b0", "comment": "Malware payload (Mirai)", "value": "cb911f32c7b691067830044a23e7144f88cc0c81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283003, "uuid": "7ce538c6-2303-458f-9c2a-966a8bd280f9", "comment": "Malware payload (Mirai)", "value": "dc414cd7e8dcd9bdca3f77a2897a4c3cdc006a8ba5a1470a5783550a9188e34e72b42e30e57ffed4b30f9e2e005d3a6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283003, "uuid": "f054180e-fdf3-464a-8c62-ca759cd2037d", "value": "T1633339C8ED97D9F8DC5125712027EB328672F13B1019EA8BE7DDAA23BC52B41D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283003, "uuid": "72cf7fff-0267-4021-9acd-05a4d5a41a11", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZkC2BjWxrXdJKQDf1:ORKnAvjcV7ZIEJdxZkC2tirN3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283003, "uuid": "157b3785-9b31-4c1b-9a8b-31322f8cc821", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283003, "uuid": "ea5114b5-6a2d-45fe-993e-9aa9295d4e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283003, "uuid": "b7cc98a4-df65-4564-9c22-3b71afec7b75", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661fa84d-3438-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691312733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312733, "uuid": "58d87f52-6f46-421a-a6b3-2a78a33f38b2", "comment": "Malware payload (Mirai)", "value": "14d60e67e2d7979fb373c787a17b5cd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312733, "uuid": "aa6c84f2-771e-450c-ad59-0752b0e4c0e1", "comment": "Malware payload (Mirai)", "value": "ddff2ba46681156fbc9f3fd1313dd8f89aeac046c1a3ace28670751b97d7c7a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312733, "uuid": "80761d55-c906-4593-95f7-68839c02a66e", "comment": "Malware payload (Mirai)", "value": "6f54df5703a59e134f0a6a9f83e9bc84f6aeb4b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312733, "uuid": "8727e27b-ece7-4d7a-8daf-57d1ffd7840b", "comment": "Malware payload (Mirai)", "value": "a7e4785901d2f95e21630a7c443f8d5712818cc375a04d9e0e2fb897945deabfe0aa072b892538c5280ef0a5c791ae68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312733, "uuid": "edc367f6-ef6f-4933-ac27-a1b54b51cc9a", "value": "T1AAE2E1B2C389C6A5F7966CF528BD47E02BC5852733429EF1011DBF349DA06B2F2616D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312733, "uuid": "3bbd4407-5cf6-458f-a37a-6d00392005e6", "value": "768:RJQeVpD3CHPZAczvai2Ttw2QR3AA2vXEp4uVcqgw0RNWXJ:R6eV0HPZ3aiKaHX28p4u+qgw0bWXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312733, "uuid": "0ab850ae-9b97-48f5-bc1d-2528efc70c69", "value": 32432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312733, "uuid": "1c7bd6c7-1eb0-4a65-96fd-ee98f317a51f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312733, "uuid": "eb312b1c-c738-4dc7-a3f4-f94a38908e28", "value": "14d60e67e2d7979fb373c787a17b5cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646257cb-3481-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1691344083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344083, "uuid": "709deb00-44d6-4d3a-a7af-87ca20fa7e69", "comment": "Malware payload (Stop)", "value": "0df82b966a7bfcf3850513c19e0e139f", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344083, "uuid": "9b1473eb-94e5-46f2-9db0-dd4685ec8c06", "comment": "Malware payload (Stop)", "value": "df6677c1c90e5cbdc7fd9bedb1ec78143e8e540936890470a31e4c718e9bf7c9", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344083, "uuid": "95f97817-1fcb-462d-ac7d-5f46e4730889", "comment": "Malware payload (Stop)", "value": "bab6d1d3831504435aa3c6eb2d1fee2123d1139f", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691344083, "uuid": "60592c93-16df-41ea-90b1-8ff1dc1e4790", "comment": "Malware payload (Stop)", "value": "c832e1f71768a159691d6acfe3821487e6fafb215b73bcc573b9f29111a058268d5e8c16ba533abbefb81d29e721a58e", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344083, "uuid": "556bc2b3-4a6b-4e4f-a0df-690bd1e4fe9b", "value": "T12105F11352E03C64E5768A369E2ECAA83B1DF991CF59BF9A1318FE1F04B01B1D572706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344083, "uuid": "76c024a9-8d5b-44db-9cb7-82582a4d31db", "value": "85ce740324cd186ebe76660c5a8bb101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344083, "uuid": "8aafc9a7-892b-42a9-acea-cacae09dd736", "value": "12288:T2hfKrHeeWk/vw7hXDT1p6u9qsjDqa28fAkltFJR7Vti5lwfvi:TMfKrHeeWewtDT1p63pRYdJdK3I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691344083, "uuid": "c36dc0e4-335c-4dc6-9bc3-c859826177b1", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691344083, "uuid": "11388996-f376-4714-bbd4-c7fdefcb243e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691344083, "uuid": "0a697ae9-6593-4c16-be07-2c556465737f", "value": "1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333a55b7-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283871, "uuid": "c694c427-8cb3-432c-a123-982aa56b6489", "comment": "Malware payload (Mirai)", "value": "2d144e0095be8575422ba1d45a463d04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283871, "uuid": "5820c9eb-3778-4033-855b-576bd7a784ad", "comment": "Malware payload (Mirai)", "value": "e0d6d6c6e14540a8e43b3a68992bac1d8b56d207b29d77d9f81b03a453e2ec4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283871, "uuid": "98825336-b55d-479f-829e-c14a1b9d9a6c", "comment": "Malware payload (Mirai)", "value": "96f935db6d3926548abbc2a7b36acd6ae2ed0f14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283871, "uuid": "f19b3b2f-08fe-4a8a-bf41-066069015a8b", "comment": "Malware payload (Mirai)", "value": "9b01a61b5e1d1975e9faf39c4e4e0d5f8cca0d17264739b64b48c36aa07a63245c994f56e78d5dde8200e42c7bd7c009", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283871, "uuid": "67bc1321-88a9-4f83-b21d-caf973d2d3ac", "value": "T1C5838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283871, "uuid": "f53690d1-d9d4-4ed9-9186-f7c3cc363252", "value": "1536:LsMhLMLiQjlHvBo/AopJpLwA9Z5lsiXd42+:LsMhLaNZvBlA9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283871, "uuid": "d24ea74f-a10f-4794-a95d-c31328df3264", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283871, "uuid": "490c3241-808b-46f4-bfa6-1caee0feb4e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283871, "uuid": "7839a4f0-d082-44d2-a560-357c36216357", "value": "2d144e0095be8575422ba1d45a463d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0d98be-3485-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691345787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345787, "uuid": "2323c879-fa4b-4e85-96dc-0a4064a52d16", "comment": "Malware payload", "value": "198b0ea8eaa5f6158ee10d840a9dcbb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345787, "uuid": "b78470d6-6bc2-4600-b141-761e54024f2a", "comment": "Malware payload", "value": "e25eb133c786ade867a05438bc5c0d1bd69e1f40ed9fe7d5f38be5cee057b2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345787, "uuid": "e0d7d346-300f-4f36-8a4a-174664cace08", "comment": "Malware payload", "value": "44cb70f238e2f1cb0efcd85e3ae123cc73f475e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691345787, "uuid": "de6aaed9-689a-450f-9a56-ad0a2b7981d5", "comment": "Malware payload", "value": "53a45a1a74d70c430d40e6a61da9b615e0629fd708f12ddda1fcce0aa299b78bad377fb1f2d0e05048f4e49d299bc09e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345787, "uuid": "5346ed3c-918f-4f14-a4a2-fa50e04e36e0", "value": "T167546C1362E16861F6774A738E6AC6F8EA1FB850FF1577EB13589A2F09701E1C672301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345787, "uuid": "fdcac5a9-2832-407b-965e-877597835b3e", "value": "088cd9e5d803c1f11555296e944be32d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345787, "uuid": "210bfdd1-7b56-4637-8b72-5183d5636d7c", "value": "3072:EDArqZY3z+aJ9UH8ueRHG2RhuhEzDB77kMkHYRzc55p9B:Wt63z9PNm2Rh7k1HYpIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691345787, "uuid": "aaf488da-8935-4e3b-aff7-c50b67aaa8d2", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691345787, "uuid": "267c5739-f4dd-4e6a-8d87-7240e88c088c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691345787, "uuid": "f8cf8deb-ad23-4a75-a52b-7ef35d827eee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f45feba-343e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691315405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "e53c56e0-01e2-40d4-bea9-8362db2c25fd", "comment": "Malware payload", "value": "1ffcfb65693bed831e7ec4686506ddf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "89f08d5e-2b52-4c2a-9ceb-4c67caccf6d8", "comment": "Malware payload", "value": "e2a8cb51675272c5c4fe31c980a698589c8295c817ca1eaa48712b2431242c7c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "e68436b0-5c72-41b9-a11e-253c99b69d2c", "comment": "Malware payload", "value": "8bde0db4d4de1a1498f537abe038fd8fd98dbd22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315405, "uuid": "51163a99-c64a-42dc-8d2b-770ee2ffec60", "comment": "Malware payload", "value": "04f2ebd388299bdecea759a27181d4281b57adc4dfb5936399558d0351970e233a3ac9b14b155cc77c0107e76663fa7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315405, "uuid": "c173fb3d-3c40-4546-9418-b9c363d1a0dc", "value": "T17D7302547813EAFFC2B6073CF87F0C57350856498D9A2917D7925ABDBDC2A0398F8192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315405, "uuid": "140685c1-5e1e-457b-a2f0-550e5e38e92d", "value": "1536:0ZaytO7AC7yG19kEosVP+qjGt+bcjRUyj3MFXFAzCwaOcggicaBYYoabV7elj:0BtOhyGzzV98+4jCyj3M/yCwMg3cQbVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315405, "uuid": "f2e808d2-001d-4902-b743-8e1597035548", "value": 77640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315405, "uuid": "ae860c1c-99e4-46be-9535-0f7207e34be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315405, "uuid": "f95aea2b-38b5-487d-81af-6a9191ca6e00", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e57f56a-3438-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691312720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312720, "uuid": "402bfbf9-34da-4882-a3e0-4aecdeafeb4b", "comment": "Malware payload (Mirai)", "value": "91598db9a439680fb661bb408f9d6d93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312720, "uuid": "a1061ad3-32df-4380-beec-67f61fd5d66b", "comment": "Malware payload (Mirai)", "value": "e35a142a456b50307b8e1ddf27af0b1cae333b2df98b53cdf742c242bb9be449", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312720, "uuid": "42057002-540f-44e9-ac56-4235da0a8331", "comment": "Malware payload (Mirai)", "value": "ba3370f4ef8e10fa5f703e593867948c7f7faa7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691312720, "uuid": "e1836e67-7a48-4f34-aafc-79a2dd68fb96", "comment": "Malware payload (Mirai)", "value": "8b69ca7cf2e653c96e44f28daf833c4ae4ac4e924cf6ec25ff98befbc39212ff7b294ee42c6e1c2c08799ebedbee8618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312720, "uuid": "b04809e0-0ae0-4213-92e0-41a50c8faded", "value": "T190B33CD7D8065EACF4AED172E20B0B05A861D2188FF90E27E261FD5FBC21275B94ED41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312720, "uuid": "b2c833a7-0770-4973-9192-9b30ba050beb", "value": "1536:PjBuA0Iq5WL4DVxdaWhrUG8RefZYC03gOE8Yt:RoWL4DVxxQor0QOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691312720, "uuid": "07642c0a-b0b3-4c2d-8442-2dd9482c4c42", "value": 108436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691312720, "uuid": "93c8f1ac-755a-427c-8fc9-9041d0aeed53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691312720, "uuid": "3fa41f27-0b17-42fd-9beb-3631322c0651", "value": "91598db9a439680fb661bb408f9d6d93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030c4619-346a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691334041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334041, "uuid": "fd7ca8e4-246d-4572-9439-fbe7a8598b39", "comment": "Malware payload (Mirai)", "value": "b065917aff6c6f7d6d865d24cc33ddf5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334041, "uuid": "92145d5c-408b-4ea5-a561-219c6ffaa42d", "comment": "Malware payload (Mirai)", "value": "e7e34c3412eaf0733f808a72ebc4bf10e275cadb5dd4b15344d371088ef7f492", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334041, "uuid": "367e90b7-8f34-4510-8e8a-fc2235b53550", "comment": "Malware payload (Mirai)", "value": "dbeee3dc6c83716d7d2ca11605dfa94fccbf5551", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691334041, "uuid": "01f67ca7-0baf-404b-aaaa-195f2a8e73c5", "comment": "Malware payload (Mirai)", "value": "b51f4bb9cf3882f6f8113cd4cce5cb92f17045d4eebeb74ef224029a37ac8631a0f9a141e05351087d879b5fa6c51484", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334041, "uuid": "82c4f6cb-60fb-4d07-97ed-7c0082e9cd27", "value": "T117F31A56F8819B11D5C112BAFE1E128E37131B7CE2DE72129D246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334041, "uuid": "bca19195-6a05-4b24-81f1-5fc36dedbef6", "value": "3072:3qd+UykULBPieXNk3Dr/eaEJkG8jN2gSGCir9LNx7:adVYkeXS33maXdN2gbr9Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691334041, "uuid": "770a1a2b-c7b7-4bba-aaa1-6c962b407641", "value": 160860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691334041, "uuid": "2be8bdc8-d090-4bc5-a8a6-881b24058848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691334041, "uuid": "a0f96caf-fd29-46e5-a9c0-612ccaf14fbb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5226898f-348a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691347918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347918, "uuid": "63fe59cc-87ea-485a-a7db-8ffebe5b8e46", "comment": "Malware payload (RedLineStealer)", "value": "16f7a0bbf8a15664d4317cbb60579a1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347918, "uuid": "437ec9c7-c44e-4267-a582-2b22125f86c2", "comment": "Malware payload (RedLineStealer)", "value": "e8a48935660e4e21ba88c7f07ea99eab3e39cfccc49834b45701b00b77ca3d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347918, "uuid": "3215d4e5-a8f9-4521-9ba2-aab9ccbc1970", "comment": "Malware payload (RedLineStealer)", "value": "b2787e983a8e13f6ea8eb964ce3e3c0e4986f60f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691347918, "uuid": "f6e98024-58c7-45ca-8e3d-55484663a531", "comment": "Malware payload (RedLineStealer)", "value": "1387fbf6d670db6e259b56e0f2e5f17a8c89535b8a01236c1f8cef1b57ea94e0fdf54402124c93c10ae1fc0ba1f0c271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347918, "uuid": "134e6862-b47f-4870-bd8a-6f605386c34e", "value": "T1D0457C6238C08535DDDD30767B9CE7218C6DD0A09B2646D352C686DABAD09F02AFFF85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347918, "uuid": "1b48ce88-5ee7-44ea-82a8-3e54a3692c77", "value": "beb59a48f2399bd993c41436bf734901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347918, "uuid": "22563037-cbd7-43e7-b60a-435bd82b6e88", "value": "24576:Vh8lq2g1rhvcfm2wsDPShJic1elTlJLmUl:T84rhvcfmJD2DDmUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691347918, "uuid": "55b54a4c-abc1-4954-8925-b6670d170de4", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691347918, "uuid": "ed7c1af0-4b9a-4567-a117-f2c44a02dbb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691347918, "uuid": "e7819e3e-4d27-4f9b-b562-94cffade2483", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1278d70c-3486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691346093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346093, "uuid": "202d64c7-255e-431e-ac8d-20795afef662", "comment": "Malware payload (RedLineStealer)", "value": "3bc454c9104daf431f870fcb520c4b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346093, "uuid": "871cc2b6-9c2c-4673-9eb1-f1eef8909351", "comment": "Malware payload (RedLineStealer)", "value": "e8aad739e275549a864930e7b2fe7dd63820bbfbdc90eb6dfce2c8e5805284c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346093, "uuid": "4757dbf2-d92c-42c5-8a0c-1d65b92dbbd9", "comment": "Malware payload (RedLineStealer)", "value": "dfdd445c4cd1c8754499890ec2ebd840aa55c89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691346093, "uuid": "b5a9fe14-4c65-4932-97fc-df630083c5f6", "comment": "Malware payload (RedLineStealer)", "value": "5067a3557b6c10ba55f42f6e919ee172687256eb9fbf951a9a826737ba20edc09205554b9f7d9acbb751d71f42e898c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346093, "uuid": "2972dafc-a1a3-4888-95ca-10492092f5c9", "value": "T1B8E41252A7E8A072CDF527706CFB06830E32FC615A7553AB67A1694B1D732C0A57037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346093, "uuid": "cc27caef-fbb0-4421-bc09-cc4bae249b03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346093, "uuid": "0ca051e1-96cf-42fa-b435-23e7e40746ee", "value": "12288:nMrqy90057eXqA+nfMhydSmbH4hZFZBnbHypkXVgjDx5mOouz+YoYj3dhls:Zy357KqA+fMCSmbYbFZVypRx5mP+2YjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691346093, "uuid": "5f61fe71-82a9-44c7-9672-82139ee2a265", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691346093, "uuid": "3876c807-b4fc-4aaa-8a4a-a51418adbf81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691346093, "uuid": "132b6882-e9e5-49e8-84c9-3bd1c2888ef7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c02ef08-346c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691335157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335157, "uuid": "cb2a135d-a131-46bf-ab2a-f217a8c9a70e", "comment": "Malware payload (Mirai)", "value": "ebf1f11ff345e004b137a5f41ed6e79a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335157, "uuid": "c31cf2ab-4aa9-4600-a7fb-d1132809b579", "comment": "Malware payload (Mirai)", "value": "ea92d80d8b7d8be657eb667347be9e92004a54bf6f124e143744b6efada650cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335157, "uuid": "291acc15-0067-4b09-a9e2-8e37e8aff4ab", "comment": "Malware payload (Mirai)", "value": "35773ce3e082229b513cb0ad7bacbf7c69ea7472", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691335157, "uuid": "11d06d07-da7d-4451-a96d-a14c27fc7ebd", "comment": "Malware payload (Mirai)", "value": "7efb95e1e89662698f12ead6d442210a4d787713443d8d3fec5e7ae4ec3d2706d1aee5fdcc2b05fa81c8b799726d702b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335157, "uuid": "cebebaba-a280-45df-b376-5a1fbc31bdf6", "value": "T1CBB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335157, "uuid": "3858579a-f2fd-437b-a4f5-b5b88e44d1b1", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZeoamm/QcuLB1niDNb:YuFX0GIk1MHyphramm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691335157, "uuid": "1973b380-e8fd-496b-a60c-a228a1bf56c0", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691335157, "uuid": "98a2be1d-0c36-448e-b352-53535ce531f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691335157, "uuid": "3cdd345e-a0aa-4afe-a121-29bb4d73d511", "value": "ebf1f11ff345e004b137a5f41ed6e79a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cd76f3-344c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Havoc)", "timestamp": 1691321510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321510, "uuid": "968de5e0-2c86-4a01-b36c-e0e47345fdd8", "comment": "Malware payload (Havoc)", "value": "e3f125e7cc88a1c53cc68e1bcb273191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321510, "uuid": "b139fc13-25ec-4084-85e6-45a60b0d7d31", "comment": "Malware payload (Havoc)", "value": "ebdc54df582be1cafb91a1948657212fe50229b09071b1cbb3d1b660cc707fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321510, "uuid": "0ac4f362-3356-4c5c-a654-09bf9406ab71", "comment": "Malware payload (Havoc)", "value": "0eb2dad0cff22f251ae86528313e51345e952397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691321510, "uuid": "a4d41baf-4e59-4596-aea4-04b628426462", "comment": "Malware payload (Havoc)", "value": "73e35715830f97a95b4afaecee11f2dd54b78576d2b771d6c1ff84f77c7f365e72cd8a3b0370efc8b782ea21d497fe81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321510, "uuid": "cad1ac7e-1dd9-474a-9783-767e157ec83c", "value": "T14A93C806E1A330FDC5BAC2754B8FB632F9B6F45C15341F4A5B20C7092F60BB1662EA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321510, "uuid": "5d9f1f08-dd47-4f61-9a7f-6e15bb9e86e9", "value": "768:9bgyYWldBM19THIh9TxzGtZ4o+BGwC6M6IT7JAD14lthdxALrCPx1VskZhba/ejR:eyZ4THI7QQy7J84JACjZpbdHQz0PsYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691321510, "uuid": "5221f93d-0730-41d2-b61e-338d11bdecb4", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691321510, "uuid": "2d882258-2728-448f-a475-096d20c3894e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691321510, "uuid": "2ce6bb7c-1d7c-4214-b4d4-c4b12d279ce9", "value": "SecuriteInfo.com.Win64.Evo-gen.23781.18905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7203eea7-343f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691315759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315759, "uuid": "20988733-f278-4981-9fdf-7ac2783907ce", "comment": "Malware payload (Mirai)", "value": "b55c09fade561f749fec60bc821d2be4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315759, "uuid": "c2e60551-790f-453b-a540-34671f67b5dd", "comment": "Malware payload (Mirai)", "value": "ee89922c30cba60f14034c7b22ccfcdba9037db50177ad792bdb624815376dde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315759, "uuid": "f2e4f014-674f-4b7e-9f5f-364b53e75031", "comment": "Malware payload (Mirai)", "value": "ee5ab47b8f68e1d278ed44191d0a2fc03d6a59a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691315759, "uuid": "c63b73a3-34d9-4e8c-bc61-7d967eb4d1fb", "comment": "Malware payload (Mirai)", "value": "e167b6d9017a94ce0cf7386aa89f2a3c91494f4f641b206088370f9aab2bd4b5597523fb8ef60863812a55f36cf04d79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315759, "uuid": "844c383e-bca6-428d-b68b-c894a4117e54", "value": "T1AD935B39AD7E2B23C1D4547F52B70720B3E5A38E25E9875E7D600E1CFF51AA0212763A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315759, "uuid": "6839f400-55a9-4dcf-9b77-80bfb818e648", "value": "1536:Fy4gcQK6+LteNVJBS+3zTvaJz9dblUraRGgGfKVliXS:MdY0+7lvGgchS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691315759, "uuid": "0e0c7390-015a-478a-8a05-ca757a07655b", "value": 95068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691315759, "uuid": "ebaccc74-e356-4245-bea4-abb96c1647ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691315759, "uuid": "7abeb31a-31f0-4cc6-ac10-532dd509ec77", "value": "b55c09fade561f749fec60bc821d2be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94db2d12-345f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691329561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329561, "uuid": "190e9302-8150-4d24-ae64-63bb7dd23e96", "comment": "Malware payload (Mirai)", "value": "a7c336336289032dabdf63bd6a21c344", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329561, "uuid": "03754a31-f68d-4a94-8d58-493f81a56d57", "comment": "Malware payload (Mirai)", "value": "f3f2ba16867f4c706b6059ca42c9d052469d4499465249a84e0483724cacfa36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329561, "uuid": "8f145b7d-eedc-4266-8ac6-32e2c01ac8ea", "comment": "Malware payload (Mirai)", "value": "eea9380c8edc1ea2f0523a6bd839adacc8a9f060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691329561, "uuid": "610520cb-7511-421a-b6e1-fbac506e27ee", "comment": "Malware payload (Mirai)", "value": "3183a8ace6c64b7324efb9d942d0835acaa5e8151e8ad143266c5884fc9375aa579359e68585b47ab92fe8363b5f3486", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329561, "uuid": "4ed98b1b-4b44-4753-9a62-21603ebe4e55", "value": "T1C21339E6B401FE3CFC5EE37E85174A09B531B25905930A3B63A3FCA75C321944A6AF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329561, "uuid": "9ce343b4-5129-492b-a28c-6c9f7cc379eb", "value": "768:goytSM+ZEIXqi0GJ5MgWSnGvQKIRfsJu58d+bH/VzXqMfQJGEktz5oCKq:lWC6LG5zfG1IFso58d+bNxIJGvtNaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691329561, "uuid": "48356ebf-ec5f-433b-8dec-ff683ea47286", "value": 42840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691329561, "uuid": "c7acdc6f-1816-4907-938c-f933baa89294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691329561, "uuid": "dbabc3be-02ce-4f81-9cb8-8a8e244bff92", "value": "a7c336336289032dabdf63bd6a21c344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24889eee-34b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691366310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366310, "uuid": "3d55ee8f-263a-4029-8880-a3358f63524c", "comment": "Malware payload", "value": "9ba535714822f04dbe2b768aae10f5bb", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366310, "uuid": "12d1c2c0-0616-4e1b-8fd3-bf77af4ce28e", "comment": "Malware payload", "value": "f5f167423d31cdd7e742d6ae85d6170f26203ec7496d4e098f9e16f40e864c0a", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366310, "uuid": "cdd5c920-205a-443e-a759-350ad4d56df2", "comment": "Malware payload", "value": "7eb4d78e1927c855f2c6c859a04aff003faaac82", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366310, "uuid": "6fe6ddea-b3b1-4020-bf90-7596b7f1fac1", "comment": "Malware payload", "value": "70733ba4ae9b8865c02c6043a18621705d2c3dc82d8780281de9fe7dde68ba0f13b6f2241121e45e36bfb17020d1d5a5", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366310, "uuid": "afe96bcf-3d9a-4576-89e4-7fd37fcf77f7", "value": "T12F45DB38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A352C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366310, "uuid": "22110a4e-93f5-42bc-a505-98a6821630c7", "value": "3072:kOkkhHEP0ACrCBM5BQbz58We87EFF4iv09V5FJJ:kOkkxEP0A6iaBQbz2WerF4iv075FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366310, "uuid": "f42771bd-b4ac-46b4-9a6f-e6c9ecd82f25", "value": 1252972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366310, "uuid": "c4e700d8-04cb-4a80-89ad-b29e0928fec2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366310, "uuid": "18512493-c440-4836-96e7-4d954bb3b18a", "value": "correct.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20b64b0-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691284164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284164, "uuid": "ccc0f0e3-4616-4307-807b-cbf9c3054e9f", "comment": "Malware payload (Mirai)", "value": "e8815374b5fe5044a47d5aed72e09328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284164, "uuid": "3e62b138-77c8-402b-aaa8-e0627f6ae4bb", "comment": "Malware payload (Mirai)", "value": "f8a71156351e8c9a9f9d12e9416c435980864b9fd7c7700e6b3a2d40189eaf4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284164, "uuid": "bfc12c13-5fcd-4dd5-8acb-92f1353e916d", "comment": "Malware payload (Mirai)", "value": "c31c180323a069ba0a48382298a926d0d560472c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691284164, "uuid": "c692e7b4-81dc-4f82-9184-2b663e04c4c8", "comment": "Malware payload (Mirai)", "value": "e07887fc8acaaf92f3c4f8e319b309397432d027cea2a63d60de6765e70f8aa8dfb1e4f8109ed4307ab1cdad37ec980c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284164, "uuid": "0addc8e1-5607-4010-a3f8-4045c41efc1b", "value": "T1D473970A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284164, "uuid": "3d0d24f2-45d2-4a4c-a3c5-08a649c0624c", "value": "1536:HogWL2T87i8qXc3SEyOlnXLKgLhaV4+6uHO/YQBS/hP9AAxd42+Is:HoB2T2qX49JXLKgLwV4+6B/YQBSJP9/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691284164, "uuid": "48817233-5946-442d-ab98-a157d76e2465", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691284164, "uuid": "2c29b123-86dd-414d-b8b0-02eee7a8ed54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691284164, "uuid": "05167f18-e818-484f-bd94-06675f8de3c9", "value": "e8815374b5fe5044a47d5aed72e09328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2703b580-3452-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691323794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691323794, "uuid": "387a56e3-b39c-422b-a545-98a6509b17b5", "comment": "Malware payload (CoinMiner)", "value": "bae29e49e8190bfbbf0d77ffab8de59d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691323794, "uuid": "90dd44c2-2f8f-45a3-9af6-23b8e59f94ec", "comment": "Malware payload (CoinMiner)", "value": "f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691323794, "uuid": "dfc5f527-91ad-4d87-a23e-44163882e37f", "comment": "Malware payload (CoinMiner)", "value": "4a6352bb47c7e1666a60c76f9b17ca4707872bd9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691323794, "uuid": "194490d6-179b-4ad1-8e44-19588aeb7a51", "comment": "Malware payload (CoinMiner)", "value": "474e5990574102911d8c6f4d2c388bdb2144acb31381c4905dc807c0d68af4dc76faf00eef1c5c296d441fd11d786b5d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691323794, "uuid": "c6147d27-85cc-4122-b2a8-d16f8453f8c6", "value": "T16546D0786D6F093AC4B121B9E4C32DE68FC3588E564174F6AC77B8612FB09385AD3139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691323794, "uuid": "9c2b79f2-9639-4c20-a971-914cd12794c6", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691323794, "uuid": "a9258e63-a150-4675-82d4-aaf0a22bd092", "value": "49152:MMcDmMRlBdzs3EThgR0uEqBXLdcJAbtNmbOHaGhEospqOziZXAfrrARS7JL2ozPX:dcdrCET8XeospuZXAf0EJyocDKIVDT05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691323794, "uuid": "9ddf87e2-bb5a-40bf-9a56-ee32cb6cc4e4", "value": 5874968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691323794, "uuid": "c19c8401-b31a-4b2f-ad75-f84ded8a4496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691323794, "uuid": "8ce0b366-e81a-4a39-a720-a485bac10862", "value": "bae29e49e8190bfbbf0d77ffab8de59d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9604ba2-3458-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691326697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326697, "uuid": "7bfdd41e-50c1-4018-b62e-aba3800446fa", "comment": "Malware payload (Mirai)", "value": "be011082c5cf5d162c7f70c3d960239a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326697, "uuid": "ac967773-39d2-435b-8460-e8a5a9140041", "comment": "Malware payload (Mirai)", "value": "f9936e10bf11bc0236a408bb7f72ac0fc4f3ddb42a19c209ecfd979a3d3f0264", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326697, "uuid": "7673de82-143b-4919-a7c8-d73f17cb14ca", "comment": "Malware payload (Mirai)", "value": "4a2d0d1921cdeaa112f7c7119dccdb70252eaf2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691326697, "uuid": "363fddf6-ea2a-4e00-ad7f-c66abb9dc1fb", "comment": "Malware payload (Mirai)", "value": "87e951a0211b65ee3d33c2ad3fa3c813cb571d82c83319a8922650d6bde71c96d4e5f2aa3e3de81e0c7fb0e68289502a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326697, "uuid": "447dc359-1911-4720-948b-51696f4846dc", "value": "T12D539FA5C5E8AE98C61481B8B614CD394723A408A6E73DF6DA46C795900FFFCF4487F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326697, "uuid": "b96d31ba-ac18-47f3-b8cd-936a8c0e1bb8", "value": "1536:RBaE/nPS3/NRyOwCYiR6GyiubSI/+gMicHQXjGuSDCC7:RBD/nq3FRI0MftL/+gUHQzGuSDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691326697, "uuid": "63a20f16-9baf-4633-b075-4c9cb8cc28c4", "value": 63804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691326697, "uuid": "110fc0d8-83b6-47a6-87a4-4c8aa9389e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691326697, "uuid": "e543c9ec-749b-494f-917c-3d36e5c1e257", "value": "be011082c5cf5d162c7f70c3d960239a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73faae44-348b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691348404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348404, "uuid": "3a662ac6-6cd3-4050-86b0-d771c5cb9d86", "comment": "Malware payload (Mirai)", "value": "c6d9ea036d4943041f7eb9ddcd58b61b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348404, "uuid": "87212e1c-2566-4117-be20-ec9ca30bcad9", "comment": "Malware payload (Mirai)", "value": "faea5ea4e26ddaa16eda6f60100c0e3d0557784cf1d1a56ab111aa25d294575c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348404, "uuid": "a84a5715-2dd5-4186-a987-356fa74135e3", "comment": "Malware payload (Mirai)", "value": "6cbfa26e4f6a3453b55add0df81e3691482934b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691348404, "uuid": "55501ab1-9e60-4311-9f16-98284189d28d", "comment": "Malware payload (Mirai)", "value": "6a3435a25bfc1d2ac7b3cccb664e1647c7fcbdd8c3a2d177a0ecbba984e195ee3609163937fa914fc4221ff315cd5a22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348404, "uuid": "79312c1d-9744-492e-a284-6003fc9a4304", "value": "T1AE330262576D6AE251F08737BC32FC1A62AC17F99C67309A2CF0961577C18024EF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348404, "uuid": "17968a4f-dff7-445f-be45-bef829e70248", "value": "1536:s9O/ZMAXIxNUk0YCLcPqF1aBexo4opKZbh:s9O/ZNKyECLGqFUFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691348404, "uuid": "5339f9cc-b01e-442c-81f3-58e02ee9bf05", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691348404, "uuid": "b5eb6476-0431-427e-9737-c3bd8c00278f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691348404, "uuid": "c3e1cb66-8f1a-4b30-8408-52511018472f", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ccb742-33f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691283875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283875, "uuid": "21525d31-2d93-40ac-b93b-732e23c9c887", "comment": "Malware payload (Mirai)", "value": "34a93980b4385c6cb367d4f41bc10836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283875, "uuid": "c6a18bfc-155d-4059-b520-9c6bd81bb43a", "comment": "Malware payload (Mirai)", "value": "fde2173c8c1ff0354f8940992b42a0e02d7c661d902b3fe8db3c22a38b5d288e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283875, "uuid": "fc42210e-93dd-42a4-8204-46446253fb4e", "comment": "Malware payload (Mirai)", "value": "41323470f03ed3268164c7c501195fa3ae04b0cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691283875, "uuid": "4d8c76e6-b5fb-4c40-8ee8-7348dc4513c1", "comment": "Malware payload (Mirai)", "value": "f5ec0dbbe57e70b24ccc526cb9ff28e04a3aa68169065fe2fdea4bc605c5ca12f8f7a518f70415a6b82853cd44796219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283875, "uuid": "6c23ae95-0bd5-4898-8f2f-a83b4688820a", "value": "T1A7434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283875, "uuid": "cee5faa1-7967-45d8-ae47-e93914381f5b", "value": "1536:q01NDkjhWBPe1ZDaDy0wYrVdk/Grud42+P:qEgoBo3YrVcG2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691283875, "uuid": "96e4fae5-54da-4c9f-b94a-2f95cae69efe", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691283875, "uuid": "1bf3a246-132a-4f55-97ff-ac3c5d68a600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691283875, "uuid": "fadca006-83eb-4992-8b55-98a1023a8c49", "value": "34a93980b4385c6cb367d4f41bc10836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }