{ "Event": { "published": true, "date": "2023-09-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-03", "timestamp": 1693785782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "548146c3-9bad-493e-8b9e-2a9eaeab7214", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf7b58e-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714864, "uuid": "2c0697d7-bc99-49e4-b441-783da4e17523", "comment": "Malware payload (Mirai)", "value": "44e77b9b27f4fdb235cc001926bf05a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714864, "uuid": "ea86aa35-8b9a-4479-8d7d-647be1e95b9d", "comment": "Malware payload (Mirai)", "value": "0126dd6ad41aa00d84f6693d21a047c33472739d43dae80d0e08f3effd18da9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714864, "uuid": "39489f9e-752d-4bee-95d2-3234550619dc", "comment": "Malware payload (Mirai)", "value": "315d1cd868ea3c09fcdb07d04a141cc420666fee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714864, "uuid": "9c866216-0f4f-40ca-86ec-2c53c2d4d330", "comment": "Malware payload (Mirai)", "value": "d09299349890512605d7699a129b9dd19a283e790296976f13409cf40424c6900d6a5cd6aad32a383e5f43fc5540fe86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714864, "uuid": "d2c9dc8e-c9a6-4e8a-8cba-710a6c5bf2bb", "value": "T19E435A02331C0A47E1625EF4393F27E083FEE99021F4F588664FEA464276F37158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714864, "uuid": "a476fc4d-8cf3-4d49-b15e-91256ff585d4", "value": "768:MCZJL0jH4wtucKe7PKyQewJ+TRLVp5zFfZNOybC9pDSYwUCuNyTyJ3DM3bdWtZAZ:M8leVJwIPzVObBS+zqyJ3D7zsLBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714864, "uuid": "4e1642fa-a7e8-49f8-ac4e-7553d71c9ad2", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714864, "uuid": "d51399a8-c5e9-4b15-998e-e87a6bb76284", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714864, "uuid": "3d646605-ff6f-4e74-9dd5-dca62ad86d60", "value": "44e77b9b27f4fdb235cc001926bf05a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1229e09a-49ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693707036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707036, "uuid": "fa161fa5-ab7c-4806-a9a3-57d85e6a4a2d", "comment": "Malware payload (RedLineStealer)", "value": "0b7c0cbc28ccf7a253a7f2d1787b86a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707036, "uuid": "cba8512d-cf51-40e3-acf8-f3fd84e6a12d", "comment": "Malware payload (RedLineStealer)", "value": "02be50acb754a09f75b3b1b6b4b8dd8609c6d297ccd89a1705bd8446149f6712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707036, "uuid": "ac8b563d-0c3a-42d6-8f60-a71b4484308a", "comment": "Malware payload (RedLineStealer)", "value": "4a49cc32189e26042d4322eea026c139d3af0a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707036, "uuid": "6ae9d2b9-4ec3-4927-a536-8103cb6f56fb", "comment": "Malware payload (RedLineStealer)", "value": "b30bd2e9fb05f3603dc0c849b604209332ba0f12b01124a7c63e94a7081b0d2738d52ce135c7306d2bcc3c269f410f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707036, "uuid": "8c429e69-a8ef-4b5b-90a7-d2884e10282a", "value": "T12394CEA3A1E0BC28E51DC7318F1ECAEC773EB8604D256B5727745E1A19311BAD6CB309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707036, "uuid": "86770b1a-fd35-421d-b430-a22acb736643", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707036, "uuid": "a605e54c-a595-454f-802e-f71acd5a62ad", "value": "6144:A7MdT3v2HwjULPTmhkPF0QV+eGt/0Ym9Salh6gYK/y:A7ED2H9WkPFx+eGpm9Salhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693707036, "uuid": "2a6e7c27-5e4f-4fb6-aab2-1f02b545aed4", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693707036, "uuid": "fe4eecd7-dfba-4eba-b049-741457fb3700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707036, "uuid": "04257193-d88c-4217-addd-824461f82f3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d6c738-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693750903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750903, "uuid": "eae5e5ee-b727-499e-b9e4-0d24e0ebca6b", "comment": "Malware payload (Vidar)", "value": "35acce75131913602e8fbae88bb9720c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750903, "uuid": "e4ffdfdf-fed2-4d9d-944f-10e4b1314362", "comment": "Malware payload (Vidar)", "value": "031652f034a9b1bf3486ae3578cf1673ca869670e88a6dec5b281732566bc527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750903, "uuid": "23d2ef6a-f6df-4877-a928-428064b3c56d", "comment": "Malware payload (Vidar)", "value": "557ebdb76ced3be23038570e86dec5565ba55b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750903, "uuid": "1f11a80a-1381-4d31-8fe8-314463d47374", "comment": "Malware payload (Vidar)", "value": "dcf2c0a0a9c5d1f2f0cff71e8b07e47cfc1c8e1a722ccc3acb7692f7583d36fa2e1bda6cc03a7e321ed215b67546778d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750903, "uuid": "515df925-8e83-478c-8b2c-e8799b16dc37", "value": "T18E747B8366D1BC72D41D43368F1ED6EC772EB8629D15ABB627542E5A29313B2CE4330C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750903, "uuid": "96679964-1ba1-4ae8-8d5f-14283ae85b30", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750903, "uuid": "a75b00ea-01d7-4d0e-84a6-4e06fc873bc0", "value": "6144:YaFKzUGv24QlDQ3kyd1FNN3mwG88BLJ0mnshTSnL:YaFKzhtQ1Q3kynF7RgLm2sFSnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750903, "uuid": "31829fd3-21eb-497f-bd40-9fff9e53b391", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750903, "uuid": "a25c1de6-b2f7-4aea-ad0e-ae878915570b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750903, "uuid": "a1b3027d-89d9-4266-89cf-639073dc8bb5", "value": "35acce75131913602e8fbae88bb9720c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070719cf-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693750826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750826, "uuid": "2cc70fa7-e8c6-4769-ae39-6fd8b885696f", "comment": "Malware payload (SnakeKeylogger)", "value": "31a79a822050cb569e2a130497872066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750826, "uuid": "fc4f451b-8cb5-4934-ac73-d4fa5b257c6e", "comment": "Malware payload (SnakeKeylogger)", "value": "03f8dbf1f3cd5848a4b4bb6777b2143b3a6dd8bc34faa4f732509a7f539a2c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750826, "uuid": "4b092cc4-f1e1-4744-ab2c-f7f1836c0a74", "comment": "Malware payload (SnakeKeylogger)", "value": "5407169db91e7b0827c4b8f2d785abcb0aab9e88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750826, "uuid": "2fd89187-2fcb-4027-9ce9-e9642cf32095", "comment": "Malware payload (SnakeKeylogger)", "value": "c1c42e80f543d780927e9c97a80b2f01a677806b033bcc3e77db83b284348b9d9ccdec54dee2b9ac18259c58dcbdddab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750826, "uuid": "d4d62575-455d-479a-8cba-9df21df7bbfa", "value": "T1C654F15262E5092AD0D273F954B62442173EBD7A1121C20E9EF0F9A475B3763ECC3B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750826, "uuid": "b0e39ddf-2ee9-418f-9f39-2b4c921a8e60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750826, "uuid": "12dbb2f4-c3e7-4b36-999a-1741d6991f61", "value": "6144:VLCAiQyE5mas1VRdWBBGGTa+p5lQmgCNY+0yu8EVD:9CAiQywd4wB75Jgqxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750826, "uuid": "f225703f-c231-4d78-bef6-b2d45b2ade41", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750826, "uuid": "125341c2-ff1d-4e4f-8501-262768f8cc2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750826, "uuid": "1bb7152e-4667-4f18-b61c-6b543fcea7eb", "value": "THG00809000090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a576c-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693777419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777419, "uuid": "4adabc01-6724-4dd0-8980-299e41ee0fb6", "comment": "Malware payload (Mirai)", "value": "265200f3c9b9e07b07eb37af39bfe947", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777419, "uuid": "49cc8b47-bc24-4ce5-b91a-b0e4a23b130a", "comment": "Malware payload (Mirai)", "value": "05c4f1870e699ac570f40c77ae947d91189dd8cf84bd83ea6dc86ac653a07c95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777419, "uuid": "0569cf77-b5d9-46a1-943a-094383c7d025", "comment": "Malware payload (Mirai)", "value": "1dd1dfab73625e40d1a222304299fc0ab7a9cf08", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777419, "uuid": "e03ea054-45e3-415a-a992-ac8a2da95e76", "comment": "Malware payload (Mirai)", "value": "46f64c3ec6122ab0d92e51155f50f48456a34c348b7491b40fac9ad87ff2007a851c1b11bcb8d7e3028c444c785818c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777419, "uuid": "deefa8d7-0374-45b0-a9bf-54dc739c074e", "value": "T14AC3F849FC515B13C6C612BBFB5E428D7B2A17A8D3EE720399256F60378785B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777419, "uuid": "10a14fa9-7254-4c11-b9c8-6d3171999a6f", "value": "1536:uB25fCAg8yfFxAdZ54VPkOeITsxwtaysu4A46/+0Otl5N9wywmO/BFBAs/x/7TL/:uB4LoFxy4eYQxwtayMInjn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777419, "uuid": "ebbd798e-590f-4825-97f8-4c334724ba40", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777419, "uuid": "d8de3797-66b4-4808-aedb-87ddb384201c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777419, "uuid": "dc5c64dc-1ae5-4e09-9cf7-f1eccfe85906", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcc71da-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770886, "uuid": "8bd3fdac-cdcd-4c8d-b603-7849627ca99b", "comment": "Malware payload (Mirai)", "value": "e697f33f3e57a3d89b210f4e47271784", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770886, "uuid": "d8501453-7a7e-4a49-8482-8eee3df66201", "comment": "Malware payload (Mirai)", "value": "060df6a07c3f16a365ad9f3ccc8713f50c08c5d56d465d9582d96e4796cf18f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770886, "uuid": "c46fd184-91cd-4c9d-a202-05fc50915ea4", "comment": "Malware payload (Mirai)", "value": "d85306f18ab6983d1d838304477fa2e7d7ef3240", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770886, "uuid": "5a289f13-6ca4-4259-90ac-651dd0f019f1", "comment": "Malware payload (Mirai)", "value": "4ba5afbd7f2689a003323d10911801869875b80571b5f33c6196097bbe4f1c47e2fa482881ea65d989f41094932324eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770886, "uuid": "ecbe0a33-c14f-47d4-aa12-1c9629b59b0e", "value": "T1F2C31955FC405B13C6C212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770886, "uuid": "49d4aa4d-41ad-493c-88f0-afaa096587a8", "value": "1536:J9v0s43G5bUWk5RA7Sh71QAFMxK4VIGUT2yZuJO/6AA46n3thlcSwyw1FrR73VMW:Lv0XQ2R8g71QNE43UqyZuJOe463tM3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770886, "uuid": "8570a10c-051b-4b36-90ef-70923adaf206", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770886, "uuid": "b7766cce-decc-4c6d-be0b-090231c7724d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770886, "uuid": "8c5005b0-634b-4599-aa42-63e6ff8ba038", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc428e46-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748553, "uuid": "d4775417-f1a3-4e17-93f3-f567b8116e9b", "comment": "Malware payload (Mirai)", "value": "0acc02f56df0a3f09bf60ab094b553ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748553, "uuid": "e758905f-3494-4f7f-8536-90680d47eaf2", "comment": "Malware payload (Mirai)", "value": "097dfdd1c8b6f85072e1b8a58882dce8f59f2667035e6140dc225f95374316b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748553, "uuid": "d566ccec-cacd-44ad-be28-59b3abc88e22", "comment": "Malware payload (Mirai)", "value": "cf5088e71ab7d0015926aed0652c42fbdff86cb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748553, "uuid": "3e027402-0097-4332-babe-9316c1da7530", "comment": "Malware payload (Mirai)", "value": "74756c0cb89e16584d28a67f137b09933dda9fb57b1086931d9ccc051ce89548e460c8b811c5e15003893307d5d4bee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748553, "uuid": "17feee4b-9faf-448b-a4be-02e5e0a3541c", "value": "T175536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748553, "uuid": "5a793d84-6e18-46ff-a6fc-476e78ab0c9b", "value": "1536:kPqRg0FGTbSX5xpLepSGoisF7QhOx2X/ZOqc/yA8w:p5VH88I9cK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748553, "uuid": "7987d06a-10b9-4d87-9bfe-5eb3600f34f8", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748553, "uuid": "de44e6b1-7818-4ce0-8fef-e248a0c37766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748553, "uuid": "c9b8cf96-4910-4db3-91c5-ea4f58139a67", "value": "0acc02f56df0a3f09bf60ab094b553ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14169a19-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693750848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750848, "uuid": "646e90f1-621d-4931-a371-dcaa71311d6e", "comment": "Malware payload (RedLineStealer)", "value": "614803d5384ce1b1a1c43cba028e5635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750848, "uuid": "4a4c7edf-56b6-4bb9-97c1-7efcaefd355d", "comment": "Malware payload (RedLineStealer)", "value": "0ad4c61b29220a34e150a7ec784f4c7bf9ece86417e91726cccc0ef3baba828e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750848, "uuid": "6c963f86-4233-4ebb-b177-f019973b325b", "comment": "Malware payload (RedLineStealer)", "value": "24a07f27369d82df1a4f10b5ec2aeca8d09b80de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750848, "uuid": "a95741d2-a835-4fe6-8f47-1863d718dc30", "comment": "Malware payload (RedLineStealer)", "value": "375db382f4885b5e0e074e417b9b70c448f3752198d42a56b046baa2dd12e6b357533c7467e3629c576746dabdf97601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750848, "uuid": "f5233731-28ea-45d2-a3b4-c5cbf9b98c6c", "value": "T1BE352313F3F89472E9BA27B068FA07930636BC916D74DB9F3795C4160D32AC09076B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750848, "uuid": "4ec23776-a318-47cc-9f2b-03fe340b412a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750848, "uuid": "9ebcb151-7835-45d2-ae99-7ef782ec6b89", "value": "24576:hyFCE2UOEEwiVyTtCedo0NXZSDrNoRycidg4jMglb:U92/ae4/doUqrGid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750848, "uuid": "b3804123-0ebe-40d7-b547-26885c934a8c", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750848, "uuid": "df54a0b1-b2c2-4330-8b36-69556d37bd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750848, "uuid": "f960f43f-6c40-4347-8002-6afc94fb5b80", "value": "614803d5384ce1b1a1c43cba028e5635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c1870b-49ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693707312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707312, "uuid": "f12e6401-8d43-4f45-bc39-57866c4f1fc3", "comment": "Malware payload (DCRat)", "value": "a301f1d7fe80574cc4888e1477cf5a22", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707312, "uuid": "adb69281-d161-4144-9cc5-4ee589ef7603", "comment": "Malware payload (DCRat)", "value": "0ba951d1a97c8f4e8d64870f98ef777b11d3f49a1cd195482e3575361dd7346d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707312, "uuid": "3f1e5940-0104-4d69-8836-f61db459e82f", "comment": "Malware payload (DCRat)", "value": "a2b43366cb4cb30a4d2c5bc4cc29dafecb42455c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707312, "uuid": "befaef0b-d9a6-40a2-836d-1007d7a96199", "comment": "Malware payload (DCRat)", "value": "4f75cf7430cb6c9dd1b32da0624607c937d2d6f4260e2bd01b1d8943223d2454d4fab488b6553d24b0b6cbb27cc94e40", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707312, "uuid": "31025501-1a82-4cf4-a9bf-f8006ad3b8bd", "value": "T1B1858C05BE488E21F0081137D2BF451C47F1AD51AAA5E32BBABA776D15223D27C2DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707312, "uuid": "f990cad4-2a6a-46c2-acd1-cb9ebe04e2cb", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707312, "uuid": "630364fd-a391-4eda-966f-224434f29ea4", "value": "24576:P2G/nvxW3Wz0XaV306S/0M/W5DyaCwvvTYdydYsXb30FTMsDQqE6jLGPbEYbF:PbA3dX83lS/Ve5D5vkrMb30DD7GP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693707312, "uuid": "80b19c96-ed56-4c35-a1bb-96eeeb24001c", "value": 1792867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693707312, "uuid": "58a67661-c311-44ad-8950-8deae69c2020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707312, "uuid": "c40cc6a2-7e56-4b95-875a-e91fd702b681", "value": "a301f1d7fe80574cc4888e1477cf5a22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d4c35c-4a66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meduza)", "timestamp": 1693751331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693751331, "uuid": "1f854fba-3b73-417d-935f-21d4bcb60481", "comment": "Malware payload (Meduza)", "value": "c6068c2c575e85eb94e2299fc05cbf64", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693751331, "uuid": "833cb6db-ba24-4ef0-8915-63ca55c3a57a", "comment": "Malware payload (Meduza)", "value": "0d0a4622c58f3f17d16fb5cbd0aa5403bc614ca58847b4a725f432d202a55454", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693751331, "uuid": "fb2f2ad1-9b61-4731-a5d1-55dd6112c84d", "comment": "Malware payload (Meduza)", "value": "a0021d91efc13b0e3d4acc829c04333f209c0967", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693751331, "uuid": "8496c396-ec6d-4843-8d71-0be327d24ce7", "comment": "Malware payload (Meduza)", "value": "610415a55247d3d7132d5c17516f2f8a0f00d2a2c0a67d7d8c435af732a7816c400c19afa157282aaec43ccc57d274a4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693751331, "uuid": "552f9e48-5f3d-49f8-a0ad-d64b723ba2b2", "value": "T126F40834E69C3669D06BA078FC4B5C02E93678AA0320BFEB12D55E521F96ED14F3D360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693751331, "uuid": "bad7eaa8-48c5-4797-ba41-3aa8671af4f0", "value": "59fc3561b97c1724a66e573b2805c788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693751331, "uuid": "744a0877-6e6b-497c-83ec-d49b349ef5ee", "value": "12288:pZPsyIba7gggggggg0/Ad3m5mz1U/uuUtw/8r2y5mukp:pZ+8gggggggg04d3Imzy2NADy5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693751331, "uuid": "8d733ae0-8e9c-401b-a56f-cdd27c3bd711", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693751331, "uuid": "72cf9ee2-e931-4520-8fa2-c663681cd0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693751331, "uuid": "e21ed52a-f457-4528-bd2d-6e73014c830c", "value": "c6068c2c575e85eb94e2299fc05cbf64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb860e8a-49fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693705710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705710, "uuid": "d9584924-8a6b-4691-b108-b5f0919d9f13", "comment": "Malware payload (Mirai)", "value": "135181e3e5cfbd1f4c6476f925611a96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705710, "uuid": "5c28d387-a96d-4c41-b0e0-8b67b8f31e36", "comment": "Malware payload (Mirai)", "value": "0d163f738f956712e58e0c03091cd6b294602cfc4c4f2aed59e7dc69061f2fee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705710, "uuid": "8e29d1a5-8a54-4231-859e-891d12e44bca", "comment": "Malware payload (Mirai)", "value": "0891dcc8bf678be7d63a46bea224c915870f3171", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705710, "uuid": "79f718a4-ccef-4aed-a2e7-24f124838bd9", "comment": "Malware payload (Mirai)", "value": "cb449a6a3bf55d24e75775e35b368ef1166b7361ac9ed8825e35ddc47bd4df1520ef5285d1791d53351974ffdc51c8da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705710, "uuid": "33cecd8c-e726-4891-abdd-619c163a1415", "value": "T138C32A06B31C0947D2632EF03B3B67E1D3EFEA8121E4F640255FAA899171E325585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705710, "uuid": "95eb27fd-aafb-4001-be1c-086c4f46099a", "value": "1536:Manp0Z31XP4gOIGeFv+q1xpjvTPNyrRms+gq4/MrgvAcIoHuHq7XHq+oPkCQ39:B0PG3q1xV7P0igl/M5cPCQ39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693705710, "uuid": "c8f8c381-7435-474c-a437-dbbbb8e09f02", "value": 125240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693705710, "uuid": "000e7dfb-5931-4c9d-98c8-67d8761c7698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705710, "uuid": "db5ae807-12f5-4938-bfb3-283a53d3a188", "value": "135181e3e5cfbd1f4c6476f925611a96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dd17f4-4a91-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693769828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769828, "uuid": "54e41a61-f7d1-4b7d-b003-187c51d1c436", "comment": "Malware payload", "value": "d4997d86eab428ad40aeb9e51a69051a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769828, "uuid": "02c1e179-81f1-4bd7-9968-4a8583746ad2", "comment": "Malware payload", "value": "0ec4e34372e516b5fd8bd85fdc8fae847fb735b79dc63b33dc0c8697745921b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769828, "uuid": "c369cc79-3f75-44fd-ba2a-52d474f89afb", "comment": "Malware payload", "value": "777fe99fda5c4eda3669c58e85816439893d1695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769828, "uuid": "0b421c23-36b1-4c6e-b468-001fc51805c3", "comment": "Malware payload", "value": "2f519015e9e8fd74596bbef63f4d9ea8b9d98d80648248150a920e5e0614e374366ef2063cc26822e31acf43d635c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769828, "uuid": "fbfb36dd-1440-4794-a456-854263b0d3b6", "value": "T1FF152393F7E865B2CDF117F058FA23A31A36BC614879861B339A9C5A4C73984B03171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769828, "uuid": "caac782f-773f-48c8-a458-613c86173210", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769828, "uuid": "ee5731b6-7f2d-42fb-b792-288affcc08a8", "value": "24576:Oy9g+NzjOWXxfEmThIN8PYo0ulMVMtroUnq6xdwKMkn:d9TAWXxfEm3Ao0u+Mu67nP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693769828, "uuid": "44596dca-6222-4c8f-9581-5e8ad698030b", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693769828, "uuid": "ecb54a3f-52e0-4ac8-8086-62c1c8ebee94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769828, "uuid": "83055714-42e1-44d5-a1e2-4a56a75d7c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466e5724-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726022, "uuid": "380646eb-7803-4d20-ad1c-0f4d9207ee7a", "comment": "Malware payload (Mirai)", "value": "eb57c3b1a40ccda4fab75db0c9dba7a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726022, "uuid": "0b74f37e-0b5d-4210-8af4-63c117316674", "comment": "Malware payload (Mirai)", "value": "0f2513635a2111292f41ce22b3124d23070b05600f0b30fc2a2f7c0cc41ffd0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726022, "uuid": "21064271-d0a7-4b18-b738-082d371794b7", "comment": "Malware payload (Mirai)", "value": "daed15aaf669205daf1d22928364455d0260b201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726022, "uuid": "dedce772-1151-4bf5-8a08-30f9605ef8fe", "comment": "Malware payload (Mirai)", "value": "e6042118d2b12c54656292550befa0ee1b7aa7eafdebcb227ccd376a239d1a90c49e8f8d20f7ba3a7a069d59090a66d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726022, "uuid": "3da31b24-6b4c-430d-bd3c-c5191861615b", "value": "T165A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726022, "uuid": "6058da67-ccf5-495e-90f7-c6f06924dafa", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fYHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fYHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726022, "uuid": "85cf8e3a-3b82-4be8-932c-f5c8d5336d31", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726022, "uuid": "74881f9a-8aca-444d-97ad-c7f9c693f452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726022, "uuid": "0790f509-240d-4b3d-a809-8ca3b315cac3", "value": "eb57c3b1a40ccda4fab75db0c9dba7a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f7d38-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714935, "uuid": "8a63a477-7f5a-41fc-9688-ac38780dc297", "comment": "Malware payload (Mirai)", "value": "6960ae709a69fe7273a7d1ef7d0216f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714935, "uuid": "b7a668a5-0a3f-4797-ae2e-74bb53861408", "comment": "Malware payload (Mirai)", "value": "0f60718cbacc33c0e854e6611c9ac3d0233fe2f36d60da51af55a6144b28776d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714935, "uuid": "d897ff55-5a7c-4c18-846f-b03ab5655015", "comment": "Malware payload (Mirai)", "value": "da97a48893b8223cce908d34e9744c5e00775bac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714935, "uuid": "97bf105d-baa5-4479-91ae-9fde3c3a7715", "comment": "Malware payload (Mirai)", "value": "6f6dd2f7fea62417b4f8fa6a8fd47e11c21af79ae3685cb231dc0540af26c8d4f8d48d1fb61963c443db63520227c67b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714935, "uuid": "b1f7e822-44fd-4efc-9d19-c30cd0701370", "value": "T1C273850E3E619FBCFBA9863587B34F209248339226E1D545D16CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714935, "uuid": "52eab3d7-a25e-489c-a8e2-a95f83f4cc97", "value": "1536:z4JMVUay6+vl/h16IbycUax9E2YDsLtkR5fTb0jDUjWn:UaZy6+vdmIbycU63kR5bbmDoWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714935, "uuid": "0cfd759c-77b9-45be-9da5-e276c47c02ba", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714935, "uuid": "981f8337-2698-48bc-bcfe-8dc371bf5b6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714935, "uuid": "c181c322-23e3-4a09-8431-a930c8b35937", "value": "6960ae709a69fe7273a7d1ef7d0216f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba101572-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726216, "uuid": "c1c4c914-a92c-499c-bb72-443b429dfd1b", "comment": "Malware payload", "value": "08eb23c9804b60cc1173796b53b5d23e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726216, "uuid": "aba0fcbf-4666-4da7-9fdb-1a5ae7603805", "comment": "Malware payload", "value": "0fc4915953e80970249125af9cc467c21477d5165f3f998a6a30275f6ffbd94c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726216, "uuid": "178f29fa-ed20-445e-8c2e-2a3606b1bf63", "comment": "Malware payload", "value": "8dacaf4d146ae83102b95e4a4b72192a03eac6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726216, "uuid": "bed809be-c4d5-4709-957d-d425e98e5398", "comment": "Malware payload", "value": "8bb23bf2fc5bc335c6ebf4f34bc3e50130d52dc4f18df23c66fb583fcc97689b76cc8b7168738ffee41ac1f09dae4640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726216, "uuid": "cf3ae77e-53d9-440d-9d1b-78c6986f4221", "value": "T175E46B4382E27D5AE9258B728F1FC6FC778DF6618E097B6562189F2B08B11B7C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726216, "uuid": "5537f9d4-0c23-482c-85c3-e5cfebc05062", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726216, "uuid": "b4f0af64-edda-4e3e-a65c-eadf90ec74a7", "value": "12288:GIb6fK4oJSEsnda739k8qwoH8+0ilHGdlkT8Yzovy8:JbSKJJwd6kgoH8+sdlkT8Yzey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726216, "uuid": "8d44f148-b5a6-437e-9d6e-dec79586132a", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726216, "uuid": "6e6c0bf1-2b76-429d-9764-4db271b55009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726216, "uuid": "e301a14d-8e53-462a-a542-b328919e384f", "value": "08eb23c9804b60cc1173796b53b5d23e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de625586-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725847, "uuid": "7529921e-5ee3-4a9b-841c-08f47e075812", "comment": "Malware payload (Vidar)", "value": "34498ae3f999336a66e16c054d664196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725847, "uuid": "09f67817-db5f-4292-99e3-e2ecc8e54ba9", "comment": "Malware payload (Vidar)", "value": "1004b8a30e8475c5e466f75e65a59c17c726a83112f65916c8298b49e93c8fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725847, "uuid": "b3886c1a-991f-46fe-9b13-8ab579ffd3b7", "comment": "Malware payload (Vidar)", "value": "60431a0cd9a375fb8a6c603bb4928db821ddf154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725847, "uuid": "425bf77b-db00-4156-8783-cf15203a1dcb", "comment": "Malware payload (Vidar)", "value": "59b229621fc1afa6ab1bda0db5360d3765fe6d0361573c5e3a886b753c0f9084ce29759badfaa7a978d39b0248b16391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725847, "uuid": "7e06fa98-2229-4725-b00a-005e7580936f", "value": "T1FF15AE4392F17D58EA368B728F1FC6F8760DF6605E09BBA92218DE2F00B1176D263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725847, "uuid": "39786635-e21c-45b3-8166-ab29edb69163", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725847, "uuid": "e825bb38-b1d8-49b4-96ec-712b3cbc7bf0", "value": "24576:S8BKhTtR/owP9S+47DzxzXVOOOrF9gLHL/:S8BKhZVBStLxzXWgLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725847, "uuid": "18a453ef-74b5-4a12-bb47-493703f50e88", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725847, "uuid": "5bfabcf4-2729-4e14-b209-71e3f8e08a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725847, "uuid": "7d37bb0a-d478-498d-845c-01e61248580a", "value": "34498ae3f999336a66e16c054d664196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a6344-4a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693774063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774063, "uuid": "14bbf2fe-a741-40c6-8a08-17a03ba2fcfe", "comment": "Malware payload (Mirai)", "value": "7c1aa434617d7ee1dd614750b488b6a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774063, "uuid": "8db5a430-43bd-4b6d-a62e-d36db99c97f4", "comment": "Malware payload (Mirai)", "value": "10daf441d59e68157b0b2fa7792ac7e563d5a2cd511176f1faac8e433fca22b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774063, "uuid": "cbfa5aa5-f0b9-43d9-9368-a061cf369273", "comment": "Malware payload (Mirai)", "value": "8546a5ed1cdfbce0211f71e3763ea59ac1d44811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774063, "uuid": "67a49cef-54a5-4da9-b581-479384936b12", "comment": "Malware payload (Mirai)", "value": "91d2cdb45a8551f842212918c2b6d09a13f6fc63088994093cb9090f09d9a91026954bca4796d52d1462e35add1f0e28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774063, "uuid": "fc5f83c9-a892-4590-8acc-f9e1df2d02b2", "value": "T190D32A06B30C0A47D1632EF03A3F67D097EF9AC121E4F640256FAA8A9172D365585EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774063, "uuid": "b8caff57-958a-45e1-b33c-ae7127659b99", "value": "1536:y0nwryWPcn/qFIWZSf98z+xpnvTnNIwvFcggM7PMvgvAtI90DD2B/q3YEkFg3Si:pWPcYZq8z+x57nVLgMPMNtUFg3Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693774063, "uuid": "fbb569fa-a3fa-44b5-a724-6db3d8f8f3c7", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693774063, "uuid": "16821d05-7304-4da5-ba7f-3ad16c213ddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774063, "uuid": "e92a0047-c418-4394-ab9d-a13191883961", "value": "7c1aa434617d7ee1dd614750b488b6a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501dd3fc-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714871, "uuid": "006d366f-d88d-449b-a9dd-0b2f30a27487", "comment": "Malware payload (Mirai)", "value": "2c4f5608d5afa5ce665211cb2c38370d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714871, "uuid": "a2c1d55e-acb1-4bf4-a5a1-0319c9c075df", "comment": "Malware payload (Mirai)", "value": "11c81622e885e1f9485b70b4860c3d2285cdf73bfd9065b22d876f378efa0b5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714871, "uuid": "4bd47541-0df8-42a7-a379-9952f64e241b", "comment": "Malware payload (Mirai)", "value": "d15c7f34a8c79ae75528cc6723c44895f74040f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714871, "uuid": "b495334c-62cc-49d9-951c-c58ea8a65e57", "comment": "Malware payload (Mirai)", "value": "7545765d0d8ffd0b0db1e3fcdd11c9b258c7982abcc3969a6998fe8c7f2e87b7dba200029b5e628900c408e19a1a056f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714871, "uuid": "459637c9-99c3-4eac-a50c-59a7a31272c8", "value": "T1A5534B21A9792E17C0E5B57B12F38328B2F5274E24A8CB2D7C360F8EFF1455066572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714871, "uuid": "f11abf3d-9e36-466d-adaa-3167c9475d98", "value": "768:A0o0CJ7xbFEjr9q9epjkf2bg91XFHHmZNtz12pRKCKZduO+hpad/Fcw:A0MZpFEjhSepjK2bg91XFmZNtkQchk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714871, "uuid": "aef550ab-81bd-4605-b155-b1be552f245c", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714871, "uuid": "628c52b2-f2d6-427a-8a8d-f4da67999245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714871, "uuid": "fa62b0e8-b27e-4a41-85dd-e04e2da3eebc", "value": "2c4f5608d5afa5ce665211cb2c38370d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5a590d-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693726062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726062, "uuid": "4b342ab7-fbb3-442d-9b6f-92b5ea91e28e", "comment": "Malware payload (Gafgyt)", "value": "0736efbd1805c2edf39828c7904d21d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726062, "uuid": "7ca74838-5aa0-4fb6-b468-b222ae85e637", "comment": "Malware payload (Gafgyt)", "value": "12aa66758f57195eb8fa00fab247dac0da34f992a28f764883f9886900e8633d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726062, "uuid": "4c0a867d-05a6-48a1-9cf4-17ccb59d0ad7", "comment": "Malware payload (Gafgyt)", "value": "4ff53e9ad1c8e5f77f96fdfff41f2e5c976e49db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726062, "uuid": "408e6119-9bf4-4abc-8b34-09b4809e29c9", "comment": "Malware payload (Gafgyt)", "value": "3c3a4c42c3cb3d939ee4ab3ffe14194d831850c930599cc6db02c3370ea1f41c3194d2d834b8fa1648875e13b2e992b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726062, "uuid": "1fbd6b73-9292-488f-a3b8-5ad950c2b6b2", "value": "T153934923E9124F06C007A4F161F5DF341F62B8E69A975BD6A062DEE49683DCAB105FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726062, "uuid": "b72d5feb-bb20-4675-9674-d92e924d9f67", "value": "1536:ZiYg2sEgF2GK7RoDGK2i6J6QXgDxUeC65hYpTW:LJsEgF257XLi6J6QBe/5hYpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726062, "uuid": "a62547ea-7b26-4785-a3c6-ceba2a9df814", "value": 91144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726062, "uuid": "98c03ed3-6d35-4ad0-8496-4589fbbf58ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726062, "uuid": "b91a9ceb-cab2-45ba-bf13-d2da70f83d5d", "value": "0736efbd1805c2edf39828c7904d21d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7da89df-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693726266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726266, "uuid": "b9a59f18-9d84-458b-bc85-dcdbc0e62fc1", "comment": "Malware payload (RedLineStealer)", "value": "91b19b0e58e4a0b1e8e33637d91b92ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726266, "uuid": "e498100b-fc5e-43eb-8072-87ab6faf1ed9", "comment": "Malware payload (RedLineStealer)", "value": "14714772e640f22cb7df3d9527d27ddc07fa75efe0194c90f829911f339e946f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726266, "uuid": "804c8ddc-649a-415a-a0d6-50d89331501a", "comment": "Malware payload (RedLineStealer)", "value": "fd3547eec683b3df36670132c850e4dc85da8d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726266, "uuid": "c8bda6fa-f722-4aee-b71b-1ebfdbde401a", "comment": "Malware payload (RedLineStealer)", "value": "759aadcf94f0917cb6ed197435f5c3564cc446324e3f6535c20330685af1fe5bf96b5195593443d896afb3fe3ab0f5b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726266, "uuid": "9aea7ed0-f82f-4826-b61f-728f897dce07", "value": "T132C4288382E37D5AED258B729F1FC7EC770DF6618E093B6562199E2B04B51B6C1A3700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726266, "uuid": "868f581d-c6e4-48c2-ab27-7cb00cd07062", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726266, "uuid": "7ddb99f4-ab7c-4058-aa07-a75204589624", "value": "6144:/+kxmMoigqO7W3/TPxagNRnY3r+I6UHwwtOeDWyLw:/+kxm2gqOiLxy3ifKwwtOeay0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726266, "uuid": "c3cf9698-3226-4e71-9a0f-4bc135ccff00", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726266, "uuid": "a88f729e-b598-4bec-88c9-b44c96ff619f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726266, "uuid": "0240b058-2d1c-4f74-aa27-0572ef6e80c5", "value": "91b19b0e58e4a0b1e8e33637d91b92ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab14912f-4ab5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693785461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693785461, "uuid": "e3b45a5c-e486-438a-aa1a-5e154746cd29", "comment": "Malware payload", "value": "60bd790abd1881cfebf49adde174ce1c", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693785461, "uuid": "6d7b11b4-93f7-415d-a413-f714250ef02c", "comment": "Malware payload", "value": "147c78b17bf5826807e4fd6717b261f07d0c4437102418f1e03149c85651113d", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693785461, "uuid": "9084f3c4-9582-4ed8-b631-dd8f1cd9e523", "comment": "Malware payload", "value": "59e48f0e3649e216a9534c5d9b611addf7b6ab51", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693785461, "uuid": "7ffe729a-3a2f-4d7e-9d1f-7f4ef39af21a", "comment": "Malware payload", "value": "b98bf37be2d0f0fe46b86720a9fb710dadfbda4b4eb20c5ba9220088acacdb12c210b63993b6b99e7b93003d64b52625", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693785461, "uuid": "e98d44e1-4651-4128-8816-a35a80e06ef7", "value": "T1FF55AC34297ABC2847E7EE6335F04A550DE905AFE930393B198ED5638A762C111B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693785461, "uuid": "64815393-7f36-4440-8bde-44b47e4ecc41", "value": "3072:DQEAz84pZHFYYu1+SFDj7QXQZAHYgRwZkvuf8mXLF0RzMlyDRF:DQEa84pZ3u1+KjsXYgFv8x66Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693785461, "uuid": "d533bac5-413f-49f6-b8df-6956dd8a222a", "value": 1387046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693785461, "uuid": "54abd105-3598-4d42-904c-d28d5ca48613", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693785461, "uuid": "c860da46-5233-4080-aa36-330d4a73d7b5", "value": "Install Updater (fast-silent).hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765da5fa-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725672, "uuid": "155bb8b0-9e81-4cb6-b46f-60ddfc9d7ff2", "comment": "Malware payload (Smoke Loader)", "value": "946f8faf1c8383e34ce4485b643a2f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725672, "uuid": "f47d610b-bcb1-400b-bcf5-6c05651206f5", "comment": "Malware payload (Smoke Loader)", "value": "14e03b1aaa7c504927a139a2fcaba8976a7ba95a95d3aec4fb0db7f8dde4c45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725672, "uuid": "9c278240-bf85-48ee-93f4-c13c0383f078", "comment": "Malware payload (Smoke Loader)", "value": "dd9a0e256cc8e069d5b3517fb217741106da91f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725672, "uuid": "6f940d21-8b63-415c-8091-272a198a4e71", "comment": "Malware payload (Smoke Loader)", "value": "149ed3192996584792cf38f2bfe2a4ef98ed97ee62f7be9149e7987473b252ba42d6021e268e48e7ee3c545150bf0959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725672, "uuid": "574de938-748f-4131-aa0b-8fb2b0e4f9e9", "value": "T1C784C74392E27D58EA254B728F1FCAF87B0DF7608E4B7B6922189E1F04B1076D263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725672, "uuid": "65bb0f99-58f6-4a15-b40e-33acfaeaaa18", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725672, "uuid": "5d3a105e-6dd5-4a11-866e-065c8fc8a4e9", "value": "6144:ap2UiErRIZP9YD4p4xW/NIlJOaOgLUebH/d:c2UiEyZ1lpSWVILOrgLUeL/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725672, "uuid": "3d486b81-9d1d-47c7-ab85-c9ed72417f8a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725672, "uuid": "5aeccfce-3568-43e2-a2c7-907c9ef6f0f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725672, "uuid": "a2faac05-dc93-4113-8c6c-ea4bc92c35d2", "value": "946f8faf1c8383e34ce4485b643a2f39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0837144f-4a42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693735796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735796, "uuid": "cb4c2583-f36e-42a7-af0b-f1b346cf094e", "comment": "Malware payload (KnightCrypt)", "value": "bb06f1d2e0ae4d3a3201dd2ac387ea76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735796, "uuid": "a54a8e4b-6355-43c3-ada3-d0ac754744e4", "comment": "Malware payload (KnightCrypt)", "value": "167678eb9daa2376bd805069fac69c42b0ad0c6f70b9d644161970c1770c117f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735796, "uuid": "2577b2a4-fb70-4c7a-bf2e-31c994da2ae6", "comment": "Malware payload (KnightCrypt)", "value": "c13581ccbdb7030573778cc89db82591d876e168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735796, "uuid": "1814bea6-042c-4298-9833-ac77ae60afb1", "comment": "Malware payload (KnightCrypt)", "value": "9664aaba421ae4e279c6f788252452bfa53bfba41963adfaf0bee35717eb6aa6c498b08708decdf7cb2db26801e7042c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735796, "uuid": "bb146b51-ce29-4097-b2a0-ae399b07acde", "value": "T19A857C4BB6A441F8D0BBC27989528647EBB178150F30ABDF16A4539A1F33BE15E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735796, "uuid": "1e598f6b-0f1d-4307-85d1-ad6fc8ba6724", "value": "be843536fdc17a2b5e02f8f44a2ad7ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735796, "uuid": "5f4efe4f-4bde-4077-9f28-0fc9bc5ecc79", "value": "24576:jucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlcxBkTde/cfksg:jucUS55cHgJIzez8+n9Bn3NT2BkYoksg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693735796, "uuid": "a2ed31d5-8014-44a5-a95a-e14d97ef5dcf", "value": 1863880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693735796, "uuid": "968571ed-7c4f-4b6c-89db-774e109ea9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735796, "uuid": "f2bf05e3-1687-461a-82ec-3389947e5cee", "value": "12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888b1508-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724415, "uuid": "6933bd04-f324-4058-a94e-65bcbb4beba9", "comment": "Malware payload (Gafgyt)", "value": "254812eff5652201d757daa248be7035", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724415, "uuid": "ac94d654-5971-4cf9-8c59-63f6f7dd3bde", "comment": "Malware payload (Gafgyt)", "value": "175d7a1d2ef2d840a00d57f0fa4965bfdc9e15202e73bf5369f82dc532461b55", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724415, "uuid": "20f58e18-9aca-4151-b648-fc725a4d09b1", "comment": "Malware payload (Gafgyt)", "value": "8c4407a573c3f96fb5841fe7af8e797155c3eee1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724415, "uuid": "ffa56855-8f34-4c4b-9e7e-7c32b45c1580", "comment": "Malware payload (Gafgyt)", "value": "4a1133ffc9556f8b0acdee33d2a5303abc7437599d6a3242a50fe171028a587d6b33986e679326005224ac41c3090b24", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724415, "uuid": "d5611389-31d5-4c21-b8fd-0d785766bc07", "value": "T10E833ACAFA46CE73E01310F116EA6B219D31F9FB1822D582E7646DB4DD111C1AA15FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724415, "uuid": "78bafeda-f0c8-48a5-a25b-d75e9adb41f5", "value": "1536:LjVnPwtx1ssPJDX7UiYzahJrd3S+4vP3RQf2haNwtdenQu4J33xXn24TZTUg:3+D2iDX7UchJr9cWflNw+CJ3hX24TZT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724415, "uuid": "3b60c802-cffa-4371-8998-b940c07de7fe", "value": 87976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724415, "uuid": "31e1ae2d-12e3-41d0-a5d3-b15e10e88f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724415, "uuid": "95abb67d-c8ba-451a-a903-41b13412088f", "value": "68x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed2cc0a-4aa9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693780099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693780099, "uuid": "8c60e392-cee7-44b5-a4e0-761cccdf6c56", "comment": "Malware payload (Mirai)", "value": "5b804520cb59bafb54890d5ee0ed5126", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693780099, "uuid": "e22f97a4-9242-4fcc-9118-306978416699", "comment": "Malware payload (Mirai)", "value": "17c397b39fb6132bc97a6b87b5e7fe9c3807017f885b7c1f19a1d3ae8d970076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693780099, "uuid": "d4ba68e6-4ee7-4274-b8d3-e6822bb818da", "comment": "Malware payload (Mirai)", "value": "552b54f58c583e3d59239041307b0abf1153b3ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693780099, "uuid": "e16fc12a-20ae-4c08-a321-de28e10f4b95", "comment": "Malware payload (Mirai)", "value": "89639f02c8d375ea163fdd22b9e25bd6ac46b0c3406b3e9402769702f58228db8799974ec7cd01f7c1ac8d854acfbba1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693780099, "uuid": "a8982f26-a60e-4d9a-9180-7b0abe3f527d", "value": "T1D0B34873CC29AE6CC664D5B4B0B18FB92B53A960814B1FBE15A6C2749043ECDF6453F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693780099, "uuid": "02cc9277-4157-4b2d-aa0e-cf2b0c8ad0d2", "value": "1536:ejKvZA13r3jrECxVKqVCF7QAqdyiccLW+rLH7/kDWlEF:eGg3PrEE8qUKdhpLWSH7/+nF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693780099, "uuid": "817a30ee-0bf5-4431-846a-9a563404cb88", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693780099, "uuid": "90bc48c8-f054-40ac-b19b-acf02304ed93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693780099, "uuid": "ce90c38f-80cc-444f-b1ba-13beba49d1a4", "value": "5b804520cb59bafb54890d5ee0ed5126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5428407e-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714878, "uuid": "1848efec-8743-40b4-9cd3-1aa801bc5651", "comment": "Malware payload (Mirai)", "value": "ce9f3c02e1f4cddc6d7c2a99f8487ecb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714878, "uuid": "dd53d724-2d2e-4069-b2a1-309ddbf01b5a", "comment": "Malware payload (Mirai)", "value": "1893199b420a781acd58bed809b8910b8879c11ae002ee1b3208bfd7a2c0c486", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714878, "uuid": "cae7242f-01f2-4f53-896f-2ea23141bf92", "comment": "Malware payload (Mirai)", "value": "97605d7d890956935c717dabb1e875da9972592b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714878, "uuid": "61eb7d90-eea5-4ec7-b071-5ed048f9df57", "comment": "Malware payload (Mirai)", "value": "25b319efce8c3b3b4684c9c7c223de57e059332c2a89949dea810d4675c647bd95e9bab18a2f6222ff6103be70919bf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714878, "uuid": "125f211a-48ae-4718-b660-bec6cf11f0e1", "value": "T176531755BCD28A12CAD422B6FA2E518D372263E8D1DF3207DD216F1137CA82F0DBB556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714878, "uuid": "1bfd3cb1-8537-45e3-997d-974283602713", "value": "1536:mZ8HyRyQpvOmemFlOcxlgErL2yBCct5/ec7xam:mZ8HCyQvFTeyvhb/ec7xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714878, "uuid": "0d4846d2-b233-4e95-a005-c5da492ae947", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714878, "uuid": "e7388258-9930-476d-b9c2-9c6273337d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714878, "uuid": "5cc9731b-d121-42ec-9426-2042560db213", "value": "ce9f3c02e1f4cddc6d7c2a99f8487ecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d38c67-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693777421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777421, "uuid": "515e9f61-6792-4969-97ae-114523f17bb6", "comment": "Malware payload", "value": "7a4e81b9bc935f21ad7e3c7eb36d8fa5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777421, "uuid": "88f327a5-537a-4dfb-9780-89ae73f99a40", "comment": "Malware payload", "value": "1ac164be9c3b1618fe4a76fb6aaead3f64a6abf85ab23ae4a85814f1af4d49c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777421, "uuid": "6f1c3465-058f-4147-b79f-d8627e8eee07", "comment": "Malware payload", "value": "eac2ac2e19646af693484d3dc10c4aae30d70b33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777421, "uuid": "0d858f3b-d84e-416f-9fa0-37420f1ca499", "comment": "Malware payload", "value": "97e84b8df50402ef029863d27398b58a7a5efc15e4e28019be62dabffd91f0c94d3f54e512cb845250ff3f5c7133260b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777421, "uuid": "3b1c44a7-0527-4d94-b01f-f8dd3321aac7", "value": "T16EC2E896BCC2966BC6D1537AB76F474C339277A9C2CF3713DC0427103A8AA4E8D62B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777421, "uuid": "d43e2871-440a-4fd8-aad9-7b8f846829b5", "value": "384:NOGbxAuQK0FBksoFcQCG48tG5rtlG6jcldfP5cKbFo6bSY/aLrybm+ILopC6R6uA:NOOHH0L7oFWEG5rtlG/btbakILop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777421, "uuid": "35aa58ac-796e-49b6-8d1d-746adcd7c004", "value": 26480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777421, "uuid": "8bc25eb3-dcc3-4d04-a6a5-465f5597e4c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777421, "uuid": "15d330d4-5eaa-4ba0-a689-9b8c00dcdf1d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5cae75-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725706, "uuid": "337d41e5-44c4-4adf-bd5f-e028a33963a1", "comment": "Malware payload (Smoke Loader)", "value": "a45bba403a79f0d47fb9106a83931437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725706, "uuid": "14b4637d-ff70-4d72-9942-b250f3c45d96", "comment": "Malware payload (Smoke Loader)", "value": "1bba9ae0ebee70298d3d5e5bb02a844e07449c945a3a6b0e744c184f1abbe6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725706, "uuid": "dbd59b0c-8031-43d4-85f8-eac5e9753bf4", "comment": "Malware payload (Smoke Loader)", "value": "b3c1df27740bfdadf0024e59d772704ff1a2370f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725706, "uuid": "c136ef2d-7cf2-42e7-b796-2155b036b82c", "comment": "Malware payload (Smoke Loader)", "value": "ff404a43ffa8db9a476970f27f9ce9f3cb19bc14eb5f7abadda0464174c2cb161ed2b07e1206dec8a349cc28ee3dc791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725706, "uuid": "0c94ca0d-f7f7-4345-a754-449f306c1346", "value": "T17184A68392E27D58EA258B73DF1FCEE8770DF5608E097B6922189E1B04B11F6C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725706, "uuid": "a56d27bd-5d90-4c0f-805d-1752dd94f98f", "value": "e4dac514b3073faa484764761e4ff894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725706, "uuid": "4a2c23c1-31af-429a-899e-a7ce78dc2638", "value": "6144:wY7dxria0EsjoLJu/GlbsWIU3yFOjgLUebH/:f7d9iatZJjLIU3ysgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725706, "uuid": "231fdd5f-828d-4342-9216-66f91ecd9174", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725706, "uuid": "de9c966a-0b97-4ca7-8617-5e0ed64f08c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725706, "uuid": "8d75615c-c345-4ba3-aebe-192313a6d7a8", "value": "a45bba403a79f0d47fb9106a83931437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f57cf5-4a39-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693732040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693732040, "uuid": "3977545d-795e-4156-91fe-e379f0cda996", "comment": "Malware payload", "value": "8fd195e0a3fc703e36f292404b7dd196", "object_relation": "md5", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693732040, "uuid": "5a647411-8117-48d0-9d37-bbb836d1ec41", "comment": "Malware payload", "value": "1e566e0ec37ed313e90aed39cc8f8f0910a4b12177be07c92b7fee9b47f5277b", "object_relation": "sha256", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693732040, "uuid": "e0f9d7e1-e5ba-4502-bf06-f34ccc484b6d", "comment": "Malware payload", "value": "17b238c9c4a74757230f7e0e62905f6b42f3b361", "object_relation": "sha1", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693732040, "uuid": "ef7a7708-4137-4505-9fe1-8dd177750f77", "comment": "Malware payload", "value": "dcd110ac48a8b3b728b98979133d10ddf23ac8c336299562b00fda4639206b903248970abeddd7ca8485e302c3c6abad", "object_relation": "sha3-384", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693732040, "uuid": "1f1d1f15-7113-4ef1-a4a4-a1d3190b7212", "value": "T130D3028952EA6226C5F397BAD8F1950816317087EA32CF4E2D4C11EC9EDB7520BE334D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693732040, "uuid": "018f71ed-0590-4b1d-b97a-062dbb8e44b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693732040, "uuid": "65d29a0e-3fe2-4278-97b2-06c9e27ab582", "value": "3072:31xka4z1cgxCNmPfMRFvEuIEF2bqejbgYA27Z15eI46jfxL:Foi0CYPfMRFvTIEF2tbC2VCI46jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693732040, "uuid": "38089318-7920-4526-8a75-9528a6a54a47", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693732040, "uuid": "5337eddb-13bc-4263-9429-43bf2320f182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693732040, "uuid": "b1dae46b-9769-4d4f-a554-8bd31c27fbe0", "value": "berndware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b467eb-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693725995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725995, "uuid": "78c5b778-4f77-417e-8ed8-4c58fa5e3b87", "comment": "Malware payload (Mirai)", "value": "ad9bf2fef040615b84be527c2d18560a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725995, "uuid": "7cb08823-3a3f-4331-81b0-95699079a38a", "comment": "Malware payload (Mirai)", "value": "1e5e7a3c82c70d5a0a51318e611c6e7b1775313815f6ab4127b4fdad5cf63be0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725995, "uuid": "c62064d1-32e9-4a5c-8093-1704ff6655b1", "comment": "Malware payload (Mirai)", "value": "465a20aa29e24649664916cbc2d150d979cfabfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725995, "uuid": "db46f9e0-6dd8-444e-889a-4fee0ce4d250", "comment": "Malware payload (Mirai)", "value": "839ccbb8ae6a63803fd16d3af502a9ede9cc242721522febf20979c8471fdd480356da4e81c54b1525c8148412062da9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725995, "uuid": "dc6d3a85-8fff-47ef-9c87-ded1336b764a", "value": "T133E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725995, "uuid": "b97e5c5d-6bad-4117-b0a2-381a0ad748d7", "value": "3072:Cv/WwsLgaq353qHiCOvhOpSqkDQHbeskmhxQwoVSUNu:KPLaq351hOpSqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725995, "uuid": "ebbf289c-6565-4114-9e29-6906ea29acae", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725995, "uuid": "156381a9-6c01-4ee9-9aef-7828c1d0617e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725995, "uuid": "2ae2fb32-ec13-42cd-a8ed-3cefa436263d", "value": "ad9bf2fef040615b84be527c2d18560a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7e86d2-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693777435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777435, "uuid": "d3d0cb17-2fe5-4615-a290-3b731b48b95f", "comment": "Malware payload (Mirai)", "value": "71069be213cc9ef09335f1f239e5eff9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777435, "uuid": "45791fa3-361c-4b19-885b-12336aad7d29", "comment": "Malware payload (Mirai)", "value": "1f30148b38a224be4e53d3b071a7daa859828201aecb674dc3d0fa80fee5fc72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777435, "uuid": "35941110-fe7c-4fb5-9892-d955e56b17a6", "comment": "Malware payload (Mirai)", "value": "c1a3eca440243f0d2add1431b28d757e6c45f6e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777435, "uuid": "9b21d19a-8212-4ff8-9f72-de398ee40211", "comment": "Malware payload (Mirai)", "value": "f7bc35d44d4bbab33a61569b8a5116d70340a0555c26bfff66bcdc76856a81ee468bd448ae6ef483f4e058f536fff580", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777435, "uuid": "7d072953-b715-46bf-82f3-248e2f2880dd", "value": "T12804C80AAF660FBBDCAFDD3706E9070135CCA50722A53B753674D528F54A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777435, "uuid": "f5914093-ec21-491f-8607-a153ec6d9939", "value": "3072:jy3lvlyOz7HQdFD8bPg/lzb6vsOd+ttJ:jy3nyOzAFDG+xeEKwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777435, "uuid": "195d6bda-0026-4345-840d-fecb873849be", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777435, "uuid": "230f8ae0-6ce6-44eb-ba03-8b437da2168f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777435, "uuid": "a339f83b-59a9-4c43-b87f-23e2882526d8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d89c03-4a30-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1693728415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728415, "uuid": "8880d25d-71c2-4af0-8b1f-7c1099b11914", "comment": "Malware payload (Cobalt Strike)", "value": "ef45ff5ed50ca692cd8f24b76374e746", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728415, "uuid": "cb6856a4-0b7a-4e2d-9741-cd418234e5c3", "comment": "Malware payload (Cobalt Strike)", "value": "1fb54bb9a1eb4301ba6a4308cb7a6a39fb92408d69a6cbe4edbad0b574e0c9a1", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728415, "uuid": "1adf3ec6-69dd-435c-b34e-f0f12ee169c2", "comment": "Malware payload (Cobalt Strike)", "value": "31b0ccd13a54f1c0bae80e84fa8102922d8b687b", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728415, "uuid": "9af51b99-c24f-40e9-9e96-ededc81d0200", "comment": "Malware payload (Cobalt Strike)", "value": "9df07d08ed2068ff9a4aa14b3b614528c2ebb2f91753c6ad858af1cfc082d3a5912fe99c8e69db67be94fec9129ec250", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728415, "uuid": "a82b6d0c-92ea-4400-a70f-93dfc7352356", "value": "T100A63368E2105CF9DC76A63DC5A70020D532FA2A5790D30B43F827794FA7BD80ABE756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728415, "uuid": "f254a66f-269f-48f2-b22a-3e9a23599834", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728415, "uuid": "55d2b515-a9df-441a-b6bb-889c0a106df4", "value": "196608:9LRpbwPyr7PnILLZWdoCOiV9onJ5hrZERw+ENFJzFcgu8piWtARuR:lRhwqr7M5liV9c5hlERwRFJzFcgu8pPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693728415, "uuid": "24f99d64-7955-43b3-9f28-7e96e9c25923", "value": 10337854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693728415, "uuid": "ea0ebbb1-d5ee-4236-93d7-87551eb25532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728415, "uuid": "c17a97be-5cea-487f-99fa-d65ad4074b0c", "value": "1fb54bb9a1eb4301ba6a4308cb7a6a39fb92408d69a6cbe4edbad0b574e0c9a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cded7ee-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725683, "uuid": "93983713-bf91-43f7-8c54-8a5b4c6a8bff", "comment": "Malware payload (Vidar)", "value": "0333f0a802f6d00b2bc65b636e4fefd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725683, "uuid": "4e42d22c-4f72-4fed-80d5-ea5ffb1ff03d", "comment": "Malware payload (Vidar)", "value": "201857a59c6dadb4803a329dac1ba8a5d46cfff6eddb9c80edb670cdfd8481a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725683, "uuid": "d9457570-d11b-4605-b08a-3cb1aa552db2", "comment": "Malware payload (Vidar)", "value": "6232a249ee2d60d58293c577d46ae4dce1583b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725683, "uuid": "969b01f2-4c9c-4254-8223-c5745b5ef67a", "comment": "Malware payload (Vidar)", "value": "c82c2cce09c6ae34114197320817d7bc09153a0eecd6af901c552564e1737ed276054c7e7214770518a021b3db0eae73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725683, "uuid": "2f532876-6ad3-4d3c-ab80-0be1866794f1", "value": "T1F415AE43D2E17D99EB258B729F1FCAF8770DF1608E097B6922189EAF04B1076C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725683, "uuid": "627a32e5-e743-495f-8ab9-75732eec1aa9", "value": "e4dac514b3073faa484764761e4ff894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725683, "uuid": "a765b3ca-47ba-45d7-8b1d-adae99fe6585", "value": "12288:+/HKtdg4DDFqbIKbPavgQZuk+3Cy4E5xQW365XotuVQZjCJpgLUeL/:+/qtdg4D+zDeZUiWAaOPgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725683, "uuid": "f84ef6c7-7290-4cf1-86b0-541c7169a285", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725683, "uuid": "ec57aa8e-58bf-463c-b1e6-cd23a62107d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725683, "uuid": "8f91653b-7df1-477d-bc78-9be3bef2fb01", "value": "0333f0a802f6d00b2bc65b636e4fefd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b34db4-4a33-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693729668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729668, "uuid": "60ff964a-0c1d-4791-ade5-31b642bd8e65", "comment": "Malware payload", "value": "db87674a18fe8a0aa88e56da7d7d5a1f", "object_relation": "md5", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729668, "uuid": "005d236f-2c9b-4e90-b35a-9fcb13f5b9a0", "comment": "Malware payload", "value": "2060fb6fe904c2ae29874dbbbd031db657678f10b735778e882bb44a85411368", "object_relation": "sha256", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729668, "uuid": "1ec4a783-0fb3-4103-8625-201a50528ba4", "comment": "Malware payload", "value": "904c025ea018c5b98cb96a374cca7354b834e1be", "object_relation": "sha1", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729668, "uuid": "d15fb28e-e805-4776-9318-164670bfbc3c", "comment": "Malware payload", "value": "64a15dbe541939a077366c2b2bfc51252bf301abaa29f822d432845347250151a8da9a888fff8b20f92f8a74e867cdfe", "object_relation": "sha3-384", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729668, "uuid": "69a8fbd7-70ac-44ab-817c-d4de544b05fa", "value": "T1BC53E371F3C7E388974B59AE96FD3C3B874168C400C49057983B8CD5A5A6F368987ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729668, "uuid": "c2805089-a63f-43d6-8fd7-4dd472ea2cce", "value": "768:EmPJfVsEuFTvFxctbf1ppppppppppppppppob+bB44O:tdsTFTsF9pppppppppppppppg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693729668, "uuid": "450fec51-1850-408a-b39b-56c341ccbeec", "value": 65843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693729668, "uuid": "607358e9-a97f-4c66-a5f7-ca0b7f31a04b", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729668, "uuid": "7ea1ce7d-aa21-4f0b-8bef-5de00408b32c", "value": "lnvoice_1882936796.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82da33b1-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693725693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725693, "uuid": "5aaf7aa6-c9c5-4b23-8ec1-d9c1f760718d", "comment": "Malware payload (RedLineStealer)", "value": "77a5b6f8f9582d56355e0245577f3d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725693, "uuid": "feb03c94-3e53-4307-aa00-48922522aedf", "comment": "Malware payload (RedLineStealer)", "value": "21dab36255ac4b3eedab2d41f0792637e764010b8697d057fc8e15133e9ec057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725693, "uuid": "8bec4c6e-b047-4294-b420-138755018545", "comment": "Malware payload (RedLineStealer)", "value": "79ceb2766a54bd53d2cef20c80ac446bab0c8c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725693, "uuid": "9559186d-7c26-47d1-a432-c9b8ce7bd317", "comment": "Malware payload (RedLineStealer)", "value": "cf6ac8a9b521797cda4110f757b4636112458b3edf77865d39214071b7ee1ed95e88b76b6faedb5449b5f265da701566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725693, "uuid": "2c43a68d-e701-46e9-80df-f581e1f94097", "value": "T193C43A4382E17D59EB258B72CF1FCAE8770DF6608E497BA52218DF2B04B1276C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725693, "uuid": "b7eacb16-24e5-4244-b812-d28c5c7de0c1", "value": "e4dac514b3073faa484764761e4ff894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725693, "uuid": "4dcf2906-fa16-4da3-9535-19617419de2a", "value": "12288:3XYx5OTWypHUodHN12eU63OCsGfKgLUeL/:3Xm5OKypN1OCLsLgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725693, "uuid": "ff264302-9c40-4e44-91d1-06c875eb0196", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725693, "uuid": "cc3f945a-3edf-4277-b6bb-8ba7a8ca2062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725693, "uuid": "784d3e8b-71c8-48c0-9703-bf5345ad4b0b", "value": "77a5b6f8f9582d56355e0245577f3d6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0805985-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720294, "uuid": "e9b4b0ac-04b1-4a03-ac62-17bd48fc56f9", "comment": "Malware payload (Mirai)", "value": "3101d1b27f49e27629b968c63c33e3f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720294, "uuid": "21fc84eb-0b40-4b6e-bb4a-332d49b04929", "comment": "Malware payload (Mirai)", "value": "23133ec3108d915009c8ef50875d6eb7ed3cbbc840955c209d5bfdb86232d916", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720294, "uuid": "1613d57f-6098-48ef-8927-9bab90359bb6", "comment": "Malware payload (Mirai)", "value": "4b5b2574134360138bd874c6e335b4b89dffa806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720294, "uuid": "20313a67-1add-495f-b29d-b8354bd90932", "comment": "Malware payload (Mirai)", "value": "811377d77aa09501a7620e538fa5fda5d2a966f51273f2d280b27bca84a4a17b369ae63c03b6beaefb90384f3fa52b65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720294, "uuid": "1b851948-fc6d-4892-a4e3-ea9f8565b140", "value": "T18CC2D022F1111EDACAA7FC76EAA2F7A577B0C60DB1A3D93121193E4028571263A4ACD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720294, "uuid": "8e7315fe-794f-4718-970e-9ed23a3bde18", "value": "768:meaVJy2XMVSLSemoWuC9XctINh2dZw+4uVcqgw09Y:5aVJy28+hWvpctf2+4u+qgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720294, "uuid": "74b511ec-44b8-40ce-858a-a07c65629c3e", "value": 26008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720294, "uuid": "7a3eb3a8-9e33-427b-9b1d-1205664274dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720294, "uuid": "fdc154a9-58d5-4e9e-a548-2bbedb427a1c", "value": "3101d1b27f49e27629b968c63c33e3f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181eef0f-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693750855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750855, "uuid": "c319367a-a7fb-4f80-aab6-1a8397839017", "comment": "Malware payload", "value": "35bcfb54b5cde5af55c2bf654c90a969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750855, "uuid": "917e8347-231a-40ed-9a70-7996d3bca300", "comment": "Malware payload", "value": "2388ad64d6cd8a3a71271507da72e54c0474ea3013cb300f0c1aa75f64c76de6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750855, "uuid": "a4ca8f3c-32a9-4aec-b798-c87e376cb03c", "comment": "Malware payload", "value": "b3f207e1b15349867c26e10124ef316f720305bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750855, "uuid": "a4157841-1bb5-4063-ad94-6658a0ba17c0", "comment": "Malware payload", "value": "64d6346bd38fe81f3d025b92df1df593c1b65d08841a2ccc11a4c166ae1ad5c98fb46e8f2f292c516e1744beafbc3d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750855, "uuid": "551e640c-2de3-410b-84ca-d5bc8ab13f72", "value": "T1BED4E08321D2BD79D9150B324E2EC2EF772EB8A58C16EB9627545E3B2430172DF9B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750855, "uuid": "970fe3ec-f90e-4907-b3be-c8b872853d81", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750855, "uuid": "9407dd05-437b-4f53-a4ea-e282ebece535", "value": "12288:qoH8SIWIOqNA2tWXZUH2d/yiUP0XujcEyUzAAyBtddryD:qk8YqNbtbH2djY4P5tldryD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750855, "uuid": "04a0741a-f187-4a91-82f0-ccd4dd661e88", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750855, "uuid": "90f7b23f-28b3-4176-a172-cb7f3203a3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750855, "uuid": "57ec6adf-2a98-4bb3-b17b-f91b01a7f280", "value": "35bcfb54b5cde5af55c2bf654c90a969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b927b2ba-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770882, "uuid": "d538602f-b6ce-49ee-a8b2-a2181c3d9f4a", "comment": "Malware payload (Mirai)", "value": "dff4c866514305960473657bc4557bab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770882, "uuid": "6e3800e1-5162-4f72-91e4-283295194560", "comment": "Malware payload (Mirai)", "value": "25cb731180d898a622a697f83bbd7af6fc1ba3d26345b36092dd6120d7a20fdc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770882, "uuid": "8b009a5e-e07e-49a7-a92e-a8c8e27333c2", "comment": "Malware payload (Mirai)", "value": "015f3fad493a41fef81ceda57091817629db00e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770882, "uuid": "9b57edfc-e88a-4f8a-b39c-6d29852f250e", "comment": "Malware payload (Mirai)", "value": "165de82c18a3545de18f4381597c50b42cd95b4a07a20815c96d0e8c3c7883211b4015414fd5a824f1eb3cbfe554a8af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770882, "uuid": "a56dacac-2e93-4ab1-a75e-1715b616a631", "value": "T112042A46EA404B13C0D627B5FADF42453333AB9497EB73069528AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770882, "uuid": "8fd182ca-7a27-4306-9172-4cb18a16d7af", "value": "3072:pCR/h6elz/h8kgaj4lyCMkHET23iUBV6s/hJjogM/RhbIEv:pCRNlzJjgaj4lybkwuBss/XMgM/RhbIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770882, "uuid": "21df10ff-a4c8-479d-9d40-d74e81336f8b", "value": 179781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770882, "uuid": "4ef26242-47a0-4592-b53e-3b56ba2bf093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770882, "uuid": "ecbf2b0f-cce8-418a-a297-e4cb18d9a344", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714856ec-4a37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693731247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731247, "uuid": "b3f931ef-5ed4-49bf-b189-1abfec4c7a0c", "comment": "Malware payload (Smoke Loader)", "value": "e71afd86621580b40f2e56cf942287c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731247, "uuid": "6494ab89-7d16-414f-bd09-70ef6f20faa3", "comment": "Malware payload (Smoke Loader)", "value": "27628d10eb8210286d7a693bf717d054ded123a64e9983f74d9dd0cd0ff8b8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731247, "uuid": "7861efc7-53da-4658-b839-1848c7efa47f", "comment": "Malware payload (Smoke Loader)", "value": "1ca3c746e8e982582934bb44316b88f3bfdbed19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731247, "uuid": "fcb2a968-a8b9-44b9-9691-fc81b8d95322", "comment": "Malware payload (Smoke Loader)", "value": "791e8644980584392e68e2d3e988f19be780d1acca965c1c9eb5fe84ab47b57ba178c2aefec296e91ef4006ea145b0e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731247, "uuid": "4731a160-b527-45ac-b8db-ae47cbb96289", "value": "T1D9546983A1D0FC79E52647398E1EC2EC372EB8618E196B5723546E6F19731B3D68B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731247, "uuid": "9254365b-0ac7-4a1e-bf06-050bbf8bdfb2", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731247, "uuid": "7c9499fd-adef-4103-b311-b7d30ea3b1bd", "value": "3072:HaSCGzZyrK82sLg3SxKITs3F562wwMvLbuttwZcRE+dSC0FWF31y3TI7:6SCLKbj5Zj6JwMvLytqcRdALs31y3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693731247, "uuid": "1a9f6401-79cc-4cf5-9be6-8356eecc3157", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693731247, "uuid": "ef00ac48-612f-4d35-ab8e-36bb5d2ba4a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731247, "uuid": "e5b6603b-7d0f-491c-8b27-bbc27c71ee25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef034f5f-4a0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693714278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714278, "uuid": "3b40f814-5220-4b74-8a3c-8fc2cb4e0edb", "comment": "Malware payload (Fabookie)", "value": "103b3199c5a7b92b74ce14f14a3965d4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714278, "uuid": "69cca6b0-57d9-449b-b68b-d1bc2b92b0e9", "comment": "Malware payload (Fabookie)", "value": "2777cb1ff9e857722dbf3987bd5c8263486ecf02c9a409bc772b071e0ba01ba9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714278, "uuid": "16bfe29d-5f06-49b6-854e-56321556c880", "comment": "Malware payload (Fabookie)", "value": "f55dbcd83ca847e14681b580c9b5cae5b0e9ec08", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714278, "uuid": "56392ce2-2ea4-45a0-a72c-7f2c040a430f", "comment": "Malware payload (Fabookie)", "value": "3d2b0134e6533a05c061788c9f0cbeb8bfdff3f35a2fcb348cfd082d35984bd6dfb30e16b23cb96e3daa9a3bfa1f0ccb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714278, "uuid": "e7ee9419-6f3c-43d1-b9fb-250911580fc2", "value": "T1FEF42B56FBBD4272E051C135C9A6E7B5E6B27C865D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714278, "uuid": "cba67293-81fd-4cb9-8a31-d6956cca4b71", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714278, "uuid": "677a6dde-77a6-4548-9fe3-9070ebfb46ba", "value": "6144:XA01NdMuvxQWQSzoYaE5kiLNdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2mWf7xLUnwa:Xdz5QWJzNLNIShtdGxTC2i5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714278, "uuid": "a2a10a3e-7f30-4f11-8ea5-161eb46c3a98", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714278, "uuid": "556f74cb-f2b1-4a8d-8cbd-e915c70cac86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714278, "uuid": "0fb0936c-9200-4cff-9cc0-b9cab8f03072", "value": "103b3199c5a7b92b74ce14f14a3965d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30888e0-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770871, "uuid": "9caf520d-7d94-40fb-a071-8bed1b492631", "comment": "Malware payload (Mirai)", "value": "abbdbf4018a7fea48714457e45dcd898", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770871, "uuid": "0bea4ffd-3af1-4919-aab1-9cc8b767b3ba", "comment": "Malware payload (Mirai)", "value": "283a25c0693e0560f9afa0f40ac1d549206bf4062c7b4af150abf3505e3ef808", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770871, "uuid": "464d399f-7933-45a1-b4a7-0b4442d5b19b", "comment": "Malware payload (Mirai)", "value": "12b2983c0bc0a4997ce1ce6ed1e3a333ff4f1101", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770871, "uuid": "459b3c2b-42f1-4233-a307-55f3bd34ea1a", "comment": "Malware payload (Mirai)", "value": "345a0b38f35284467e14a2d256f29db9f0e34736124c3583c9b73a4ea2d12f8ccfbf215c3c52405d4f0f02c6351fc19d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770871, "uuid": "518a5e64-87c0-477c-8d19-e3b0d2aff2f4", "value": "T1BB937DC5F283D4F5E88704B1217AEB335B33F0B51019FA53D7699A32ECA1911EA16B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770871, "uuid": "c112d86d-c377-43e4-a5cf-6010cae3e882", "value": "1536:B52b8q0AMNQhsp71Dfn3DFG5csMbekqVGpIznkJSstkxmPBfp:B52oVbNU8D/3xG+mkJpWkA5mPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770871, "uuid": "b4c63791-ec5b-4597-aa43-0aaa6523ddd5", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770871, "uuid": "0c5ecc3e-cfc8-44ea-9077-dd83ffe60d97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770871, "uuid": "ad357ba7-27ad-4697-a205-b81bf99aec86", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e130ac-4a91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1693769720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769720, "uuid": "42d40fd9-4b65-47e1-ba2a-c6220e897f3b", "comment": "Malware payload (Meterpreter)", "value": "0a330cf785006d124950b32c55857e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769720, "uuid": "77af6c13-286b-45b9-8c79-321e75930afa", "comment": "Malware payload (Meterpreter)", "value": "28a578ec6db205095df41587969bf7eb6bfbfab18d8929f806ab917b93050d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769720, "uuid": "8e069360-5b07-4c69-a45a-936d6c607cd6", "comment": "Malware payload (Meterpreter)", "value": "604f43ac0356eed931d9b41f5dcad6b1d711504e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693769720, "uuid": "4807d1ac-3d55-47f6-a7bc-04fff07e50aa", "comment": "Malware payload (Meterpreter)", "value": "e07aefb874bc2f23fcbeb78cd55cac2abca4cfc11cf6c06c7196cb3f41e83b8afeea602d4c07ac6ed852fc165105d1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769720, "uuid": "13e04daf-8f11-4beb-a461-6b18ced3b956", "value": "T15EB32BC576D04CF6E92427BC84EAD331663DBEE19A27470766307A361E13BD12DDE20A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769720, "uuid": "9e5a4c3b-41bd-49dc-bfdf-8fb2f3dbca64", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769720, "uuid": "21d8f6dc-b495-4768-b009-7a45df1cea11", "value": "1536:JxqjQ+P04wsmJCpCk841gueY+75+WO/P5LDNnfzc:sr85CpQIWOZ/NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693769720, "uuid": "9374cd04-9d64-4ccb-a42b-878fa89c326e", "value": 113901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693769720, "uuid": "57424768-510c-4c29-aee9-108ce19323b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693769720, "uuid": "573ac57b-3af2-43b2-9b98-b06e172fbecc", "value": "0a330cf785006d124950b32c55857e25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f4feb8-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726371, "uuid": "11c73ba1-444c-49aa-82ad-403af02f6dbe", "comment": "Malware payload", "value": "3b6b2812da4cc4c6d4633b5bd8b714ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726371, "uuid": "6a9e1bdd-dcf1-4473-a5fd-7a7eb80c3d9f", "comment": "Malware payload", "value": "29059744ede3561f605d4c19f5728c230a6874e107b044a0ae8e8d3da05f5462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726371, "uuid": "7f5a48f7-12a7-476c-89b9-5ff299f27980", "comment": "Malware payload", "value": "4a1406d61b1709f857cde710a74481f31441b588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726371, "uuid": "2d0a1833-1d13-4283-86b6-97a8ccb59a1b", "comment": "Malware payload", "value": "2a7ecf813a0212240040a7eefa6a582a07f6cf3e71780fe1b7262f09583dc21bb36361d4fa80a4d9a2d963581a9df1a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726371, "uuid": "6c59c01b-90f2-4167-ab44-b17958a2823a", "value": "T1E7363349D80E9045E50453BAC033BBBBE128FD9D184BFAF2A5DE3C887367AA0E54C559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726371, "uuid": "4cc672f0-2c55-43d0-b192-7b18f65f35ae", "value": "63d926bab4649641f492888f61234125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726371, "uuid": "d5b4a5a9-21f2-4ad4-b6ba-05329a8c1b2c", "value": "98304:AFehg/MMbKe+xZ0t6TiamCe2VhmmtPTf1rxDxwq7kuFNoCEiX+ji69K:OCgJX+8PC7VEm1DzhAuFNoCXOicK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726371, "uuid": "83441ca8-3045-453d-99d5-ea7d47a113d1", "value": 5127706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726371, "uuid": "a46e3893-4a6c-48cc-9c6f-179981340d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726371, "uuid": "af4e647d-87f3-4e06-b1e3-3385e28597ac", "value": "3b6b2812da4cc4c6d4633b5bd8b714ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ee3333-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725863, "uuid": "dccfe205-6439-415f-b641-069e05997410", "comment": "Malware payload (Smoke Loader)", "value": "7b8fd6c99cc4cb326d0c42507f920cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725863, "uuid": "c5c6f44d-143d-4c97-bb99-feb644693147", "comment": "Malware payload (Smoke Loader)", "value": "2bdec2a1c4045f8dc665ea66f7c3faefdb1ea7b617b8851ac50852b0e0f502b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725863, "uuid": "3161c637-b08e-4686-b38a-18077d81a89a", "comment": "Malware payload (Smoke Loader)", "value": "a9a933f84eca8d8e55e31386ccdc08ba7fcdcb2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725863, "uuid": "ad2a04fa-e829-48e0-b41b-a72a5137ae11", "comment": "Malware payload (Smoke Loader)", "value": "3d28baec458c60231c2d76dfc9de8c0906dcb54bd4bf46f2361fc9068539246a6b2c33285afc835485ffb81bc5e64869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725863, "uuid": "5fe2106f-16ec-4961-9fdd-d47f80c7913a", "value": "T1D984E743D2E33D59EA254B728F1FCAF8760DF5618E497BAD22189E2F04B1172C263725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725863, "uuid": "df8c9cf2-40e9-4d8b-a1bf-614ea33d1ac1", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725863, "uuid": "32b42635-b8e1-4c2c-86c0-b58b1ec212f7", "value": "3072:mTSWAY4AtOe31vrb90TuK9QleC/Jjsn0f/c1lYAc5ezUfd47CXKQgECmhBg8avK6:kQy93PzmQ/LHc1CAz6m7/30IC2/Obw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725863, "uuid": "fcde513c-d7d9-4a17-9e95-436217bc72d6", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725863, "uuid": "cbbd7861-3254-4fcc-86e4-dad3e54de108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725863, "uuid": "bb620d56-62c3-4412-bf4e-63056d93fba5", "value": "7b8fd6c99cc4cb326d0c42507f920cbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0053010-4a16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693717179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717179, "uuid": "b9a7e4e8-761e-4e7d-b6bc-998355974634", "comment": "Malware payload (Smoke Loader)", "value": "4dc922beacbbd78690a084e451fe420e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717179, "uuid": "0498684e-6a76-49f0-864c-fa1afb6f7bd5", "comment": "Malware payload (Smoke Loader)", "value": "2d90e4d6aabf27b3e3babbb6846ed261f650f885858be57a2def6a5e361071b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717179, "uuid": "04448b0d-fd55-4ea6-9a1f-f944d11068ca", "comment": "Malware payload (Smoke Loader)", "value": "60dad60b5c7302b4e3710178adc3e3733a969feb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717179, "uuid": "6a31c4a8-3bf5-4d98-8372-39083276458d", "comment": "Malware payload (Smoke Loader)", "value": "2120d48eba16403770f260ed4de519b69dc8adf79093e9fd87ffc8f5da55dc52b1229a602eb1d70dae70f0ccb379016a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717179, "uuid": "3f33e2f5-dbfc-4d8b-bb56-8cdbf2aa1fcc", "value": "T11B548B8361DDBC7AE52707718F1EC6EC371EB8608E296B962F445E1B1A31D72C69B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717179, "uuid": "f01d9050-0327-486e-a627-75dd73cdbc16", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717179, "uuid": "68b10701-4bca-43e2-9f97-62dd0c75473e", "value": "3072:/aD8DiZ7URsbW4FC0iK/qEB21CgE8bNUT51RMPU5Lt0Fyeymx:yP7w3Xk0CgEcNU5fMc54yey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693717179, "uuid": "9a9a3ae0-5641-4b6c-9a0a-67bb6ea7c399", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693717179, "uuid": "bd56fdd5-a39e-4f0c-b975-c7acb02310ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717179, "uuid": "3f82e7ff-9f9d-4b70-a13b-ca22c9177a42", "value": "4dc922beacbbd78690a084e451fe420e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7faaf18-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725783, "uuid": "b4f241a3-3965-4167-98e2-8a9f38c355a1", "comment": "Malware payload (Vidar)", "value": "c9c1a28d3b04fe4aa1db772c397096d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725783, "uuid": "aa9732ad-ed07-4f54-9828-0b6b10b10f71", "comment": "Malware payload (Vidar)", "value": "2daacce8c6db148ea731735dd39f6f3ee71c0e336b7b7e53a44414e864a1f12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725783, "uuid": "d2dcc740-8474-431b-b685-6a283fd796ca", "comment": "Malware payload (Vidar)", "value": "8f5c52aad344575640a9550a0b82565e0c12a910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725783, "uuid": "3a7bf32b-a21b-4734-9fe3-b351853ca06c", "comment": "Malware payload (Vidar)", "value": "cc7130eeeba7c7f5d1657b65f1d61a1e29cd083a87aad7fbf32d3340d1dd9de38b1dac2143d9750c8d76fb0680fb0e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725783, "uuid": "fe43b5b0-4feb-4fcc-a41b-b1319cacd58f", "value": "T130A4F843D2E13D58EA258B728F1FCAF8770DF6608E497BA92218BE1F04B1176D263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725783, "uuid": "4c69d535-7550-41d5-8f6a-88c87196799a", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725783, "uuid": "dc332a0c-8a3d-45ec-9db6-180012ef103a", "value": "6144:+xaTr5m4Nf6HuQXtx5ckp1I1pFITZiV6DgLUebH/BX/:+xaTr5xf6hcPpC5gLUeL/N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725783, "uuid": "7006bc3a-cb5e-4acf-9352-b9ad0b150b32", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725783, "uuid": "4e89573a-4f64-4aea-87ad-8037c3e8b60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725783, "uuid": "cf98cd39-1789-4efe-aaab-06e2e434dd76", "value": "c9c1a28d3b04fe4aa1db772c397096d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60583101-4a35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693730360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730360, "uuid": "5adb1a28-ff96-4bcf-8220-c2486e4255bb", "comment": "Malware payload (Mirai)", "value": "fe27a3d92dee820563d35b5641490e08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730360, "uuid": "ee81b655-b02b-4261-8e36-ccc65ef33f3b", "comment": "Malware payload (Mirai)", "value": "2e42009be217edd637e6b73c001db5b442a2c8a34b1921d67100861c3e873574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730360, "uuid": "4888b4fd-8cb3-4f6b-b33e-39ce8fa3ab74", "comment": "Malware payload (Mirai)", "value": "379013b5893a01045c74a8cbba8914cc09d9be56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730360, "uuid": "fa12589d-1793-4425-a8d1-461cad82c2f8", "comment": "Malware payload (Mirai)", "value": "b0affad76623b7f74be077429f6f34c96ab452e0954a55a1524e56ecac24c45c341eab9cf78d2dc4d6a195dfa79e3320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730360, "uuid": "6609fa31-ba03-4193-99bc-5f78f0f09d53", "value": "T1A4D2E0650B1988BACE6AC0BE07A90B626E6A0F6BD213D4473F41C4C6FDD149A3C937C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730360, "uuid": "d8a95b25-bdda-42f6-a57f-8a830f881563", "value": "768:hJq0lAtrvbaGN4M0V4OItuEuDeKzMux4aIsNLJgGlzDpbuR1JJ:ho0WbXN4MF/uDeK34CjVJuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693730360, "uuid": "def77c86-20c4-46e9-bb85-eea182b987c0", "value": 28444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693730360, "uuid": "42138962-0c02-4779-8a55-39870c2a4aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730360, "uuid": "ad3b8b03-6ada-4ea4-bc48-09f75966317f", "value": "SecuriteInfo.com.Linux.Siggen.9999.26219.2223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3393b9-4a29-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725437, "uuid": "f730288a-dcae-4153-b3f6-6e9543d35def", "comment": "Malware payload", "value": "c7d37f055600958994bdf8c5661f0cdb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725437, "uuid": "96e91802-cfbe-47a0-83a8-5602e453c555", "comment": "Malware payload", "value": "2f78b3ec4ec0dbe5b189236717c91a040d62119dc06ab9bf70a3a1210ab00777", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725437, "uuid": "24e7f792-4be8-4efb-b6dd-282e0ab0900f", "comment": "Malware payload", "value": "59f132aa6630c55394cfe40ba543dcb53ffc7e17", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725437, "uuid": "f0170744-54b3-408a-a334-53a6c67357ea", "comment": "Malware payload", "value": "ae885a459daf7f65fffb04450bfe65c7e04725f1eaa8fe200362b36d5d61dabee57c1e2c7af9aa9784513e8a74142a1e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725437, "uuid": "7869c8d3-b9ef-4987-b10c-d98683cd2972", "value": "T1D6259D117AC2C832E47A05702E2AC76A456EBD204BF1C8EF63D41E2E5F316D25636F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725437, "uuid": "f89f0047-84d1-461f-bb9a-c6babba151d7", "value": "24576:GLxyyzQyz5io+HExGWUAyiqZAY+BqnGIQ5M6DLrVVdWlArzre:GLxrz5io+HGGWxyzAYwlrXVVdWlArzre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725437, "uuid": "a421ce56-acb5-4743-aecc-e389f79334df", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725437, "uuid": "d3bb2495-4aba-4878-a53a-78a1fb55d18e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725437, "uuid": "d5c4c0c0-e11f-4bbb-b57f-9260a2f0c7c9", "value": "docst7LKPNQ2HSohyzKapObp4WvZszKYodRtksv.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa07691-49fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693705735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705735, "uuid": "46ee1c3e-bbfa-488d-a0ce-56c2c4e40f53", "comment": "Malware payload (Amadey)", "value": "5c4423d666bcbdea8f5e1da46667b314", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705735, "uuid": "f0b7eefb-0a1a-4f50-8cfd-a3f701a4b64d", "comment": "Malware payload (Amadey)", "value": "305bdfdd37152690828b2538ddc04a4d5a17cf17815f40b69d8ae6c4dd154554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705735, "uuid": "9683f28e-09ab-423f-9428-f4c4c5f1ec54", "comment": "Malware payload (Amadey)", "value": "fa81ed0fb90e6502c2d0113d51e137c9f5eb3731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705735, "uuid": "5aff8a90-15d5-4092-bf54-fe0274cf29f5", "comment": "Malware payload (Amadey)", "value": "6ef920f01a41577b8fd07fd772b8de1107d3b0018ae2089753e59252112e1123f286e01257d14f7ada8192573a64acf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705735, "uuid": "2b728136-9aac-4f0d-9b2d-5a8ea3a193f7", "value": "T17E936C1030D2C071D57E55351478EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705735, "uuid": "4c5d50e7-e704-4a7a-be36-56818062d9ef", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705735, "uuid": "18a6e286-b5cb-4d0b-b42d-be42bce8689d", "value": "1536:SPuON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJU7aI89p:kuhVZbtvbpxLHoUsYuNhV25LJU7aI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693705735, "uuid": "9f843881-28df-44e2-a38e-8144b42c30a7", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693705735, "uuid": "5d260bf9-f662-42fe-a377-5c7727468cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705735, "uuid": "26478085-03d9-4f74-a2df-58b8393307d0", "value": "5c4423d666bcbdea8f5e1da46667b314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69e4bff-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748544, "uuid": "7a366836-7e5c-4ef9-a220-6d8f93d9a200", "comment": "Malware payload (Mirai)", "value": "d3642b7fcc58b9ebf76d8ae5629d4823", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748544, "uuid": "e1b6d04a-8dc0-4816-9510-6bfd48cbac4e", "comment": "Malware payload (Mirai)", "value": "333f9d46d1e3c4a6f5b345ebfbaf61d43ca84451fbe0a73cf0d0e1a075259838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748544, "uuid": "0ec6cd79-09e8-493e-8b98-eecbdfa0633d", "comment": "Malware payload (Mirai)", "value": "6978ab63a85c1b4ed7c5e35ecf29e33cf2f907cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748544, "uuid": "43db7310-63b2-4045-a709-e484c090f256", "comment": "Malware payload (Mirai)", "value": "738368a33ce9b7bb06b69b6029637434c15a8dba21c3b6d1388104daadf2490a689208474b66585022ddb63d7bb2ebcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748544, "uuid": "e3c496ef-0677-4b47-959d-0205b8682f0d", "value": "T17D539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748544, "uuid": "6b883d4e-b806-425b-94b1-c55f47f56b2d", "value": "1536:PaAtVnz1/mUUNztiYmW6hhiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwNzT0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748544, "uuid": "8f58bf73-5d0d-4fed-9c88-40d8940eebde", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748544, "uuid": "9c2a5b44-d6bf-4308-8484-af1241f1e841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748544, "uuid": "242c0696-19c9-46a5-8040-1ad2ef406101", "value": "d3642b7fcc58b9ebf76d8ae5629d4823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f83162-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1693725486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725486, "uuid": "8730f0ff-66c4-4fd3-8846-4a9e4d01889c", "comment": "Malware payload (NetSupport)", "value": "8b2053f8b03d26c76cd8270d075f2c78", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725486, "uuid": "3c9cfe50-96be-4ead-a21c-55670fc83b9b", "comment": "Malware payload (NetSupport)", "value": "343d63ff67300da163c035fd16eeaf73ca0d8b472725be1cf501addbc205c487", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725486, "uuid": "3ba958be-a27a-4614-ae96-b1585f2ca10e", "comment": "Malware payload (NetSupport)", "value": "fe22962728e6e4ebfa576814d73bdeff2e80c41e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725486, "uuid": "77f1d3c0-0976-4990-8aed-7612611c74c4", "comment": "Malware payload (NetSupport)", "value": "c35f388d22edbc4abda875c3a20d0a6811edfc4c8d27ced290c280c21dffaf874fadc178389a653fd217e5b60c600582", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725486, "uuid": "0eaac9ee-53c2-46f9-8d11-c0c7d87d41e2", "value": "T1CB610C603E90E3FD268FCB13F73BD0EDF09299AA7941B588605DED43E81A1118579933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725486, "uuid": "69d30aab-288e-4dd9-a233-139946055a49", "value": "96:1D666WrlPV69kMXVan1X9D7AB6oYlNFA8R07VyB6xqmjc:d1x9DU6XlM8R0gYqmjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725486, "uuid": "8b181962-5260-44bf-a2c1-a27ef23863b9", "value": 3445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725486, "uuid": "bdbb83d1-5007-49ce-8fa8-26051d0e1c4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725486, "uuid": "d68e1fd9-72a8-49c2-99df-3c2900adac38", "value": "package_details_____________________14631459.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bddf91-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748549, "uuid": "6053bb88-4056-4a64-a3fa-848b4e9267c5", "comment": "Malware payload (Mirai)", "value": "6a73ea49fe1a9723117523946510651f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748549, "uuid": "f2026082-d676-4ab9-9941-37869fd62686", "comment": "Malware payload (Mirai)", "value": "344b7ae5e3505daa0b342dc2f75c05202b4e195c2a9b1d5449f201afad0d243a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748549, "uuid": "a6cf6c6d-fd93-48f3-8aa8-bd04045ff94a", "comment": "Malware payload (Mirai)", "value": "6afb288af2f99636f2181551fdb16067d2641db4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748549, "uuid": "0211461b-d0ee-44b9-b229-93d9592386f8", "comment": "Malware payload (Mirai)", "value": "789b18a215f0adf1b6d921f82c9b7cd66ff897af3c7020f7a37f091939ce28d5cb22f0e74e8fecf28561cad5be59e7b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748549, "uuid": "76370697-6318-4a17-8b2a-6bbd4dcf8ce2", "value": "T161D2E18876D757FACCCDC6BEB71E002A309A74E9A6B29363B301D8534776180F651D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748549, "uuid": "20d3826f-6f54-4498-bc77-9e59f4a3f62e", "value": "768:0lxKd2FLPxEGspd6IHE4RlY9900i/6aOlU:Rd2FTEplHEw0a0kzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748549, "uuid": "67b132f6-2ae2-4702-906d-1452ad657f57", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748549, "uuid": "94f7ac11-8204-42d3-9454-421358e402ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748549, "uuid": "7741fc60-b751-4b09-8a80-117187f10303", "value": "6a73ea49fe1a9723117523946510651f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7febff50-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724400, "uuid": "86560ad8-5b6f-4b87-8177-282533d5dfaa", "comment": "Malware payload (Gafgyt)", "value": "8a5f65d329e3d10136bfb67ca278b653", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724400, "uuid": "42d10544-9439-4651-89a4-3430d8d0b333", "comment": "Malware payload (Gafgyt)", "value": "34a768b434306b917edb550041348d3771386b4e4023cf00d36cf16c44a16189", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724400, "uuid": "dc8ca351-8992-465d-9967-93989e4a370b", "comment": "Malware payload (Gafgyt)", "value": "1e76f530df1f4c3ca96b2381ccf13112cb30175b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724400, "uuid": "049af8d8-4682-46ad-9912-00aca1072dcc", "comment": "Malware payload (Gafgyt)", "value": "47b54f7646649f7c1f00821890fae180e40d24ab2cf2314f1065bad9d7e8bd55cb988a97bbc320f3325087aee562a0a5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724400, "uuid": "769692e0-0d25-47cb-82aa-d8693630eec9", "value": "T1BFE3871E7E219F6EF159877047B38F30D69876E726E18185E26CEA481E2038E245FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724400, "uuid": "38c91c5b-4b0c-4005-a6b2-f6a85d6bde0c", "value": "3072:cTPJx8CgIk93M/txByKuFMmnL+GL4Qufqx/Nu6KV5hsp8jK0:cTPJWCgIk93M/txByKuFMUAyO6Q5hvjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724400, "uuid": "b281fee6-1c50-4cc5-a01d-900cb12bf303", "value": 143972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724400, "uuid": "c1b14230-f3db-4c66-8020-a474567fe009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724400, "uuid": "be374fc0-f2c3-40d7-b007-8875f2cf2f3e", "value": "spim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5428258-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725751, "uuid": "a9c3d401-5b5a-40cc-a1c2-c219f0579120", "comment": "Malware payload (Vidar)", "value": "f59f5e589d6f768c64a3762acd243bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725751, "uuid": "9811d219-b650-4c0d-94c3-2fb17acce8cf", "comment": "Malware payload (Vidar)", "value": "34f9859955791b86dabfc99171fa6ef0e5ae587e4f434a9ef70d2c8d4785c9d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725751, "uuid": "15962a5e-aab4-4b95-9438-d4b80c6726ce", "comment": "Malware payload (Vidar)", "value": "66d9ca17178702033813127410abe4542f63ea6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725751, "uuid": "3d058136-bc56-41fe-8845-0caa98be14c3", "comment": "Malware payload (Vidar)", "value": "97a76d4a6fe07620d44e613bbb7612efc4d7a5fa6002bdd1ddd1078f1aeebdfd7ca26ad1b8f1b55dc647fe80a76a2c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725751, "uuid": "48ba697f-348c-432c-8d65-b61bc277abaa", "value": "T16D15AE0392E13D58EA264B729F1FCAFC770DF2608E497BE922199E2F04B1176C663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725751, "uuid": "607ea6d2-c502-47cc-95c6-4e4b26bd5663", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725751, "uuid": "77312d11-13e0-449a-93ff-6d63ea217626", "value": "24576:+3Rp+tzV5BioU3zdiaA3TkXc25Rj5/gLHL/Z/:+3Rp+75Biouzdia9Xc25F5/gLHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725751, "uuid": "4a17876b-90ac-4c65-b544-3bcace7a65c7", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725751, "uuid": "f30aa88c-9378-4622-970e-31e3f95e07f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725751, "uuid": "30b55062-d62e-4f52-a3ea-f812ab313b10", "value": "f59f5e589d6f768c64a3762acd243bed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486950f1-4a6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693754372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754372, "uuid": "bd7c7966-9238-4b6b-9234-1881d964cc51", "comment": "Malware payload", "value": "b8d0cbf39b298866d9836a407bfe0c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754372, "uuid": "0f32582c-a5d5-44ab-adc7-2311375d2a6e", "comment": "Malware payload", "value": "36c9d48b95770dfe0312ad6b7bf0bc9b469485979ecdc29edd466d03e35f292b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754372, "uuid": "67048f51-2286-4345-9833-b235708d717d", "comment": "Malware payload", "value": "c1a6ae66f3f672c24a2abb995f21608e3fc32182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754372, "uuid": "85a1d70e-f5f5-41e5-a2d3-9a3277e1b227", "comment": "Malware payload", "value": "2d33c508157a50ad4a9319116a260ec9b92a00f55ef568868ff5ad8eb53c4a1eb1523238a0cd9117a7fdf5eafdc88eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754372, "uuid": "8a7b56cf-1bb8-40c9-a343-6be0a2265af2", "value": "T1C2152203ABD85122DD76237048F206C70F7ABE615A7503577660BE4B4CB3AC8A23677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754372, "uuid": "eb30980a-11ab-4d00-b2da-9b5eccf14b23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754372, "uuid": "a20739e4-a8c9-461e-b7ce-3883c5ae9058", "value": "24576:7yYF7WR4iXuEqThxyAR9LFOrKMC4lPpFFA:uYF8uEmyK9Idlhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693754372, "uuid": "68bf4d4f-ce65-4be5-8bd0-78b0e291f6bf", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693754372, "uuid": "65ca07f9-3e95-420e-85fe-ae2496f61353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754372, "uuid": "94cb93bc-6ac9-446d-9256-651221117fbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ad490a-4a43-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693736268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736268, "uuid": "d1559ec6-6f6e-4407-a077-2964636e3f6d", "comment": "Malware payload (RedLineStealer)", "value": "b961fc53c493b626d515f9b987e8ef4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736268, "uuid": "0ff0812d-0f86-4aa3-b831-7e4e0c1d7cb5", "comment": "Malware payload (RedLineStealer)", "value": "37ffd915fae22f36bb784b93c5d0311b48d13bdc365ba3be7bfd3969de1cd214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736268, "uuid": "6ede4470-20b2-4f22-9bad-3a9c96f152e2", "comment": "Malware payload (RedLineStealer)", "value": "6bf802c0411f0cf672bc7d6f935ed1d1446d0c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736268, "uuid": "c167e31c-a782-4906-b0b6-7f8ce4860471", "comment": "Malware payload (RedLineStealer)", "value": "9ccae5aaa3e8bdf1564e8fc92b2ef7fafee5a67c3be458b16bf59b81d09e623f0a0c14d727a118ed22f62b6a3909d612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736268, "uuid": "3fd7888a-fba2-4372-99c8-c5324c7071c6", "value": "T14FA4BE83A1D1FC79E1140735CE0ED2E8772EB8A18D35AB9737946E5B19711B2DB8B302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736268, "uuid": "b9abc3a0-5572-4379-8523-ec5eb7c6e756", "value": "ad153f8df4d5e34f536fce54f7340368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736268, "uuid": "4620a866-1679-48f9-b746-ae384e013fcb", "value": "6144:Qp9JFkAN2L1krbnzSAkcXEq8u3ZUSEC74Hhy3T:QpVALSrbnOcXEJQubkAyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693736268, "uuid": "2aa76c85-53cd-41cd-a300-a4dde421cc0f", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693736268, "uuid": "df208bbd-f915-47b4-b67b-55d8d0a7e371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736268, "uuid": "47c1e984-98d2-459d-9c29-02faecacb911", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f728dd6d-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693777428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777428, "uuid": "13260e39-fcf5-4d3d-9937-9e8ed2547497", "comment": "Malware payload", "value": "52a9d8e3b0dd8d053ed75b8f744b95f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777428, "uuid": "7a0038f5-a6b1-47d5-9387-5091f1a67c08", "comment": "Malware payload", "value": "382bcf138c8e52a3ac0f6e77f9a3b7ac5c7d3fdc1e5d902280493a0cd88696ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777428, "uuid": "845650f7-8427-413c-b368-29a0a1ce6a2f", "comment": "Malware payload", "value": "696f4e152b950ea904c316a2bd554dfd930da563", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777428, "uuid": "6d562ff1-d383-4760-a4d1-7a8f6c4f0731", "comment": "Malware payload", "value": "1dde721539e8458aa09b114b6d56baa23203d5f789499f68e16b15fe5c2502c20570fe5ff7b27e0d4299f357bfdaf4c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777428, "uuid": "dc79249f-ca1f-498f-95e2-41f897301813", "value": "T105D3F856F9819B11D5C111BAFE1E128E37231B7CE2DE72029D246F747B8A8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777428, "uuid": "40135642-fab3-4b48-9060-3ee16a09f602", "value": "3072:hOHUbUfW4ybXRwedruOa3lBCXbh+7xnCVpUaOO:hOGI+bXSeVJab+h+RApUaOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777428, "uuid": "4574abdb-2fe5-4448-946e-5ee5f071b21a", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777428, "uuid": "adf7c0b9-fd00-4580-8ab0-c6adac387ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777428, "uuid": "b3ddb9dc-921e-404e-9053-cc8588271f07", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29452779-4a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693774076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774076, "uuid": "ed0d7858-13b0-408a-aaf4-bf1299b5f689", "comment": "Malware payload (Mirai)", "value": "1983cda0a35b0502229a8dfa5d2e0b57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774076, "uuid": "483f7d4f-8a35-4ff7-a661-bb3827c2e9b5", "comment": "Malware payload (Mirai)", "value": "39e41a215519d46282b4c02a1ddf0e6720be93cbd35c9eabf98ccd92428c4168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774076, "uuid": "19c60a1a-7b6d-4498-bae3-850bd53c0d3b", "comment": "Malware payload (Mirai)", "value": "8a3a43a8a4c1f4f4fa877596511521bc456dd29c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774076, "uuid": "81f8754d-a2a9-4f0b-8b83-fd7fbb92d680", "comment": "Malware payload (Mirai)", "value": "7ee85bbfcc3087b159961562cf01d736c273b545edb3ecf2c9ea615c811b3a04050655356c079ea48a2440fbdb5752b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774076, "uuid": "2c531840-931a-4093-8744-e29635003428", "value": "T11D43F1165709397BF5B72871DAF5C282A86ECB385B7D1E272340D8188BC23C51EE97C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774076, "uuid": "dd9c4b1d-2fa6-4deb-b3e0-f569011553ff", "value": "768:85IH+xFkIYLqPv8LER6FlUElIzPcLOUW27to9q3UELU3GaqyWS4Mq8qpIU55qm:wewFpYLkvRklUEEBwtRLUtqe54/55qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693774076, "uuid": "a5d7992f-7548-41c5-8335-3d28f1433fed", "value": 55392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693774076, "uuid": "c324dd15-86e9-46db-8af8-92f2c941b154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774076, "uuid": "e23f2287-f981-481c-b7e6-b32a4dab9c67", "value": "1983cda0a35b0502229a8dfa5d2e0b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b382c0c2-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725775, "uuid": "d568b510-58f2-4999-be4f-9af9a68e4481", "comment": "Malware payload (Vidar)", "value": "dbe721c85d2b9de911337b499d769a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725775, "uuid": "a54257aa-f198-4e70-a514-b9da8cee98a6", "comment": "Malware payload (Vidar)", "value": "3bd0e34a07b6a1e6ebd2a0dc9f8cf917d1835a7d770d41a60c83507608dd6f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725775, "uuid": "b7d7b0a0-6467-4b84-81da-b9adcc134968", "comment": "Malware payload (Vidar)", "value": "0b646614d2024950b94328d9f14b616eaf79ac27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725775, "uuid": "1b1fae26-88bf-4715-a4b9-3d539e38dfd1", "comment": "Malware payload (Vidar)", "value": "bb70151a33377877ed6b859374fd6d24062ed8d8d14340d83c5e2a3aa99f4dfa4e7b00bd86b29a83b0a30068a62cf747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725775, "uuid": "0a4acb7a-9d29-4716-9e5c-4ac4d39663c5", "value": "T15815AE03D2E37C58EE258B729F1FCAF8770DF2609E497BA522189E2B00B1176D663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725775, "uuid": "595f94b4-7872-4e95-89b3-f8e96e7f46fd", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725775, "uuid": "a6e5cd15-ae0b-4062-9378-20719d7832e7", "value": "24576:LxrwownY6WDk1SLM8Dr/zRxQyx0FpGzA/gLHL/N/:LxrwowY+qFxVkgLHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725775, "uuid": "60ee9885-cf0d-4bb8-aa2c-d9c51af9c84d", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725775, "uuid": "d9b94384-2fcc-4dde-8b4b-3a920a01d973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725775, "uuid": "5e6bd384-80b7-434d-8ba9-3c2c5bf944aa", "value": "dbe721c85d2b9de911337b499d769a8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c28146-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693750829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750829, "uuid": "b98b1c73-0838-4a5f-908b-0c4b4fb84d5d", "comment": "Malware payload", "value": "9a05b677f9800b545e8c6642c1a04bcc", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750829, "uuid": "39320a3d-c6ea-4b83-8c4d-a4819d468fe3", "comment": "Malware payload", "value": "3c5c7716aab70eb573bbdf8790cc989a04139ad89b6094fec2d3e61edb027e83", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750829, "uuid": "b555bcd8-c43b-4ed6-9c77-f2c986f17bd2", "comment": "Malware payload", "value": "b89b3f98544f47a20e0279f8708f1b0413392ca4", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750829, "uuid": "3200cc78-8ec0-4243-9a03-216341fe4d24", "comment": "Malware payload", "value": "c0a740e486a3713be52c23f5bdd7b6553828125845f9958464ff6d59681fed90b243087881316cc4e1de929820a9e8bb", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750829, "uuid": "986a4c3b-5e88-47db-9a81-20d607f2d5a3", "value": "T1BE556AC75CCCBA82C71942BBEB22F5FC197BEE4D958024863031FA4A297325D1CB6579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750829, "uuid": "1b72cbb7-ce3e-4f88-8fe8-860854620077", "value": "24576:dWQmmav30xSZyHw6Ve6NC3DZyFw6VY6NCW3HbdEQagpU9C/6wCN:8QmmQ30676V7MF6VRddraDCyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750829, "uuid": "571b5c28-b9cc-416a-839a-ed4943cc7109", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750829, "uuid": "0272fff0-4675-4116-b107-2899f8294060", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750829, "uuid": "fa7b8160-b885-4e49-9896-4c02948b9443", "value": "ENQUIRY 67543.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb0517f-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726381, "uuid": "39fbe21a-9dbe-41df-a9e9-9349336548ad", "comment": "Malware payload (Vidar)", "value": "1aaa52189ea936706d63c56f0357f7bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726381, "uuid": "0dc70f3c-0408-4e01-8493-5c5ec3791028", "comment": "Malware payload (Vidar)", "value": "3cd9e155fca2eca60ed8a316efcebd2a45317ab4b957d0e8eef7470a104e845b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726381, "uuid": "699cd2b0-0259-4baf-b6e1-98d3589473b3", "comment": "Malware payload (Vidar)", "value": "b96945fe789ec4e5039eec2f6f2ed20206843b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726381, "uuid": "64a499b0-571a-4513-8f8b-37198b355994", "comment": "Malware payload (Vidar)", "value": "9272e376969570104cbc21ec7d9353949fdd3be585c075a8ba52e946a470cf84f604f5d0d1499aeb59d082d5a7a82959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726381, "uuid": "770b3ddf-3ec5-4e1a-bc4e-55ac94ecf8db", "value": "T16A74AD8362E0FC79E41547358F1EC2EC772EB8714E29AB5227D45E2F5A702B2D69B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726381, "uuid": "655e76db-7c57-4b12-a2cf-e19a08cc0ef8", "value": "515f729e8e6f1501a5196a14cf216d36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726381, "uuid": "dc53596b-b913-4ae2-9e49-c0bdc8d669d7", "value": "3072:q7FdzYZmtp5fNIwqus6kd4RDUAStYwUhTWCdcfNYgOx3Bpllhqb7E/XIOnjireyf:qrz7ZfNu6kdQoYwUtQNYJxrbqs/XQey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726381, "uuid": "4fd2bdc0-77bb-4268-8fba-77ce44ace0fd", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726381, "uuid": "ad617df2-621a-4f53-b41d-27cbf57bf149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726381, "uuid": "c768a693-3877-4b4a-859a-93f9040526ea", "value": "1aaa52189ea936706d63c56f0357f7bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877ba5e1-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724413, "uuid": "82b5e003-fddf-40eb-96b1-9d749633e804", "comment": "Malware payload (Gafgyt)", "value": "393f4ec4de34584cf0d0b0a7d1d05a9f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724413, "uuid": "e660240c-288b-402e-8ad5-08d5ee9f68b1", "comment": "Malware payload (Gafgyt)", "value": "3d2c5b520779e1418a382978ec51a5b5fc67c8e65e1bacaa605b2354ac8acb22", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724413, "uuid": "e4f6df61-9f35-4e9a-b5ba-e1d1029ead54", "comment": "Malware payload (Gafgyt)", "value": "c305b848246b8ea09b7f819039779e68bcb1829c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724413, "uuid": "6118d102-d610-4b1d-bb2e-7c14b41fc21b", "comment": "Malware payload (Gafgyt)", "value": "bdb7cf7c6964d82d67dd346942a5b56a4d3b6caced22602c752a341140b7a8f5b6f9b67375136b77ae568d9fd8c6ff15", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724413, "uuid": "cc68cc4a-d201-4bea-8eeb-afe04fe98095", "value": "T188B33A17B8528B02C5C215B6FB4E974A77136BF8D3EF720299349FA027864E70E3AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724413, "uuid": "65858499-157c-43b6-beac-3f1a3f71af0d", "value": "3072:pmIFnJ9ubB2iazbiI63oa40bJfRwra5hangpHha:AIFnubB2iazbiI63/JfCa5haEha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724413, "uuid": "7c805979-3134-4e52-8b3f-ba23e8948ee7", "value": 112376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724413, "uuid": "3634fa94-0926-4a29-8cb0-b00f8ccf5bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724413, "uuid": "a7c2b777-19b0-4773-8331-274abfb8036d", "value": "mra6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eccc921-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725687, "uuid": "61668442-b29b-4688-910c-95c1292d7a9c", "comment": "Malware payload", "value": "1246f4c0200c84b1dc7e2abec736faed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725687, "uuid": "f3bea61a-874f-4380-ad19-b820989dae23", "comment": "Malware payload", "value": "3dc6b086b9a6ad33d9999381349c3cd6509f44b4d78d0c761040dd3796bc3df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725687, "uuid": "aafe302c-5bd5-4327-8ff0-a3cf5a62e015", "comment": "Malware payload", "value": "a6f17c12eee0514c96dbfe8e806da30e2aa68c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725687, "uuid": "842cd996-915c-4621-b6ee-210a99bb1da3", "comment": "Malware payload", "value": "6d06522299a33695083ead5db86f65f983fc7b5a548db7a3b8ecd1760ea9a01008294d2796a931631f36f0ec1276d8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725687, "uuid": "088ace7e-7cac-4152-bf27-2499aff18e64", "value": "T14CE46C4383E17D5AEA258B72DF1FCAE8770DF5608E097BA92218DE3B04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725687, "uuid": "0c5f8507-e9a3-4579-a72c-75bd4bc6342d", "value": "e4dac514b3073faa484764761e4ff894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725687, "uuid": "1b1f02f7-fc0e-44be-b49d-67cf36cd7896", "value": "12288:lixfJYBdkwKMKgRKn/doH7IJTHCW9nwfYJetgLUeL/:li5JYBdkw22bGD9BetgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725687, "uuid": "00d8a840-0058-4dd2-a445-19e32b8a918d", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725687, "uuid": "8ffd3d0f-ba92-472b-94f4-5df0168e935e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725687, "uuid": "6ee8a779-5920-4a4a-8730-6cb138148305", "value": "1246f4c0200c84b1dc7e2abec736faed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a1286e-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724416, "uuid": "57461cc1-4f33-479c-94c6-f292b9124c37", "comment": "Malware payload (Gafgyt)", "value": "a61ed28b0aaf01e0c1b1cba5333a22bc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724416, "uuid": "b44a16ef-3943-4129-80dd-a2b6c0d2304f", "comment": "Malware payload (Gafgyt)", "value": "3dd31ae141a64c3cff84b50452d832378de2a5a06b5150c1682356ea341b5cb9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724416, "uuid": "e66e66ae-13f3-4c09-a819-a72cf028d160", "comment": "Malware payload (Gafgyt)", "value": "9bafee242df5b93cb28089f9b6164dafae5eb355", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724416, "uuid": "cd5cb2ee-5196-4f88-8205-3b30edd30c39", "comment": "Malware payload (Gafgyt)", "value": "e49223022ef9434adc899b52d40e6a00ab1531cbac45524efac70c9b1f132ce0dec80c2f14d16c5c128eee1c9afca81d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724416, "uuid": "6e21a5ce-7c44-4acc-8e8b-389242731301", "value": "T100A31956BD018F03C1C315F7FB9E46497A2267FDD6EB3103A935AF61334A5D60A2AE80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724416, "uuid": "165b0d66-f855-4ed4-a523-8e68031a7c74", "value": "1536:VGQppxhZkQXhlsF1jMMIf5vFFxBKH7OO3sOm+QDnV82cGr9G5hNrpTY7:VGinDUm9FKHM+yVJbM5hJpTY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724416, "uuid": "f2171e8c-1218-450e-8eff-ced0eb873fbe", "value": 103428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724416, "uuid": "2f5e8860-3ce0-4b6c-917b-a28d67fa5f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724416, "uuid": "8e12ba16-095a-400b-a251-0c1cf458c10a", "value": "mra5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcac35c-4a32-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Joker)", "timestamp": 1693729232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729232, "uuid": "9730bb76-7b25-4931-8b48-c95649689e57", "comment": "Malware payload (Joker)", "value": "42197636b8d24e40f69b41f8daa1a773", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729232, "uuid": "bd768d86-9ada-4c26-a43d-fdcf080b7af3", "comment": "Malware payload (Joker)", "value": "3dd3a843e1f714b3a6ec6dbdc4307ad52060b06a9fa8344a3826f3c3f067fad4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729232, "uuid": "73aee865-4f0e-4c87-ab80-bab4929de08b", "comment": "Malware payload (Joker)", "value": "c014b2c3333e17f01011af576e569853178d9d8a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729232, "uuid": "02a5b495-489c-4c99-b758-8d7e4647da37", "comment": "Malware payload (Joker)", "value": "3376e4902e5136e9fd109e3b3162995fc5108c0cb79dbe1cac21fb7305d3423653bfac04d824b639821db17c634a85ec", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729232, "uuid": "5d7e0338-5380-41f3-9e38-9c961d7792ab", "value": "T14B76F14BD32848AEE56A25708A7B329046960C174ED36FD67E7D791C0FBB18C1F29F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729232, "uuid": "38541772-b807-48fa-8560-8f4b5e3bed29", "value": "196608:jN4cmSpBi9EK5dPW6L7b9xe5TNW4mhYlFmuX6QUlO95:jN4gpId5dPW67DsNW4mh/uKQ5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693729232, "uuid": "6dff8b13-7c07-45f4-a709-940c280d4f07", "value": 7612062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693729232, "uuid": "0d673d54-4608-4a14-8769-636cd9db186e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729232, "uuid": "c51ca0c1-1307-42ef-9485-147b730e61a3", "value": "3DD3A843E1F714B3A6EC6DBDC4307AD52060B06A9FA8344A3826F3C3F067FAD4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eac325e-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "f8453b4c-7670-4ed6-bae3-1416eb8932f1", "comment": "Malware payload", "value": "7b9cafd0d7eedd0e5db2976ff3bfb206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "04945a40-f7d4-4a00-9267-020dc1f827b5", "comment": "Malware payload", "value": "4232e26821d45c578983b613acbc8be12e9a6382a3275b7bc043d5a7b9ed15cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "f678d26b-5e8d-46f7-b0be-7fab1df7b279", "comment": "Malware payload", "value": "c5a708d152d6728dd447f5f3a78cf4480e0df00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "4198a2d2-001b-423c-a48d-262faa14baee", "comment": "Malware payload", "value": "13b0a60771bcc758c76c2c650c685d9e730cf9499fbcf6192a72aefd858576f39aea960ac89f8502dcbfc1b0cb2f0030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726009, "uuid": "6702e642-9cbd-422f-a1d5-750de4e8b1a3", "value": "T171C4120C76BDA926F170AE7BCBA15180B247E516B8A2F725B7D0A70CCE751238850F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726009, "uuid": "9d97e392-34e7-46f2-a64d-10eeae032421", "value": "12288:yYm6LKOlJ8PfyvP7EvrtLnUF0j6wulLgFeCM5Do8eBc86qVJ9m7PHd:yD6+OfEvBLnUFLLHCMlm4qVLg/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726009, "uuid": "af28be89-2a18-4cdd-8778-42c56862bf49", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726009, "uuid": "6398d0fc-a53b-4329-9573-b257963c8f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726009, "uuid": "06b5ec1f-b683-4959-89ae-8ce52ea29863", "value": "7b9cafd0d7eedd0e5db2976ff3bfb206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2457cb89-4a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693774068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774068, "uuid": "eb5f65a2-e6e8-482c-b776-09f3d3370ad6", "comment": "Malware payload (Mirai)", "value": "de7229e2f71ee07b9408852d7ae608a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774068, "uuid": "b65c0110-8662-4df8-82b1-2a59efaf69de", "comment": "Malware payload (Mirai)", "value": "445642f4f40b286e1713fc42bc7cec4f56d8d6b1a9eef67e693c934d84fd445b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774068, "uuid": "e3824149-3cd1-4786-ba78-97edf279bd22", "comment": "Malware payload (Mirai)", "value": "63bb9f01ab82c2aa3164be35a00e7f65dd3d074c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774068, "uuid": "a05a6018-f423-43df-b22b-7f462ef3321c", "comment": "Malware payload (Mirai)", "value": "f046788ec337fa46b93f948a9d2ac58de04bc88f64044804c87ed1fd7d939685acd66620436e7851e200e52b94a8e75a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774068, "uuid": "cbbc9644-8f1e-45dd-8a62-316c4430e1df", "value": "T1DDE32ADBF800DDFAF80AE3374853080AB530B7E155925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774068, "uuid": "6657afbd-dc06-4fc1-a0ff-df0d8d757385", "value": "3072:31sZLEhrvKzvHKXtDAMo8leHVrjbitLPGhS3yWWpH8:lsBqXhAkleQLPGKyWsH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693774068, "uuid": "2e33385a-cf08-4666-b613-3d3f21f8598d", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693774068, "uuid": "c501cf46-36e1-4d63-a9de-bf9282f47ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774068, "uuid": "e72e8d70-62ea-4196-bc95-c0bc2e476ced", "value": "de7229e2f71ee07b9408852d7ae608a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1da2ab-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725790, "uuid": "fa95f06f-5cf4-4071-ab72-5677ebe663a4", "comment": "Malware payload (Vidar)", "value": "e50916c2569a8775682adeee9675e716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725790, "uuid": "1987a928-467b-4613-a5b9-e7dde9be0162", "comment": "Malware payload (Vidar)", "value": "455c0c72d434406bcf575d3957ad7f22f714eee597d8bdee6eacc02cbef1dd2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725790, "uuid": "dda11497-1412-4d24-ba51-62754105a9ea", "comment": "Malware payload (Vidar)", "value": "293b99397d9edf536a8ecba2492e49f8941f96b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725790, "uuid": "4269ce75-7912-453c-a656-8c0c1c666392", "comment": "Malware payload (Vidar)", "value": "39232f93eddfa51d4c7447bc368798ecde36512f6d7e492b67b6501d0e10d775c436c6fb2c4eecfe4efeada42c19fb1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725790, "uuid": "44198627-e098-4f10-be25-0306f4e65094", "value": "T11A15AFC3D2E17D5AE6258B729F1FC6FC770DF5628E097B6962189E2B00B1076C2A3741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725790, "uuid": "0afe881c-c256-453d-9847-0bde07185caf", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725790, "uuid": "d567f0e5-5a58-4ac5-b2df-970525415882", "value": "24576:vB1VY2jMJhUNXvZLhu161x9bZgZBoiBF8W2fgLHL/N/:vB1VYkEuV31x9KZBlBFv2fgLHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725790, "uuid": "d5b763b3-82d6-4f06-ae58-024542a5931a", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725790, "uuid": "2fdf97d1-3e79-418b-b780-9e41a3c234c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725790, "uuid": "7d94ab4f-f232-498f-ae80-7cdd3f9a2280", "value": "e50916c2569a8775682adeee9675e716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a62a09-4aa8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693779837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779837, "uuid": "39a28b75-fcf6-4416-88f1-2bebd5ae158b", "comment": "Malware payload (Mirai)", "value": "55ed63da7d8ad2aba10fd656de8565c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779837, "uuid": "b504df39-e503-4c6a-a817-1a8476d6bf70", "comment": "Malware payload (Mirai)", "value": "48abfae65b292f7f2f189e0db6194f8d183efd10b9f9e8b0a0c878ac1381b41b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779837, "uuid": "231c393c-9042-4c36-b8d2-0a644eddf1ba", "comment": "Malware payload (Mirai)", "value": "f7c51c63f6d7ce704608e2387c4f6f7cffcb8bae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779837, "uuid": "1d5c7b51-f804-4f42-b296-3598a2655bb7", "comment": "Malware payload (Mirai)", "value": "7f9ffc21226198a86d13a23c3366a5f4e79a8b233ff1c47a310fe3ce48840ceaebf0a655fc351ed8c6d0e5e2a069ca59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693779837, "uuid": "96bc0f24-6ea9-4331-9d3b-2f3827210f18", "value": "T16DD32A06B30C0D47D2632EF43B3B27E1D3EF9A8121E4F640655FAA899271E325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693779837, "uuid": "05eee0ab-c127-4e3d-bd0d-a19ae365f48c", "value": "1536:D+pbqUem5ZHtxBVvZzppC5ucR2I66fDLojo8vA8vhEVYxLXsZqyqFdwL:DsZHtxDRFswcV6uD9h89wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693779837, "uuid": "dfd87d32-b9e0-4be0-9c3b-83b0666a24e1", "value": 133636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693779837, "uuid": "3a4b19bf-d737-4d4e-903b-5351f44618e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693779837, "uuid": "a7ff1c1c-a0d6-49e5-96ba-37eeec0bf5cc", "value": "55ed63da7d8ad2aba10fd656de8565c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea88200c-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720284, "uuid": "9e0024da-6e5c-48f6-b991-99de90bbb212", "comment": "Malware payload (Mirai)", "value": "4141599f18ce9bd9ad6779ba1ebecd9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720284, "uuid": "02f0dd91-62d1-400b-8c23-5224c4082518", "comment": "Malware payload (Mirai)", "value": "48c5510d4380ad4b3ff2b85fbb14f3822915d0fe3fe93f5bd29821cbcc3855ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720284, "uuid": "62429fb5-7c63-4e6e-9e3c-ad6a5269fb84", "comment": "Malware payload (Mirai)", "value": "587ccae994bbd6fee881f489d97c62cdde44160b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720284, "uuid": "c09e095e-dbc3-498d-881c-7ce8e03eec21", "comment": "Malware payload (Mirai)", "value": "4e0109f875aa1d7bd5d13a39a7eab407f9e4379b3b661256972b3edbce5c77f81d26d2bc927d9d12fe3631e12b731a9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720284, "uuid": "6f96a529-4ff0-4069-a42a-9148d555a563", "value": "T12FD2D1CD71A2F86BC98C5CB1529D136209B09AD0328E42DCAF128CD8F67AB87B14D47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720284, "uuid": "c669b36e-3831-4497-90a0-5f211a96becc", "value": "768:h6YWsmDlIJcBxNPc45TxajUxye1VnSEYxW9:h6YGDyJAPx1qUEwlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720284, "uuid": "ff5a230c-b255-4d06-b1f0-ac6b079a442f", "value": 29284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720284, "uuid": "1029c46e-8bae-4c71-80b9-f0bcf2cdd41c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720284, "uuid": "33d94257-cb67-4358-9437-bd0abe2949af", "value": "4141599f18ce9bd9ad6779ba1ebecd9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0763a289-4a92-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693770154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770154, "uuid": "6a41d801-2ad3-45b4-a4fb-9fd44a29401b", "comment": "Malware payload", "value": "8de7480497bd74fba49c5139a2ee60cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770154, "uuid": "03a9a3d5-9f15-4e96-b128-64f6e5266b3a", "comment": "Malware payload", "value": "49cb2f1c46cd8c063e8f050a1ddc51d8843718a64a9b5c8acaaf8393da22c568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770154, "uuid": "46ff891c-00b1-42ac-bad5-2ece3212125e", "comment": "Malware payload", "value": "67de56e6a4397aa0e64c19ab621cdb3118d93d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770154, "uuid": "afb79a2a-24f0-492c-bfee-b31bf5b842e3", "comment": "Malware payload", "value": "e1803147332a208013f7e667fc7a29627413dc7b344e09ea27ab7b9cd2221ee3f517171a5404ea3ff84516e7146fc8d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770154, "uuid": "3ad325bb-b802-458c-870f-ff4220616d6c", "value": "T123948BB3A6D0FC61C41543318E2ED6EC772FB8528D596B8726583F1B29B23B2D653B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770154, "uuid": "c9d5e29c-64c3-43b4-b0b3-4b56ce3bf74b", "value": "8f32d818dba805d643c0726702e5c31f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770154, "uuid": "f7c51540-120a-4e9b-ae44-572b57d7b712", "value": "6144:la9X1VPCaaD76tJiPtortU+HDKEbtNUxoEhjrTkE3r9slJrj8M6sFTD:la9X1VPCaO7i28DZUHk8OltJ6sRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770154, "uuid": "d847a4fc-68bd-4c45-907b-ea90fa4e39e3", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770154, "uuid": "68562f05-1d2b-418b-abfd-6bfa4f476c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770154, "uuid": "80d5fb9f-5fe7-4c64-9f18-09c46fb8b6f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bff630-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726314, "uuid": "3ac4f1b8-9910-47ab-91a0-d0d40de9a54e", "comment": "Malware payload", "value": "644bf3ee5ae3781f145c63485911161d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726314, "uuid": "63d3076a-d844-42ab-86b0-db33a0c97cd0", "comment": "Malware payload", "value": "49f4a8c50fd4dd8a4f94b0501cdb586fdb749bcbb92f8690ded6585254d799d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726314, "uuid": "2f23a9e2-5a04-4e02-8f9f-7cc55a058c8b", "comment": "Malware payload", "value": "8db66b4c87a4d6d3361e268330080542528ff7e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726314, "uuid": "4e255291-99f7-4c9e-87a7-8f1b5a20cf3b", "comment": "Malware payload", "value": "ece8eaf84944d05cf4290f5b20cde83e07a8983373fb4a87bbd2068d4d7ca039cefe852f233c508de957218fe27ace7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726314, "uuid": "f9f89258-6493-45b0-bfe5-4cfe6fa75aeb", "value": "T11A56E857F89540E481EED164C726A213BEA13489073433E76FB19AF11B27FE8A6BD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726314, "uuid": "d0e6124a-88df-4d64-8448-3b0b9e83881a", "value": "49152:6p+LoXU1ThfwM9rb/TZvO90d7HjmAFd4A64nsfJMy+lJrrq0Lu6TnWMdiSmIC/xI:3dhoPCrdnW86vteEUQvgklCLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726314, "uuid": "b80b1511-81ec-4413-b3b2-670b9ee6ae56", "value": 5976000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726314, "uuid": "ac5abfe9-8755-4365-9b7b-7785de35f634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726314, "uuid": "8885eb08-1bb8-4efe-9b46-2e6ba04596de", "value": "644bf3ee5ae3781f145c63485911161d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cba6e29-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725737, "uuid": "2bf1c21e-bac0-4550-8595-7c7e68c2a4ca", "comment": "Malware payload", "value": "fc29607d036cb27149798c60bf1069a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725737, "uuid": "df99b0e8-0d3a-47e6-8ab4-395b46781abb", "comment": "Malware payload", "value": "4b23872f18f016e1190ab4cb40bfb2142868db81b2603a67619bf490577be04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725737, "uuid": "3a532d87-96a1-43b4-bcf9-e3c57e85aec2", "comment": "Malware payload", "value": "e1a6a79e05718defde85bbe5fb6d7222f800313f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725737, "uuid": "75f49340-8316-48a0-ac8b-ad78b8c45bb1", "comment": "Malware payload", "value": "4da5b2b40dcc918d5deb7549afdb4ad99c300f622fb62f91fc7fb4bbbc47e70e6fe4818c882e4a564b9210933f78b81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725737, "uuid": "dd686390-c7e3-4620-82d2-6ce6df4ad3b7", "value": "T136A5D700D701521ADCBB35E94BAD313DB10CEAE0131464D785C8AAFEDBEA6F13E3559A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725737, "uuid": "7eaf2d1e-cae5-4a5b-b882-c1e0451c8146", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq8l/GIv4VJb:HLz6va++B6xN2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725737, "uuid": "c719ae0e-1124-4fd5-8ea1-2052d736b159", "value": 2195774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725737, "uuid": "83519bd4-04fd-4e28-a157-7d56701d6ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725737, "uuid": "e47e5a7d-fbb4-4558-a78d-436679517a8b", "value": "fc29607d036cb27149798c60bf1069a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3314773b-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693725989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725989, "uuid": "d818979c-8277-4cfb-a63b-0b6570ac809c", "comment": "Malware payload (Mirai)", "value": "ded7fab0fe783562a19d0a7c5bbf447e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725989, "uuid": "5df39293-7182-4454-8ec7-9bcb113cbf94", "comment": "Malware payload (Mirai)", "value": "4b6555ccaf6d11ecefa841aca28044e1a1b0b2b66e592101b27154005b722299", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725989, "uuid": "dd0ce15c-dd5d-4da0-a301-a5f55aacf295", "comment": "Malware payload (Mirai)", "value": "1cd6f1cbd5022debaac940ec722485a40846b213", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725989, "uuid": "3cba3b71-45b1-48d4-8fc6-6444465e9fb9", "comment": "Malware payload (Mirai)", "value": "07b5816641d6f5e9af58690eb2cc38121a67f5586e25625e46cf56b7acd9c09475049e94553158d5f9217b7c59b3f3b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725989, "uuid": "e45cc447-b24e-4d6a-af3f-937df23e08bd", "value": "T10DB31877A4654F73C045A5F125BA9A310F12AD931B1F1A88773CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725989, "uuid": "7573f013-7be2-41d5-b022-461b4718f5ef", "value": "3072:MDVLSItJP+Xsp4JlN3HujmH1cuEgvniuN/:MDV+ItJH2l3HujmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725989, "uuid": "ef8e3eb1-621d-4158-a543-da69d4dab9dc", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725989, "uuid": "51fea860-6151-45ba-b598-f3337b6530e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725989, "uuid": "81318e40-572d-4968-a57d-da02271acf2d", "value": "ded7fab0fe783562a19d0a7c5bbf447e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe80d12-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725742, "uuid": "d17e7129-1f77-45fd-aef5-8e8eb166a80f", "comment": "Malware payload", "value": "8205a943a971d3d0116f16670806ae06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725742, "uuid": "4737af05-fce0-43e8-9a89-76545b763e2c", "comment": "Malware payload", "value": "4c61350428e473a4af07589b163e965c8d0c50b936877eae055f71ddd336d4cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725742, "uuid": "6398b9cd-eb63-4094-8cc5-7e7b668318d4", "comment": "Malware payload", "value": "151cf423b678aa961f49cff073a907f276ad0ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725742, "uuid": "99dc6667-2785-47d7-a613-2e445d08380f", "comment": "Malware payload", "value": "2f58d22c8f7b20fb73bd264d856989e664be71a92aa1f31a46d462d7f7884d8581ae2979ccea7a0958941b2b597fc198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725742, "uuid": "9fd906dd-7680-4dbd-bcfa-a6ed68a5dec5", "value": "T1EE939D216591C033E5A31674881AC7F2AE7F74760275EE8A5F9449344F327D3EB2A34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725742, "uuid": "f0f7e2b5-72b7-4ea8-b16e-f06e0e18ccd4", "value": "1536:OlB9RCX7wff9qFeg3JRSRlk/xlpovTdV0uCygxF:OlBjKof90JiipS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725742, "uuid": "578545aa-5142-464a-ad48-08cd3128d05b", "value": 93031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725742, "uuid": "fbd7943a-996f-4320-94c7-9006a1b506b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725742, "uuid": "a681ea3c-f651-4a26-ab0f-4cc975340afb", "value": "8205a943a971d3d0116f16670806ae06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d5fd90-4a00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693707658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707658, "uuid": "bfa5261d-3617-443a-a7a6-abdfe8d0a118", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ade2d61c76f947eed09c10ddd4df8578", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707658, "uuid": "8b542463-e054-4720-83fa-b35aa241e398", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4d5e8970cac0c4a712788ba6d0ea6a3ad3e842dbeb61480b1f58bd0408497dbc", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707658, "uuid": "cf7a83ec-44fd-4f0a-85f6-3750851ff090", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "eaa010d2e0e4a04922790eb0fff4c14ba3bd4c95", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707658, "uuid": "a1359a8f-5020-449c-b4ff-b6bdbd489644", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d38a124f9f18fb1a2cbca02c47133692b8766da85d540802e1ca9235d3b7db058087c12c7313b2ae8ef8398c18201c59", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707658, "uuid": "19a7faa4-12cd-4be2-84dc-e6cf4f9b4da4", "value": "T16A252343F6A1D5B9F571E8F00C99E600543679A20878A29937FD5F8C5F33EE8EA50728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707658, "uuid": "280ef23c-1deb-410f-89f6-b91c938598d5", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707658, "uuid": "1ce69482-eb24-44ca-b364-64279fee157a", "value": "24576:8I39dAcA1YObmDSgpYP9+D9a9b8DjdVPQHzGkyFV/uN4vxt:86dAf1F6DNO9+D89b8DjLPezKuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693707658, "uuid": "8f9b6e11-d669-45e0-9af2-889430946a90", "value": 986101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693707658, "uuid": "4661120a-0e2a-4b99-8416-b684b3b6735e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707658, "uuid": "0e871614-2909-4492-9534-e4610471c97b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63462989-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693725640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725640, "uuid": "237f87b4-50fc-45a7-9e53-62f0de4d3673", "comment": "Malware payload (RedLineStealer)", "value": "bf3d0e5c75235be04bd3599558b11758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725640, "uuid": "59ee8165-c84e-4be6-bbb1-6b620015551d", "comment": "Malware payload (RedLineStealer)", "value": "4d8af028bf99091867806781d74507c08293f6bad0ae34e5eb70c5cda7b17660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725640, "uuid": "30b5e720-a0d2-4c02-a40f-50628a765bd0", "comment": "Malware payload (RedLineStealer)", "value": "2d6be1789e8ccb87f25d266a4df79a4021b73268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725640, "uuid": "1bcb9657-b01e-4c7b-8f49-e31d5d1b0970", "comment": "Malware payload (RedLineStealer)", "value": "e98a09b095e1d43920ecb8b837cf1ccf2cd73a5ea7d378b1ac78eea29034a5599fa627edd4efbadeb0d950ce9cf373dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725640, "uuid": "a10025e3-27c1-486e-9ac8-760e50d71aee", "value": "T1FD352303AAC48077D5F62BB05CF62183053ABCB1AD754BBE3B12799B0DB15C0917AB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725640, "uuid": "a82154ef-eee7-49bd-a968-5c232af6d73b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725640, "uuid": "8fb8823d-5a5d-432d-a7f7-4dd6e347dcfd", "value": "24576:NyakwolSghTqEPROkgzWx9qLsKss0Umx1UaHR2icRbz4O:oakVzpOkgzWPYnssgxOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725640, "uuid": "be34bcc3-72c7-4f4d-b913-e1ee3beb0139", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725640, "uuid": "1535ef2b-7c5d-463b-9894-5df2cd570e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725640, "uuid": "e3950780-cf21-4379-bc6c-286c6f5fff17", "value": "bf3d0e5c75235be04bd3599558b11758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c09c9ce-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724420, "uuid": "49a85567-213f-459f-8796-964acc262857", "comment": "Malware payload (Gafgyt)", "value": "8e47c6f3dbbc3d64d32611f4567c1eb3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724420, "uuid": "c92b7472-a603-44ba-b90b-0acc652bfe23", "comment": "Malware payload (Gafgyt)", "value": "4ecb4aeeec579a246fa2b0274302bf108153666b9d7ed36214bad3497e0b30dc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724420, "uuid": "bbc410f7-8d94-47c3-9ccd-71cefb210ecb", "comment": "Malware payload (Gafgyt)", "value": "8d3e1bd17ee3f8f9544dc8804674ba38a61cea03", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724420, "uuid": "595bf315-40f9-455e-be8f-3e1c8598e953", "comment": "Malware payload (Gafgyt)", "value": "45e00312994111d98fa64d3d3deb4dc6f5599ffa5564eadb31ec6c1daec9e2ed3d1fdc36550a20929c22ed4115627033", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724420, "uuid": "908b14bc-6043-45c8-9e3f-59b9c1cd62ab", "value": "T131935BCAE793C873C06310B511EBEB3A9E30F9F31A259902D7B86FA0DE021D15955F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724420, "uuid": "a3076494-4b37-4af2-9249-c6e1375c120a", "value": "1536:LFuFMfOddMXA693wYAaj2oZotyyt+v8JSw9DJ33TZv3+49:LcSfhXh1wYV2o6tyA+WSwVJ3DZvO49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724420, "uuid": "6f1a8672-7952-4144-8e0b-07711bd8d19e", "value": 96848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724420, "uuid": "00f9cef2-b8a2-45c6-b4bc-7a6a6a6bc7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724420, "uuid": "b0b35ee1-65b9-4d94-95c5-64e8f459fcc1", "value": "684i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b519b35c-4a6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693754984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754984, "uuid": "35416aee-e7a8-438b-bdbd-bec3b6802bca", "comment": "Malware payload (Smoke Loader)", "value": "a741bd22e46118cac5699d6261e6f62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754984, "uuid": "0e3af77d-fab7-45af-81c9-439c30bb55c4", "comment": "Malware payload (Smoke Loader)", "value": "4f2b50cdae8a54b9ea8c2fb0c9a4f90cb3deff3253312f8c2d0511101b210049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754984, "uuid": "2c004a78-f0a2-4ffa-9892-284d56871438", "comment": "Malware payload (Smoke Loader)", "value": "46785fa37f94896d1106388ee4b4d4cf7b4a1ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754984, "uuid": "678ce88d-3e37-4201-b2b8-e8760f196f83", "comment": "Malware payload (Smoke Loader)", "value": "71ccaf45d44e3629a91af17ad5a9f5d3d47fd1bb4af81fc63f2e9c47ea6be3af1b67d2ab027e5953557c44050d0caf63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754984, "uuid": "51afc33f-e8b2-42a5-9b54-e398a71621ee", "value": "T1CD54599367D1FCB2E01643358F1EC6FC771EB8628E29AF9727542E5A19322B2D617301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754984, "uuid": "6b3fc62f-df2b-47ff-9cc3-25f6be8fae05", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754984, "uuid": "a553fb6d-6f07-4eca-b805-ea4d99ef178f", "value": "3072:iZFT4HkUBNwPF5K4x89QHjxEmRS8uqsx0VlshTIsik:KFvU/q8U7I8uqsIlshT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693754984, "uuid": "fe019a4e-b4fa-46ed-963f-34e693760f91", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693754984, "uuid": "f80265c1-aa5f-49c5-acd5-51a54c40f9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754984, "uuid": "4dca6590-0101-4dd0-878c-ee566b188a12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faffbd67-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725895, "uuid": "843a4ace-4590-4a3d-b43b-e742ddad47ac", "comment": "Malware payload (Vidar)", "value": "5bf5971bacd2331d5ebbb5a20ac31c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725895, "uuid": "c421b195-3e7e-4941-9cf0-a08e3aebdd98", "comment": "Malware payload (Vidar)", "value": "4f82b2ed8d3bf3d9d889a6ae2eb3aced542fd2a75078ca9c97f38173e6cce0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725895, "uuid": "09b499df-67c7-48a0-a614-666acaf56d9f", "comment": "Malware payload (Vidar)", "value": "b255e16f2fafb3a04180eac2343e78de35ecf7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725895, "uuid": "da26782b-6dfd-444b-a38c-f5e5ae132778", "comment": "Malware payload (Vidar)", "value": "37a5e19c07f31ccdfb59ba7579a3c8ad7dfe00b9dc742afbb79c23e0c0425d8ad960e43548da429059748b9d8704008d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725895, "uuid": "c110b048-9345-4380-b613-da970301c383", "value": "T18F15BF8392E17D59EA258B73DF1FC6F8770DF1608E097BA9A2189E2F0079176C263705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725895, "uuid": "e653dee6-c26a-4371-a92e-9100650a5525", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725895, "uuid": "a6ec5c78-7149-45e5-946e-abec60a04f99", "value": "24576:WsFNsLT/QFpsthba3xAMN1GO6g0jZk2GM/:WsFmLbTtk3WUKDZk2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725895, "uuid": "1c2751ba-ded6-4959-9d22-346b190a0f8f", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725895, "uuid": "5d3f2174-f30d-41df-b981-7bc62de0f97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725895, "uuid": "70a94f2c-afde-43c7-a9f0-8e06567c9ff6", "value": "5bf5971bacd2331d5ebbb5a20ac31c12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5547df49-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726046, "uuid": "37440108-8dfb-44cb-8f63-eb5958370306", "comment": "Malware payload (Mirai)", "value": "aa635c4b4e6dc45ccd839fdb2eb7dfa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726046, "uuid": "1393e64a-55c6-462d-95c3-a764bb68d224", "comment": "Malware payload (Mirai)", "value": "52ae8a4c78016f74a61e6f973ce20a353961fee90c0e6a12a8388f5e42d6cf08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726046, "uuid": "7a3f1604-64fa-4427-82a0-8fec01b9a556", "comment": "Malware payload (Mirai)", "value": "66fe1fbb7792b5b6b8f8afbb69c49b032bb1d95d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726046, "uuid": "fb94344c-b6ef-411e-9591-405dd55f0bcd", "comment": "Malware payload (Mirai)", "value": "744af58b1aa9c6d82235f575534e517332a46b134f168cf23dbf4f84f3c3e77d38845f2e5cdeba26654c6b1b7f59cc43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726046, "uuid": "dc6c4052-4ac5-4c22-bd91-36cfb337296d", "value": "T1D8C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726046, "uuid": "ac6722c0-d8dd-44ac-acdf-0671f3c3eb55", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPRL7ymm/QMurB1nKGNb:SMQplVRamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726046, "uuid": "c678c772-7f7d-44de-9044-d8e9e37e173b", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726046, "uuid": "1199a9fd-40b2-44d2-87d7-64bd9facd111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726046, "uuid": "00ba9528-d69c-4210-9196-7743d8608800", "value": "aa635c4b4e6dc45ccd839fdb2eb7dfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f339a0-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748568, "uuid": "4a5dd2c3-47d5-4a13-aa3d-9e1309f686d1", "comment": "Malware payload (Mirai)", "value": "872cc9b14a0a7764f3e822a66674b225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748568, "uuid": "de763b8f-054f-4436-9a1b-316e89626d58", "comment": "Malware payload (Mirai)", "value": "5380ef7252f758818da44f12e8479e32ad062c2044d2318099482fc9c029c253", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748568, "uuid": "9ba2c633-756a-4391-87ec-60d33dd0ba5c", "comment": "Malware payload (Mirai)", "value": "038239142d49035901d4018e8e2e45a00e86b3c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748568, "uuid": "c0b6ef8b-3780-4923-b95d-8bb8e66858c3", "comment": "Malware payload (Mirai)", "value": "c6ec64527b086bdec0e7c3ca9e219b2bfe8d170e2d1e02b591af876aaf7a812810962213587d0361311b7f94183d3fe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748568, "uuid": "2be97136-8cad-40a5-b861-05f0aa030fb6", "value": "T1D4B2D0608B8DDA09C7B03474F2B88F9A5A6B52F4C1B639236510F23CC3A159F38F58C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748568, "uuid": "5ca2e7e9-b98e-4303-b992-4db64abe7c81", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVG6BfIy9nMPm4m1hymdGUop5hu7y:4GHKQFH0rs3zEfIyePmv1s3UozM7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748568, "uuid": "eddfbc47-3c63-46b6-af1c-9999d00ca7e7", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748568, "uuid": "cc0d73e8-e102-4019-930c-3becfd280fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748568, "uuid": "129b8a6a-edcd-4e24-9aad-5d78a3e82869", "value": "872cc9b14a0a7764f3e822a66674b225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355e9dc8-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725993, "uuid": "aa175f1c-fc22-49b8-8698-42af8f9721fd", "comment": "Malware payload (Vidar)", "value": "016745fe81e2f8f59e771221324df87f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725993, "uuid": "245ad87c-a459-46fc-8400-cf814e25871e", "comment": "Malware payload (Vidar)", "value": "541948c4b13042e9c6dae3a433660aaa546c06352f0bbb44133d9a6ff60e54a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725993, "uuid": "033e78da-d54f-4084-8d82-78cab1640864", "comment": "Malware payload (Vidar)", "value": "e0043f2b3e9af0aad3e463da254924a771401095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725993, "uuid": "98b62cb0-c56d-40d7-ada6-e6227286969d", "comment": "Malware payload (Vidar)", "value": "a4a22b76d5b2a13f74c5b6bc31eda4fd1ebf3fa02030077339258a197b6ab3d010e06244ee04530fc85e743980440c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725993, "uuid": "6049128b-3218-45e2-9a4f-d4bebfc2266c", "value": "T1EA74AE83A2D0BC79D52443358F1ED2EC372EB8A04DE5AB9637446E5E1931372DA9F309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725993, "uuid": "80b97fd1-4b7a-4ca0-af58-8bb29ab35248", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725993, "uuid": "ac243bc2-3f10-47c2-a3b6-7e4330a77abb", "value": "6144:zsKOfVS0nChnqc6DMhzUlcdOiaveRXTsky:zsFVKhnQMhzUBiauAky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725993, "uuid": "6763537a-7d5b-450d-8cfb-8a4a2a042a99", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725993, "uuid": "c077a5db-0358-4eb7-a406-45407303a210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725993, "uuid": "25db2c57-c61f-4f1a-bca6-106a7a210a54", "value": "016745fe81e2f8f59e771221324df87f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4b9e8e-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726006, "uuid": "32e0df3e-3273-40a1-908d-ddc8bb7f3702", "comment": "Malware payload", "value": "23fbd6cc3e4d92725be2123cd0a34144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726006, "uuid": "67b63875-c24c-4908-99a4-7045df24e259", "comment": "Malware payload", "value": "5472457e4a6d21d8806d961a26df0a0e45c86243770ef326f3372ed042d68661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726006, "uuid": "a1c15451-d8d1-483e-a6d2-99e52758ad85", "comment": "Malware payload", "value": "b2b8611883377b819c1015a1fb1bc5215614b15a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726006, "uuid": "198fcdaa-5e50-4724-be00-664698665d68", "comment": "Malware payload", "value": "e92d0b101fa6e210b2f54577742cc42b2d52aa6d2c3312ea629e22aa4fb88f5a6183afe7f5fc7e4681c2ccc8b5375a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726006, "uuid": "f88b456e-c984-4c56-a365-1c8c9441f9fd", "value": "T1006633232145124BC5E5C8B6A927BDC0F3B3177A8B836C78ABD5ACC635754F8E282D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726006, "uuid": "7813ff8f-a07a-4fb3-a099-9f444fd32507", "value": "cd4194f2a03a8241f9d651f91a4afdee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726006, "uuid": "af743673-5e50-4743-8c0e-d64d60bdc7f8", "value": "98304:gYOpjnaDe7pEGzyiQDOuknu4TNPu5zGxDicRQwnwyNkuBY9pxvGVqMMjDngfBvLU:gbJEeOGZPuknu4TNAzGx2tXuqIg1YJwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726006, "uuid": "24ed6325-75ff-4c68-a7be-8ddef9dc1ece", "value": 6946848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726006, "uuid": "c197e9bd-1182-429d-951b-0cfef13b0922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726006, "uuid": "6599ec10-7d12-46b5-b94c-b1ed9750b4c8", "value": "23fbd6cc3e4d92725be2123cd0a34144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f73a09-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726338, "uuid": "f047a6a9-fc0a-47d3-8364-8a619b1e9868", "comment": "Malware payload (Vidar)", "value": "30aa77647060c1818e89193da8c7422e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726338, "uuid": "8d3a6f03-5e5c-4974-b11b-10767056a1e3", "comment": "Malware payload (Vidar)", "value": "54b99c968e338c0fc176a30a1f5ea89c85f6ce62f5c7a2f026b3e948be5e7670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726338, "uuid": "1f96792a-0807-4b8f-988a-e3ecbe27045a", "comment": "Malware payload (Vidar)", "value": "342e78b86a1ef72dcda49dba996f471990c642cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726338, "uuid": "de69e3c4-4423-4405-8421-8630f01baaad", "comment": "Malware payload (Vidar)", "value": "fa153766191feae59079697a5e1d28480bbbaec18f188a5b10ca96c36f5ef6f2bc8afe2ba935829068a5279803ad556b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726338, "uuid": "3ac1a2c1-0b0b-4b71-9f78-3478a8de49b9", "value": "T1B905F1D3A6D1BC7BE0220772BE1ED2FC372EB8705D196B4627144E6B0971172DA9B342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726338, "uuid": "4642d705-3e8c-45aa-b7d6-55984dbf52c0", "value": "a90bfe185c06be0aa4a37134cfb76f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726338, "uuid": "d275e64e-afd5-4bba-8c2f-d192f43ab5a5", "value": "24576:9qT6JuLv3wMZ13obols/+wFJQGkshUmgdy:9qT6kHLobDGqJhUmgdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726338, "uuid": "33afcb59-c358-4577-88b0-798ad5b341cf", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726338, "uuid": "ee7fcce6-ca48-4cdd-91b4-afab26c07e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726338, "uuid": "3cf5fe14-c124-4302-a1ef-1e9ee94903e1", "value": "30aa77647060c1818e89193da8c7422e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77619ae4-4a60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748867, "uuid": "6839636c-cb25-4b95-8cc3-8297da5cb930", "comment": "Malware payload (Mirai)", "value": "27692cccec364c8053001d1e24f92fc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748867, "uuid": "deda2fba-b359-4c00-b7f3-5f51656146bf", "comment": "Malware payload (Mirai)", "value": "55fcd734b16d767c91968ecb3252626a806ea8d551ed815c25c25221b0a77487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748867, "uuid": "64ea7755-c1b9-4b77-8a2f-90b6e187642b", "comment": "Malware payload (Mirai)", "value": "6c3de5ae9c4fc3092494768faea133aa006ca50a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748867, "uuid": "2933f063-3e2b-4e00-8159-886681be4b9f", "comment": "Malware payload (Mirai)", "value": "fc826f5d38e2324256ae536cbb872ad579a4ab502116cace5a7a951d4390c4fe5864da2a4e9bf6a4534981282f9c2da3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748867, "uuid": "18669b39-8061-4915-bcf8-a2bc915fbcce", "value": "T17E735D24A97D2E26C0D4A17B62FB8321F2F6230E2570965D7C760F8FFF2464468562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748867, "uuid": "5187dafd-60b4-4024-bf35-337de7eb3023", "value": "1536:5ms+geQfvznpCR8ee84cNZAUiAvFI7IlNnws8J:YwfdNu4cfZvFqI3w7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748867, "uuid": "416a5f80-fdca-4fd9-a66a-359c33e4a7be", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748867, "uuid": "64e13c3e-4216-42c3-8423-d6bc01708d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748867, "uuid": "fb6f3ea0-a396-485a-a83f-53e3eb5ec99c", "value": "27692cccec364c8053001d1e24f92fc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a86ff25-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693725492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725492, "uuid": "b34432dd-a007-4783-b47d-2958e537f221", "comment": "Malware payload (AgentTesla)", "value": "6a4359dbc0a68ac20c4e8638907f8c1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725492, "uuid": "e0656b33-1c04-4d34-a963-7d7f23977289", "comment": "Malware payload (AgentTesla)", "value": "571b509e7c87384fe9a4933b24cf0d7d8e2c2faa70e39613ba3561259a573df1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725492, "uuid": "bd3cd48d-89b2-4dd3-bc70-da8431f0a4df", "comment": "Malware payload (AgentTesla)", "value": "6f7dd492b83ce878c507834686c41c02864beb8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725492, "uuid": "0653b3fa-c23b-4731-bd4a-8c87979e7c31", "comment": "Malware payload (AgentTesla)", "value": "75d6149f4c38281c07a1c3af9b23867df1c66593573d23f93b2a6e25d403f5ffca9860553d36d22effc8b5b133873f1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725492, "uuid": "0dcbc9b2-16f4-42a0-81a5-d041ca2c5392", "value": "T1A9C412971AE2E827D12A4BF950609E30101AF25DD0B9E6A0EEF5F1CF3505FBA09553F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725492, "uuid": "8453523a-3256-415b-8939-d4c8b182d842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725492, "uuid": "524fe340-95b4-4824-8989-46b1253d281c", "value": "12288:itE4ccbXkDCxviTp5bawzL3Tur61d8am9BM2IJ3h:itoWkD0K1l6wHm9BM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725492, "uuid": "f5f4550e-e914-4c6f-a5c2-d883890da651", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725492, "uuid": "e9b59bb5-90e8-423e-b22c-a305e7f96ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725492, "uuid": "117ca98b-ca97-4c75-8f6e-a54c401660e1", "value": "World Business kart Hesap \u00d6zeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef36a1e-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1693725902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725902, "uuid": "c232d661-f348-4cd0-8459-1b88cfae08ae", "comment": "Malware payload (LaplasClipper)", "value": "062fe47e8efc9041880ed273eda7c8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725902, "uuid": "74c3baf7-ca73-4d1b-8665-bec15b62432e", "comment": "Malware payload (LaplasClipper)", "value": "589b49a8e56beb55dcdacec0cdc3e04949eaa678df53d720ba940c7193130344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725902, "uuid": "a33232e1-8e36-46ef-9e11-885cf7ddef4b", "comment": "Malware payload (LaplasClipper)", "value": "b77fffa5fce64689758a7180477ffa25bd62f509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725902, "uuid": "c19e8e96-7496-48f1-805b-86b394520bd9", "comment": "Malware payload (LaplasClipper)", "value": "f3a6dc88089d1a4ab72529585083532521d03dce2fe1c0b2d2fe6842f2d90b638abdd852309a7764919375c857cb2818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725902, "uuid": "2757793b-ef67-4cd1-a735-8140ec9f3847", "value": "T138F5337100B1B8B5F50EA9F0651D6E067C3AE91CE8FA42E127CD7E1EF9903011B67E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725902, "uuid": "e82e56c5-c972-4df6-af14-698f5b49abd8", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725902, "uuid": "0350ab8f-fb31-42e0-ac22-b38443816cfb", "value": "98304:Qs1IP7M+tBbnp5KsWEjGnT6iWB7cXWvdeMl+0WyC6oxgfMapH:VoA+3n7KsWEQTUqX8dedyXw2pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725902, "uuid": "5d6d75dd-0959-4b66-b716-22b462244535", "value": 3645624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725902, "uuid": "f5582c67-9f94-4e61-84ce-8a4d24c74b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725902, "uuid": "66e5e6b4-4b3f-423b-9ac1-237d6d3c0cce", "value": "062fe47e8efc9041880ed273eda7c8f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86360d1d-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724411, "uuid": "26b93df2-96cf-493a-9859-1388412014b6", "comment": "Malware payload (Gafgyt)", "value": "47c6abb9c4652d24b08e2c0349c4a433", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724411, "uuid": "62d55eae-96a7-4bc5-a651-ded88524a89a", "comment": "Malware payload (Gafgyt)", "value": "5a17ec7121e5720b24c9a449f2aa63b7fe5f57a0ebaea9de7e491f6c904438f8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724411, "uuid": "c122a6ba-ff2a-44d0-bcdb-9c0e3cba2074", "comment": "Malware payload (Gafgyt)", "value": "3c742dd08d560e0ff8c0fd5f70148e6543b494c4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724411, "uuid": "5a7f4bff-e975-4211-a084-63a56425c7ce", "comment": "Malware payload (Gafgyt)", "value": "39c2f7eb2454b85855a499abc89163bc57dff6b7aaf5c28b42b5dda787883ef129e04659d4e37d9cd6ce693e51ea032d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724411, "uuid": "299bc208-a5b7-43b1-b115-5d7a78b1b7d3", "value": "T15AA32956BD118F03C2C315F3BB9E46897A2267FDD2EB3103E931AF6133965D6092AD90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724411, "uuid": "d06207a8-43c4-4b65-9509-faedb36b5c52", "value": "1536:UZQ3KR3Yck3ZyxCBh5SgckcwO7nOrqCuCZk58OTFB+RSv05hzYOpTs7:UZfO06/c8OlYwxTnkQ05hvpTs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724411, "uuid": "35ed76d9-47b6-4e10-bee0-bd2d62ad80e9", "value": 104368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724411, "uuid": "7483c76a-ea48-4580-b854-ac5b112fbe41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724411, "uuid": "56166762-4f96-4559-8241-b93134b86797", "value": "mra", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a323c8-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724408, "uuid": "56ab8209-edb8-4240-8ebc-ba0af13f8790", "comment": "Malware payload (Gafgyt)", "value": "9fb2da4afbb06a921c449b481fdd2f00", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724408, "uuid": "d13332c1-cd00-473a-b1b1-02736b02726a", "comment": "Malware payload (Gafgyt)", "value": "5ba377968478c6fcb0df838d3b9f8fee11ae9d58bdfea468ca1ab2d9854d9dda", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724408, "uuid": "cee1fc1a-2a24-44ef-9bec-03a62f00bcca", "comment": "Malware payload (Gafgyt)", "value": "687c6835cb1a60653df962e7629e924dc6c892a5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724408, "uuid": "32578a16-42f5-49e9-9f95-7f76c2e3c236", "comment": "Malware payload (Gafgyt)", "value": "e322272ed28be7290441332cd45e2b9603bed0020a2e9987d739e5d33a9a32dac10bf8f1382ac57b1c3c6ae2d64ab22f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724408, "uuid": "3a2b09f6-7b2d-442d-9f0f-c4fa5d09ca4c", "value": "T1E1E3C506BF108EB7C81FDE3305B98A0528CCB89725A5373B3674DA59BA5658B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724408, "uuid": "64c3bba9-868b-457f-ac25-be0df1a8439a", "value": "1536:Gs56/487+4gapOAdQA4Omyh/Igm6fZxaC3lJ8TFvR1SbGBhz0u65hspdkm2:oAODvmKIGfu/NXvzc5hspd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724408, "uuid": "a70c31f0-77ce-4388-b064-c5f4e54d0f83", "value": 145348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724408, "uuid": "3b56ab3a-f4b9-4c9a-8f21-dfc106e403c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724408, "uuid": "3baac01c-0e85-46e9-9dc4-bec793baa292", "value": "lespim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a437f3c0-4a30-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693728326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728326, "uuid": "a2553c77-527c-41a6-bbe6-f1819a65a6ee", "comment": "Malware payload", "value": "4b395e58c2cbb3702d3999c26411dad3", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728326, "uuid": "62d5ebf4-0ba7-4871-8177-7f3909e6f5b6", "comment": "Malware payload", "value": "5bcc5718b11d0e933930934805ea3f1dcb888dd19eb9dd75574ef425e704d799", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728326, "uuid": "ec26c41c-ba3b-4cb5-8af8-1406850ede54", "comment": "Malware payload", "value": "73ab3cc0ae79848342402de07e433558b4facdac", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728326, "uuid": "adfd99ed-161a-4e38-8051-c2546772d7d1", "comment": "Malware payload", "value": "6e8f9e6e460b13532ccaa01a5f077b494647b2aef0f6f7695940ba39711660c6670af0f489fd40e8049d764867d4a4b8", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728326, "uuid": "87a1c434-bfea-4679-9e5e-3fd5e7626165", "value": "T1CBA67C30EA44012BCE8313BBAD6646D3A93CD621131211DBF6DE175D1BA74D8933AF6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728326, "uuid": "8297aa60-a722-4cc5-bfce-076cb7dc2b5a", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728326, "uuid": "9edb3f8d-cdf9-44ed-9e04-2dc1a8d0ec35", "value": "49152:3Wtfl3xiDZjSPQaLOpU0dpBYYZFfsqWGXwuO6Bpp5eIMXYpnF4tk11zppI04zmHf:mtfl0kYax0dMiNsqWGXwtyqIM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693728326, "uuid": "4c4b8402-6504-435a-b3be-9c564a94a753", "value": 9784466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693728326, "uuid": "3fd1ed78-d429-4698-9821-e0732ac22160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728326, "uuid": "5cfaed25-78a9-4047-a99a-475244a5f425", "value": "%D0%A1hr%D0%BEm%D0%B5S%D0%B5tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8bbc59-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725872, "uuid": "d4cf3ea6-1f29-4eaf-bc2d-9f00c82dca3d", "comment": "Malware payload", "value": "6312b528b128f4c08feef5b9ae3d33c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725872, "uuid": "fec2bc22-3bf3-4732-b24b-4f41d80ec7d1", "comment": "Malware payload", "value": "5c46816ff55701c39cece28ac8775cd8dc5b7ee905a6d028ebc82f8622c1365e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725872, "uuid": "bec240e9-d8fb-4627-9872-392e0f147e29", "comment": "Malware payload", "value": "790820a85dd563d0927346411def48c32ad45dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725872, "uuid": "d0d632c7-413f-4fc9-bbcf-63e4fe98c6ef", "comment": "Malware payload", "value": "025ab5e6ae5d8fce24342ec8f25d329d946395a0a3f2711b77433eb0cdda1336c2e9547c6a3fcbb80fe5f9f902726ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725872, "uuid": "3718f27d-a9f4-4021-9489-ac4a3952dbd3", "value": "T17395D600D701521ADDBB35E94BAD313DB10CEAE0131464C785C8AAFEDBAA6F13E355DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725872, "uuid": "d7f2f243-8d15-4bba-91e4-eaa1a3c29ac2", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq85:HLz6va++B6xN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725872, "uuid": "3e5de3de-f923-4a53-bbe7-0560c9998c5c", "value": 2006025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725872, "uuid": "334adf9f-fd14-4bed-8fd3-8b621fb39f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725872, "uuid": "1d1d723d-d12f-4e48-8503-e26788633e1e", "value": "6312b528b128f4c08feef5b9ae3d33c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dcffb5-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726079, "uuid": "6e798af9-a141-49c6-bb6e-53f663e5c1b8", "comment": "Malware payload (Mirai)", "value": "92143c6a5c950cf1860be61a77ef51bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726079, "uuid": "0c52e051-d818-42b0-807a-c157f714ac53", "comment": "Malware payload (Mirai)", "value": "5cc88cac481b2b46b41f3984784c37b8e82e025b1ac05a8ce368a503f68c09db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726079, "uuid": "a5cc1a86-2d3e-4aeb-8ad2-86712257875b", "comment": "Malware payload (Mirai)", "value": "3d56bfa21b5af8899a431c03fba44e15c24d0e76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726079, "uuid": "2af8145d-5e47-4ea0-85e7-8c3a9ee288dd", "comment": "Malware payload (Mirai)", "value": "56e84eef28223e3183de649a82f2f781d8d3efdbad41c8ddee44338c29df575221bda1813afc359ccbaff28e9f7c99fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726079, "uuid": "a8188f95-af7a-4753-8f55-3210a2fbb267", "value": "T1F8334C02B30C0947D1A36EB43A3F17D183FEEA9021E4F684751E9B9A9675E324186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726079, "uuid": "32a05936-8402-43a3-b32e-6c4d97d0f35d", "value": "768:g5Rc3RdH3OoPkZH3YW2zZ/S9yEob+3Fy8eIAguBCtIFhZt0ALghIJCs:oKPN8GhMyTbYTeIAnCtsZ6A8hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726079, "uuid": "fb2f9d44-294b-48fe-a25b-4650172f022d", "value": 51956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726079, "uuid": "674c040b-1b91-4964-8873-4d86b56df6f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726079, "uuid": "9cd5da7a-c5e4-4680-826a-b272c5fe11d1", "value": "92143c6a5c950cf1860be61a77ef51bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8225fe37-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724404, "uuid": "3007233d-48ca-4b52-8f0b-e6a0290edb9b", "comment": "Malware payload (Gafgyt)", "value": "97fe1da419aa67ef5f0c0d49c8c0aeb2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724404, "uuid": "25df4091-ca34-4bda-8163-b15b52291f8d", "comment": "Malware payload (Gafgyt)", "value": "5d7063a8f98642f57301f0e4014217a6ff3ae6f9aa2595e1874807f1d7ac4f85", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724404, "uuid": "1acb26c7-2f6b-4ebf-8796-ab42d3007348", "comment": "Malware payload (Gafgyt)", "value": "03108ee2ef3d7bb33b74e63588a87003e93877a0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724404, "uuid": "f655cd29-2be3-4bc6-9b9d-4d4cf95e464f", "comment": "Malware payload (Gafgyt)", "value": "35d226d2843bc8115cd69da693f44c26610bae1dd347c141097ea5afad43184f63790f0968bdcf1b7992afa3cd958a9b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724404, "uuid": "e5f1bb59-cd42-43b2-8716-b48c66c4c06b", "value": "T133A34B03F695CDFAC087D2F44AEF69228931F4EF167271676390BE901E1CED12A19E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724404, "uuid": "1ed7450e-19ee-47c1-a71c-07357955f5f8", "value": "3072:62RRnFdVS+mcnaGjT8yBQEIgtMwzvcJ3lXCZqN:6IhFdc+jaGvFBQEzhwJ3lXtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724404, "uuid": "1964458e-ce5b-414d-b15e-9d85460f4f53", "value": 105471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724404, "uuid": "2a089648-f794-44b5-a289-d7f3a30fd875", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724404, "uuid": "d74b004c-ddad-4a3f-ac3b-5a27a7f9723c", "value": "46_86x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb82aa15-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725869, "uuid": "c2bbf4c2-5317-46b1-b9da-c01b630fb0f0", "comment": "Malware payload (Vidar)", "value": "fb54d5936b8c83997338f8c0f8108472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725869, "uuid": "b4a808d4-d2dc-47e4-8cb2-a64e443c8b72", "comment": "Malware payload (Vidar)", "value": "5d9d843abad362304893336d0727557cbd4d4c457e08a6d5215c0c24e2c5f160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725869, "uuid": "ffe3d629-23fc-45c6-82c3-e39fe36439b7", "comment": "Malware payload (Vidar)", "value": "93824d1a053a229de8a204818c900c8054d87815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725869, "uuid": "e3681d1f-5e6c-4c0b-b2bc-967e1d335653", "comment": "Malware payload (Vidar)", "value": "bcce38e960f76c8e069d94ddc111d8e48e635984e40e318a43578c78afa1f77524adac354ef4409e6bb24c98e0baf37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725869, "uuid": "b9ca92ce-b8cb-447b-845c-2a26e37b360c", "value": "T122A4294393E17D58EA258B729F1FCAF8770DF6608E4D7BA922189E2F04B1172C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725869, "uuid": "62d532ee-c69e-4f1a-936e-a1c50281de51", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725869, "uuid": "1d5468a8-bd0c-4d1a-9178-8ffae5777305", "value": "6144:WmsHM56D6NDsweUDVxLU/Cx71w3NE9s552/Obw/t:DsHM56D6NoAfLUgxeNCsz2/OM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725869, "uuid": "d4e60863-61a5-4556-8aff-59a8111200c0", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725869, "uuid": "3bd760c6-efae-41b2-a6f6-90da555f3934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725869, "uuid": "a40bdfc9-5df3-449c-b762-39909b3a9883", "value": "fb54d5936b8c83997338f8c0f8108472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f5ef46-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725887, "uuid": "e3b03fc6-3497-47fc-b245-8f04c0cefb2e", "comment": "Malware payload", "value": "8ee7bf7efd5c2e479d072d54c506f48a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725887, "uuid": "ac99758b-c868-48c0-8459-57a7308eb7bd", "comment": "Malware payload", "value": "5ddbba7a57a2e08e07cb2904e7f6be6447c9e292cb4cae483988db8443857a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725887, "uuid": "70f481db-e054-491c-8d78-e0b808c26783", "comment": "Malware payload", "value": "43c87b2468d036a5ab2912e1334501c7ff5348b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725887, "uuid": "df00eb16-99e9-4e72-9a2d-40d063c9ead7", "comment": "Malware payload", "value": "f6971a5a2e30a4c3080edea18758f25159743c1641f29f275012be442117071f362914c2edfbc92d5a016db5b345df34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725887, "uuid": "988fa92d-230c-4595-9411-0b8c9d396a31", "value": "T1104318212945A032C32895F8365B7B2BD13CA9550B3DAECFCFDA8C341636BD5B133A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725887, "uuid": "250a06ed-f67c-4c0a-8b93-90ba621d4bec", "value": "768:ReCtDcGNVqcTn/co0AXnlWu65I81humbzwpwpPjOkyz8zEk5OrlZvD4ia67zwssz:RemcU/gcnlL6b1lbCmjOkKzsuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725887, "uuid": "21ba4977-5198-45a2-b8cb-95ddffbee805", "value": 59472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725887, "uuid": "8b1beb89-619b-4a72-b576-159dc48c78c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725887, "uuid": "9640f621-e815-4428-869e-86f9d94646cd", "value": "8ee7bf7efd5c2e479d072d54c506f48a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4138da6-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748539, "uuid": "3f9c9702-6c4e-4d14-a487-ecd69ff632c6", "comment": "Malware payload (Mirai)", "value": "14d8d7aa4a1f4a0929a7cafe8c118f4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748539, "uuid": "46005169-3af7-4316-aa7c-5b278a35e080", "comment": "Malware payload (Mirai)", "value": "5e302d9beb9c21f5c62c1ead98e7505625e1b665b95a44581a95d2ad1f599cea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748539, "uuid": "e0527137-6a4f-47f8-b7ea-80ff6508622e", "comment": "Malware payload (Mirai)", "value": "ba0dab76382a0499a3dda23a2d546659cf373216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748539, "uuid": "2c786cc8-60ab-47e6-9915-fef6ea2cbc57", "comment": "Malware payload (Mirai)", "value": "7bad8238acb201fb8e7ff7de7b90a5f940af9f3668bff02c9468e50525d5cafc9adecf238b3ef40ce068633ba69743f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748539, "uuid": "b1c10725-bdac-4a58-b5b5-050b633ee521", "value": "T15AE2E122271AACC3AA700176E96052CF377C1ABDC17EB1F629140478ADDA9DA0F691D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748539, "uuid": "d459f0ac-2beb-45e1-bb88-e3958cdf54c8", "value": "768:9oiWiO031vEkzFfN6ToPFj15ufs6AG9q3UEL5IZ:9orm1vEktjPT5uCrLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748539, "uuid": "0ebe8703-9cb8-4517-8cd2-e6a0563a3fbd", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748539, "uuid": "7b951bfa-006f-4cf0-8978-aa5174f43676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748539, "uuid": "f9f5381e-2052-4642-9ad7-c5da35d86b16", "value": "14d8d7aa4a1f4a0929a7cafe8c118f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d41097b-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725657, "uuid": "6878fbd4-560d-4f59-98d7-a84f1cd47e67", "comment": "Malware payload (Vidar)", "value": "f49a18de0928eccc60284a4540ccd38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725657, "uuid": "33b55b92-8bd3-4b68-88c3-01c1082fdf0f", "comment": "Malware payload (Vidar)", "value": "5fed80fe14d69197b794b89eb87767f2be766d97702b00bc82d35c619961448a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725657, "uuid": "adef445a-088f-4077-a7bf-aebdfe737e8c", "comment": "Malware payload (Vidar)", "value": "458713af6cbfb535bf89afcd1b779fcda9a81baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725657, "uuid": "8f202275-2104-4900-bf8d-d1496df8bb74", "comment": "Malware payload (Vidar)", "value": "8c6fcb98487061e2a59d9b3c1e1948b9cbffc6dbfa465de29f2eb549e8040e6e9753febf7724381d17672415e8869b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725657, "uuid": "07374017-ddc2-4015-b89d-e12924941ef8", "value": "T1FD15AE4392E37D58FA258B729F1FCAE8770DF5608E497BA9A3189E1F04B1076C263315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725657, "uuid": "4fcdc2fb-49ed-425d-a8f7-03da49491f59", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725657, "uuid": "45372251-ddd8-4e20-b25c-c3bf1ef1cfa1", "value": "24576:4eV/XqD2yhs//qfP9gG/bAO5OxChDgLHL/:4eV/XQzhsnqflbbADxC1gLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725657, "uuid": "0c708010-b42b-4532-968c-928370baebe2", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725657, "uuid": "3b1437ee-c116-4ed3-8704-9410b6cc880d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725657, "uuid": "d19abf5a-6b43-4092-829a-29ec5e4455c3", "value": "f49a18de0928eccc60284a4540ccd38a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f130d90-4a76-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693758383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693758383, "uuid": "66fd0216-15d4-48cd-b7f9-b3d04799b471", "comment": "Malware payload", "value": "cfb273b2956c40dc77489e4ddb4fa244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693758383, "uuid": "09df7e9f-bfe9-43a8-8ad5-7c410852b5d1", "comment": "Malware payload", "value": "61514d792a0dff68436f3897149f8b9fdf1c256be8ec5f9e3e06a363af04bab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693758383, "uuid": "0998563e-5c29-409a-84b1-e621223e48e8", "comment": "Malware payload", "value": "240f2486d8063579b4f03522655b819f5b942a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693758383, "uuid": "43408eb6-7033-424e-ad5d-e9efbc3b1c40", "comment": "Malware payload", "value": "a2fd81cbef66da7078ae8a30236396b168288d962f51f0a185f254d4d450b8b01a6a99e622fd6557df6a4415ed41c156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693758383, "uuid": "4c502c20-55a5-4907-a9d3-9a2c8a498e1d", "value": "T1CD7633407315A8F9F686513DC89DCA5BDBB3388223A0D19B076887635F272AD0C7BB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693758383, "uuid": "b12a4666-91b3-4e6a-8456-b0de275f9c70", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693758383, "uuid": "023d0d5a-149c-4242-9290-45cfa2186940", "value": "196608:CxYmOshoKMuIkhVastRL5Di3tOul19Ja9LJg:sYmOshouIkPftRL54tlbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693758383, "uuid": "da9d277a-59d6-49e0-a226-48867ba0b412", "value": 7818162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693758383, "uuid": "4e317a93-8a6a-4f3c-b331-cde2ba4ff58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693758383, "uuid": "4d155e2b-6b4c-4468-a2c1-dc872a031d87", "value": "CHKDSK.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b86a3-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693750915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750915, "uuid": "675689d9-6264-41fb-ab50-58c539856a66", "comment": "Malware payload (Vidar)", "value": "3df92bffe0ff8442ad00a49d0fea25d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750915, "uuid": "7b48fcc4-57cd-458d-ab0d-3e2bb08e734a", "comment": "Malware payload (Vidar)", "value": "6266acee8097a9b26058353af101e33171a8455b49aea13a7bcb7c906c87d057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750915, "uuid": "8bd08389-5a6e-491a-8aed-bf9177815873", "comment": "Malware payload (Vidar)", "value": "a2ab6d582d846a89653e92e00c38dc66ab90db48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750915, "uuid": "59f1e145-6856-4bef-8427-0ac69c3d6179", "comment": "Malware payload (Vidar)", "value": "f860128ad6e9daf3e33ffd4a79b318452877d52b448db9b42e65c21f930b9dba6e5a44893044ce7ce1da7387814ae6c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750915, "uuid": "1b4b59b1-6898-47cf-a491-306b056a78d3", "value": "T10E05EFC3A5C4FC77C51503B68E2ED6FD3B2E78639D22AB5727542E5A19312B2EA03341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750915, "uuid": "eb8bb3ae-c809-442d-9fb8-0b945e29dfb0", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750915, "uuid": "a48ea586-a029-492e-b71b-4dc9780d5c59", "value": "24576:CsuJwpBRYHTYlsgouNwDnijOm+Dj4MSsF:CsISINgouNwbwOPj2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750915, "uuid": "c22f7c32-d160-4288-9410-ba204a5e29c4", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750915, "uuid": "6cf9a917-59a8-4e1f-a291-b1787a08abc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750915, "uuid": "37060147-9586-4790-9ab1-d72b3e00a87a", "value": "3df92bffe0ff8442ad00a49d0fea25d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5b4f22-4a59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693746006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746006, "uuid": "042ebcbe-ccd6-4ad8-925b-87cd7f4a5e4f", "comment": "Malware payload (Mirai)", "value": "74bfc3c7c9dd3f654c3d18f8891ac434", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746006, "uuid": "d7dc1d00-46a6-412c-a140-88c38150f78c", "comment": "Malware payload (Mirai)", "value": "676a87b17f6c83ca25bd8b459dc32440e4e67c39ed079326a5f35ce66f407936", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746006, "uuid": "b8555f1f-ca3f-4594-91b2-302f64c88d27", "comment": "Malware payload (Mirai)", "value": "d558e9465a55448f442fb13da372cc23ea46e25c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746006, "uuid": "2e5f912e-7fae-4e81-9669-362a7f3455b0", "comment": "Malware payload (Mirai)", "value": "e5bb5d25bab1ff0bc1586a4156a5e2eaf60d22411e80998050064e6dc2c31d14e869c34d97b5f50a4ebf9dce52179549", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746006, "uuid": "016712ab-4c86-4f35-a8c0-40b0f0ab7315", "value": "T11D33F1921F77BD91C1B34BFBFC32C811B1246AF8B59B346924747616B70392B0AE0686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746006, "uuid": "4860a300-9c2e-433c-8ea7-ccae211de5c0", "value": "1536:s9O/f382butan9Y09QYJr78LcPqF1aBexo4opKZb7:s9O/UCuta99QyALGqFUFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693746006, "uuid": "dfbe4d29-4a47-424e-bf78-aaa7383bf04b", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693746006, "uuid": "c546165f-b38a-41f5-ba50-d875933a41c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746006, "uuid": "16bf502c-40fc-42ce-9cb8-51507360b0fb", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc55c56-4a6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693754062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754062, "uuid": "8987ebed-2895-40dd-a3b6-f557e651205e", "comment": "Malware payload (XWorm)", "value": "b88cc7ba6a01daf0de338ee2c656864e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754062, "uuid": "8bad2ca6-16f1-420d-9460-1704a0fa747b", "comment": "Malware payload (XWorm)", "value": "67de54a5271a2354b492bbaf5bbead07cc1e24fd5efa94bdac2fc30f0475db1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754062, "uuid": "e483a297-8498-4093-88ce-02c76d8174ab", "comment": "Malware payload (XWorm)", "value": "5df77f6403f8b3c462c8dae3408f33d45b272b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754062, "uuid": "3496c16b-6586-41b9-935f-17bec5383e02", "comment": "Malware payload (XWorm)", "value": "1f71617b825ddc7ddc838691d1d30cf85f3e170b77467ec609e82a49a81e04feaf7f57363aa7e0ba284802b84acabae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754062, "uuid": "5d3b5065-21f9-49c9-8007-48c69bc3b8c9", "value": "T16A56AFFA94553327C7B0507A9F72497583A2D63C2CC4AECA698E70181D38F5FB9436E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754062, "uuid": "c45c92a7-f9c5-4df8-b2ac-b656727ea253", "value": "6f462fcc6b830b77fb3fef2add9dc570", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754062, "uuid": "777004d3-db27-4b85-a47e-770bba7d0cb3", "value": "98304:K+erVUYkek1Bqs4uzLw1Hf6QQd1LzMQmLNHDUHqvqJhRdOyY:urVsewBvHw1HyPd1LzMQ2DWqq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693754062, "uuid": "5a4d7db7-2d6f-43c4-b9f4-fc59d728ce49", "value": 6185472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693754062, "uuid": "95cd4bac-ba80-4097-b1e5-886327fc3a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754062, "uuid": "ea5dc963-599f-4dc4-920c-f07abcccc32d", "value": "b88cc7ba6a01daf0de338ee2c656864e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da50af0a-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725840, "uuid": "59d2e389-ecac-4006-add0-45a825f5262e", "comment": "Malware payload", "value": "b24543219b676da7c3472068502490e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725840, "uuid": "9ca7e9b2-aadd-4401-9ec0-b1baedbc7ef5", "comment": "Malware payload", "value": "6a0528eadc393b14e9ebeb35c951142126adc3cc84caaf7f139ccd58a3318923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725840, "uuid": "b21ccd8c-fe81-4968-844a-74c1ac86325b", "comment": "Malware payload", "value": "78b2ee87afc077c068b7995958ebb02ac728b316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725840, "uuid": "303e76e8-a772-4b87-86c4-0c805c6311bb", "comment": "Malware payload", "value": "9574951d7af94068353eea80580133a37734bdb8b4932290562654327040e7824d4f531c3ce39fe82c090b0ce1d16301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725840, "uuid": "cd3059b7-2ab1-4a4d-ae55-ad8fc8cfde7b", "value": "T11B56C08FCC5A3C39F9343A387691D3A7EA5503C63A7D0D600971F8552599CBA73B28E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725840, "uuid": "6d4be6cc-001e-43c7-aa65-3b05875a16f2", "value": "98304:8lzU1sSEauu0fQ6h0cn9Lr8SIBYHob4LR+6c7vdFjoRf9+:8Q9EVu0I6h00r8jBYHob4t+6c7vdFjoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725840, "uuid": "b4cf621c-41f2-48e6-8ed4-b1a7cbf456e3", "value": 6274802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725840, "uuid": "0fc60d82-b684-42f4-ae75-e9ce0740d0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725840, "uuid": "fad57383-c849-4184-a0bd-c9891569ee85", "value": "b24543219b676da7c3472068502490e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ab0888-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726364, "uuid": "b4e0d8fe-4c64-4143-844a-2bd1628bd0eb", "comment": "Malware payload", "value": "5f644b1a57c142849c05235abef4ec7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726364, "uuid": "327538d8-5efd-4299-8b7a-37e73ef41e7f", "comment": "Malware payload", "value": "6ab409720a6fed60d94574f0c49386818f287afcef37857c432ec41ffb169081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726364, "uuid": "dce49caa-68a4-47da-b00a-7c492eb66fa7", "comment": "Malware payload", "value": "f001860627e91e01630ecf52ced9bda34caac5af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726364, "uuid": "fe5d79f7-5787-4107-acbc-1a32e00ad906", "comment": "Malware payload", "value": "dab334ffc502876a2491b96c5ebc3aa842245fd3c8a259db11698c9d93eabe88cc80c4da873eb5f7dfba975a37ce0c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726364, "uuid": "dc1c97bc-93cb-455c-96de-974d8a141111", "value": "T1B725D7109701522ACCFB75FA4BAE703DB10CEAD01344A5C745C86AFEDBAA6F13D3549A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726364, "uuid": "ed395ec3-3f06-47c2-9381-831ae6c5bd6d", "value": "12288:Hh7yKwBpUVk1IvLlB9EUEurBuWdJsMLUWR24KVdR803KOK5OU7qOcnPWuZiA3nhV:HBcO19SWdwWRhpHqPPWuPnhMlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726364, "uuid": "5eff9211-af93-440a-b3b8-52f8e776727b", "value": 979660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726364, "uuid": "884b5a8c-8891-4c7d-a185-d22ed9847566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726364, "uuid": "cbe9ca79-8c15-4c6a-af2b-5bf79d16a828", "value": "5f644b1a57c142849c05235abef4ec7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e54bbc-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714884, "uuid": "148fde28-b7d7-4bb9-be3b-02ab93880051", "comment": "Malware payload (Mirai)", "value": "4adccecb06296fbd747eb0b3144eb7b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714884, "uuid": "2f5fa144-9bfa-45b0-be8e-b39705e62c5d", "comment": "Malware payload (Mirai)", "value": "6cd9830b5315314d9ab077bf275cc8ca43371bc1a7e3a38109e77a41ea5134af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714884, "uuid": "8904daa6-b0ef-4d45-9eaa-7393994d851d", "comment": "Malware payload (Mirai)", "value": "3336acedb6d9fab0c655350ef626a40d9514a6b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714884, "uuid": "5772273f-fd67-4db9-b046-b13864487e01", "comment": "Malware payload (Mirai)", "value": "71ece16681fb696b19a8b004ce8588c94ba3ba86434a0ddb969d18fc920d901051ad89afb2502d9a4c8807c993518b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714884, "uuid": "f59f56f8-c495-402a-b409-4b87cff9fe7e", "value": "T18173820AAF650FF7EC6FDC378AE91B45248D641A21993B797D34D818B24B24F49E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714884, "uuid": "e727fea8-abc0-4eb5-842b-90b7c0551ee4", "value": "1536:pkTyl+ONe2FC5RcIghmb5QhcDuPSwtugXB:p0yl+ONeqCLghOIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714884, "uuid": "8197daa6-120a-45fc-8318-cd1a9a56e012", "value": 79852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714884, "uuid": "4b39fd9e-2206-4e89-88af-b68bebdf0cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714884, "uuid": "ce242ccf-42ad-47c0-8523-dca91fd9820b", "value": "4adccecb06296fbd747eb0b3144eb7b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0632a5c2-4a04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693709163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709163, "uuid": "de889275-6999-46ec-8aa2-8af0efc4bd43", "comment": "Malware payload (RedLineStealer)", "value": "a0bb1fc6903559dc1efd418e4c87a65b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709163, "uuid": "5af79452-2dfa-42cb-af4c-711e5cc0357e", "comment": "Malware payload (RedLineStealer)", "value": "6d42eed9436bdd4acb6f12e0a11c74ce4312b80afc9ecf905c204d14787fd1ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709163, "uuid": "cbf54c4e-9be4-4fcf-af91-37a4edffcbe1", "comment": "Malware payload (RedLineStealer)", "value": "b846167f711d34e5620297e98da3936bc336cdab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709163, "uuid": "9df37a45-f28c-4fbf-9f00-53b4b68c1861", "comment": "Malware payload (RedLineStealer)", "value": "8dc272ebc466a77801dd650cd8178e68d5050fe8b8bca159aaab46a69ce045abbb0d385cbfc42f531fee013d6ffe1f33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709163, "uuid": "429828d9-41d0-42f0-8b99-387e3a2862d7", "value": "T131152343F7C490B7E8B027B448FB46930E7679918C784B9A2F04A96A4DF158AB934376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709163, "uuid": "715fa85e-3a9a-478d-bb34-d71810b268f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709163, "uuid": "d77895f9-ecb4-4ce6-baf3-ec73c2145780", "value": "24576:qyKEmvwH59SEQ2+gV0L+ZNSOxNSrTCuIzzD31Yl:xPmoHNQ2V0L+ZNLKCPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693709163, "uuid": "e5d61d7c-178f-48c8-bf17-94a1fb51d13d", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693709163, "uuid": "643de621-29d8-4a22-929e-21ff9840f8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709163, "uuid": "45324918-0096-448d-9da8-f27d197c1f4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d78b801-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726087, "uuid": "e85737cf-8e83-4e40-98e5-16cd0e70a3d8", "comment": "Malware payload (Mirai)", "value": "9b9f5b128cbb472d98d18e8d34f4ceca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726087, "uuid": "c2de5b9f-0bd4-4461-b90b-0f2a681de2fc", "comment": "Malware payload (Mirai)", "value": "6f623ca995fd36628e781930ce8d97a068d4ce844e51be843d47fd323a154b16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726087, "uuid": "fbdbcc4d-0343-4d53-ae7a-2f36ac3eca78", "comment": "Malware payload (Mirai)", "value": "9bd18a1ef4f53db78fcd4f557604e2dcaf000568", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726087, "uuid": "1788e9f8-f9d5-4ec7-8fca-4f95382a1dd3", "comment": "Malware payload (Mirai)", "value": "fed739f36d2776515f47346233c46889197e17a12f546f3f3eb1f4a1e94a479d5019b18d8de89b5624afceaa5966a83b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726087, "uuid": "823c691a-9e3b-4f99-99fe-291a651b90ab", "value": "T129332A91BD819A13C6D4127BFB5E028C372663ACE2EF72079D266F11378686F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726087, "uuid": "71ed817a-5ee9-4550-b6bd-08dc0e276f8b", "value": "768:zcmIE+zuKBAi6Vd2SEQHdy3CyLonx+WQjZ/N+fmvVMOgOiAF5d9glys1PvH5I:DI7zgi0ztOCyLonwN8DO6ud9gEsRH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726087, "uuid": "14482dbe-4501-4d1b-b940-0a275f35326c", "value": 54792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726087, "uuid": "c95bd7e3-9fe0-4377-9c39-4b98a1f067d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726087, "uuid": "26b68793-6c0e-48d1-b198-78ce995bf45f", "value": "9b9f5b128cbb472d98d18e8d34f4ceca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbead3e5-49ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693707348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707348, "uuid": "9156e1aa-14aa-45a9-a40a-67a11af50119", "comment": "Malware payload (Smoke Loader)", "value": "b70c787252598615d35e2e1e0916272c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707348, "uuid": "b8942588-553e-424e-a2d9-417811a2c67f", "comment": "Malware payload (Smoke Loader)", "value": "70856a13672513d4828d2ca74d2f27d4c6239908e8aa303e1ef9536f6e113fcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707348, "uuid": "6bbc940b-d471-49c2-a4b0-aab43544170a", "comment": "Malware payload (Smoke Loader)", "value": "6a7f27cfabdf0d389b167ec168e096039e788865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693707348, "uuid": "18cb9e48-4ee2-4c84-917d-1b6f3ea9a35d", "comment": "Malware payload (Smoke Loader)", "value": "69c3aff4b16e2d5d6accbb8c81858beb28685aae19ddb5d731a6cd7151e985878af5947547dd3e0f866e711c8a5ebe46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707348, "uuid": "103355fd-3733-475c-aec3-d36d9a084910", "value": "T1B1547AD361D1BC7ED52643718F1EC2EC7B2EB8604E29AB5627446E2B19311B2DADF301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707348, "uuid": "fa91ad84-8350-4cd0-a381-7d7dc1e02a9f", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707348, "uuid": "5992a0b2-0ec7-456e-b987-0e3f3e9cea18", "value": "3072:2aYCH7NyBaTnsrxIWFisHCNYj4lBcdKECwA5Lfr0Fjymx:ZYC+abOksHCNYjhKECfGjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693707348, "uuid": "6d22c403-e8b6-4f02-b3e8-4a69eff150f9", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693707348, "uuid": "7f82c29b-305e-4b88-a2e5-7e23962060c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693707348, "uuid": "82431918-95d3-4818-a3f1-d5593ba0006c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0517e808-49fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693705726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705726, "uuid": "1c3e8198-7ca4-4f7c-bdd1-a23eeb26d8c0", "comment": "Malware payload (Mirai)", "value": "34d04a8e78a51848269b203e90f32b64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705726, "uuid": "8889be45-eac1-4f3a-aaa9-e4d21403d5f5", "comment": "Malware payload (Mirai)", "value": "71343b16bb625ba25d6648c216014e138f40b5714239d34737871ede3af34245", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705726, "uuid": "18ef85b6-34eb-483b-97c6-402050c93f63", "comment": "Malware payload (Mirai)", "value": "b6966ae69f65036acf40ed8ed88fb60cdd5f81be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705726, "uuid": "a7549622-168b-4426-b5f5-6a090dd3c334", "comment": "Malware payload (Mirai)", "value": "2f4484f6c6c8cebc76f6d19ae06643470a02fbe7951444ecc026fffd58dcdc9c54d0d865f849d53b64de21e605c20a2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705726, "uuid": "480cd9a3-9d9f-4d4d-8b6d-cf0da4773d0f", "value": "T1D7E318D7F800DEFAF80AE33B48530805B130BBA245925B372257796BED3A1D91577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705726, "uuid": "67ee109c-7bb9-44c8-8426-069cf5d92b8e", "value": "3072:1nMaw04SjLGpfLXY8DxAY/nGy3Vrjbi5LNqkCIy6exME:pMWQ7R1AMGygLNq2y6eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693705726, "uuid": "7b6442d5-28a5-4b2f-a78f-c8a297c1520e", "value": 143744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693705726, "uuid": "be16e3f0-a3a6-40a3-b50e-a80f601932ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705726, "uuid": "c326b9a0-1d7e-454d-b84c-d76e855ba663", "value": "34d04a8e78a51848269b203e90f32b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9537474a-4a32-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Joker)", "timestamp": 1693729160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729160, "uuid": "13b55978-af49-48e6-9e16-d089db7205fe", "comment": "Malware payload (Joker)", "value": "b70df52b2a6d09f7278645f5d07e8e08", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729160, "uuid": "cff125e7-0156-408d-9267-9b363d889575", "comment": "Malware payload (Joker)", "value": "7154cdcb125d36309ab8930c9fb1d12920f954ec897271c3c5b35aa9e3e980e7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729160, "uuid": "90a58115-7d40-46be-a87e-f0ecaf0ce7e9", "comment": "Malware payload (Joker)", "value": "a0dbb365d081561cf376e8513ac9156e4fd7fcd7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729160, "uuid": "8615a582-8432-4e71-bee4-fb499907ceb0", "comment": "Malware payload (Joker)", "value": "f216d713268b4ee5bfa55f6fd5683b415e9a2fcf70533915647ce9f01c29d8e2640ce3a508910d3b2016271f6dc9473b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729160, "uuid": "71bb718d-0584-4a89-b8a9-a6b5363114e7", "value": "T156561116C31DA82FCC7350326AA8106245528DD96992FB637F04B30E7EF7E958B49FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729160, "uuid": "158327b2-11ed-495b-80f3-e2226c67d3bc", "value": "98304:cIkUcb8m7NLi88rNfnSbUpdSRxyiDC86Vb4Qjw/DWa80as+eWfH/pMzfpeZVPFEf:qHgm7N+8yNfnSbAGvsKm885deEfpMdY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693729160, "uuid": "8eb524ac-b9e9-4447-a687-f3b049a935fe", "value": 5913367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693729160, "uuid": "12f2854d-517d-47c7-a088-107b6d568a89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729160, "uuid": "3a23fadf-fd0c-4208-a7ae-9fb2b5ec9822", "value": "7154CDCB125D36309AB8930C9FB1D12920F954EC897271C3C5B35AA9E3E980E7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c625bf-4a35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693730607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730607, "uuid": "d3dc3181-0f8f-465b-a057-d8899108f3fb", "comment": "Malware payload (Amadey)", "value": "b84b44c2bea03ec14ffa48509c522e94", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730607, "uuid": "6f7295f6-3db8-446c-a3e4-f75788135e83", "comment": "Malware payload (Amadey)", "value": "716263dc7987ed6d0e62821c91a0b0fa5bb731587b78cbde287031df0c53e59f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730607, "uuid": "a9c2795b-92d3-48ce-a13d-dea4d1e7a34e", "comment": "Malware payload (Amadey)", "value": "8479600704f4444f5e9fc725ba48d4cbd13414da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730607, "uuid": "93640ac7-4849-457d-98d1-4e30a3077362", "comment": "Malware payload (Amadey)", "value": "276114f6db382140140979fe602d9bdf5b39feedbd0907b8488cbc2c6c709bfdaa27705640bdeb922ada12ab37f94dd6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730607, "uuid": "ca5f3a14-4916-4d60-aec4-a4826651fe35", "value": "T1C11523D2ABC87177C8B127704EFA469317353C929C7A4363279A986E1EB2280D573737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730607, "uuid": "6072c246-ad0a-4746-b6d7-5bbbcc62cc6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730607, "uuid": "174d9c10-a717-4e0d-a515-d0ab19db73ee", "value": "24576:PyoSNjkp5aNy0hCxXW4bLdtEN0IHhL1yHOTvWS7/2:axNYzaNDWbhoj91yHOTeS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693730607, "uuid": "545a7bcd-7c1d-421b-9db9-121de11f8291", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693730607, "uuid": "f9025d96-a0c0-4182-a65a-db87e5fff49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730607, "uuid": "1ccd7de4-6147-4835-ba94-0f03869d8028", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14be260d-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770606, "uuid": "a2c940e3-4bd4-4b7f-9fb2-11e893aa1624", "comment": "Malware payload (Mirai)", "value": "75351784c9ffb24261f3d3a62ddf7ee1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770606, "uuid": "1136ffbe-7eb8-4f89-8ab2-f01a939ac05a", "comment": "Malware payload (Mirai)", "value": "725dbc4ebe212484a9a837fc2b9706ea36ec7049295f8a2a019685e5c2a4654b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770606, "uuid": "d7685286-b3d2-45db-9837-52b4eac99062", "comment": "Malware payload (Mirai)", "value": "40b7a66a03f7616ea49d80921f5bbc20cb36b007", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770606, "uuid": "d41c4c21-aa20-48a4-b14e-b0c61511efdf", "comment": "Malware payload (Mirai)", "value": "c81fbff093e30bd9a74cd783ed547631163d38bdcd54e5a3a3d3905d1b43d5e3ad21311832526df5ad3ca9858a8b801a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770606, "uuid": "aad38779-2ff4-458c-b819-006693dbcf69", "value": "T17CE2E114429BA8D0F7B14476DE3D8188A7A3A5A8E0F73B73281443DF359A998D4702D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770606, "uuid": "c29b1f92-3cfc-485b-b0de-a625f10bf312", "value": "768:aqVS15xtHitEMKWWTzwD+P5X3u/WTP/TrSc3La2s3Uozt:45xtHitpuIKPdZTHSNbzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770606, "uuid": "51b5ae89-0406-46d0-adde-9fcad7678127", "value": 31500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770606, "uuid": "8bdf4ce6-409b-42fe-b395-d94601d0bd2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770606, "uuid": "9ca443a0-0eb7-4e80-9288-a01f9aa1ac55", "value": "dark.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e91bb4a-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726143, "uuid": "df5567a4-b146-4f9d-8b3c-573829e9c8b3", "comment": "Malware payload (Vidar)", "value": "0e4d3432ecd66da104c75ef3d180226e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726143, "uuid": "21d7f504-f62f-4127-b943-ff2971f07f76", "comment": "Malware payload (Vidar)", "value": "740f93a6369b2d97604f632de77b98a5af94bdda56296689545ea1a0b13a42e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726143, "uuid": "8214c009-343f-4726-aee4-733aff81e3d8", "comment": "Malware payload (Vidar)", "value": "e444d25a0563b8bcfe4c83f11912856aad14e31e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726143, "uuid": "e7b949b0-0c1d-4485-be2e-5419e870c553", "comment": "Malware payload (Vidar)", "value": "0e5d9875e77a8f9db7dfe9f835d1d5f15b9c399954b53eb2866c5407a7bdfd52974b1e2b60fe4a7745944bd7868a920f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726143, "uuid": "999e054b-f997-49f3-b5fc-c87db06e7d66", "value": "T10315AE43C3E17D59EA258B729F1FCAEC7F1DF9618E097BA522189E2B04B1176C263701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726143, "uuid": "2c495070-9858-4045-a1df-f67ebf148fc6", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726143, "uuid": "fb7628c5-db56-45ae-b59f-8806b49ddd48", "value": "12288:X6/Kyv7RoL972IU9XplOLc+J3a7JeyE/m8+RZ33ULq6EYXog4XtkPXNqt/tW4Pgv:X6Cyv1oL9ylWgHC8ReLTmk/sVgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726143, "uuid": "77bd40bc-5fbc-4487-ab7d-52af46238cb7", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726143, "uuid": "77ba3992-a78a-4b59-bdd5-1322b2d34f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726143, "uuid": "f6feafb8-2483-4ce4-b620-a5ad5711f7c3", "value": "0e4d3432ecd66da104c75ef3d180226e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9094c18c-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725716, "uuid": "83d507d6-23be-4856-9613-8bf2176a172b", "comment": "Malware payload (Vidar)", "value": "e20fca5788d52e00e56ae321f13caae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725716, "uuid": "c9d94184-866a-4f6e-ad22-72328c4a0831", "comment": "Malware payload (Vidar)", "value": "74b56d46ad3be564eaebbe5106e12da96b4ede56fc4b0483b1fcec1fbbace37d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725716, "uuid": "cf5d77a3-21c2-4175-9367-d70884d75d95", "comment": "Malware payload (Vidar)", "value": "241768cae53f48201dc50ab69118f3ae634308f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725716, "uuid": "381212b6-d54d-4024-a7cf-869d6127a1ed", "comment": "Malware payload (Vidar)", "value": "9e51cdb684b2f42de513bc403f8cf3720411a486fe181a73c6d9bd0b342be30b4a163c874587752a2a1a7dd8e5dcaf5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725716, "uuid": "42ed2200-6177-4bc0-81fa-e0482b7bc252", "value": "T115A4074393E17D58EA258B739F1FC6EC770DF6608E097BA922189E2F04B1176C263716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725716, "uuid": "989682d1-9474-469d-963d-0e8f97d523b5", "value": "e4dac514b3073faa484764761e4ff894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725716, "uuid": "2b3f7032-a73d-4802-8c3d-eeb6be1059c5", "value": "6144:IZVqOSrVXbfi2yQCba1Zg+FjsRfyiEhrgLUebH/:IvqZrVraE5LgumogLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725716, "uuid": "3fed6e62-f49f-4a55-b04e-9711fa8b4c42", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725716, "uuid": "0144c75f-3a8a-4937-86e8-7bb5cdd6e3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725716, "uuid": "99f448cb-c400-4bc3-8139-fb6915894bbd", "value": "e20fca5788d52e00e56ae321f13caae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b243f7-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725866, "uuid": "c8e30c9d-98de-4753-9aa3-f11c06d35d4a", "comment": "Malware payload", "value": "786983db0145af2d9145bf707d981ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725866, "uuid": "56ef55e5-e49f-4e1d-948b-fb310ee21947", "comment": "Malware payload", "value": "74fc336733b5f71b312ba008f2782cec9e795cd77ad50f3f573197eee872fd7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725866, "uuid": "64bdb24f-ac65-498a-97f3-150b86b6bc76", "comment": "Malware payload", "value": "abd7eff8d3740092d784b876690c189cb591f2b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725866, "uuid": "f02a8fc9-2f69-453c-b95b-1c852e25ac41", "comment": "Malware payload", "value": "0317a36c13936f50b0c68144acf44fffcedd7800e6b31f34eb6d400b97805d845844490197ef9d77b906ac6fe40ef30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725866, "uuid": "0cca0ee6-6bfb-40b7-815a-9ff7bedfb1cf", "value": "T1EF16335BE2E309E2C3239FF698C74E8F94729C6AA5C70D70C1F546B41255C25A38FA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725866, "uuid": "376b3a4a-f7c9-413d-ba7d-c6411d7e57b4", "value": "98304:t21synSUQ64l1aYtf8SHfE6CSpFuAL/7jDuBjMDfFowF7v:9yn9Q6Qfx86hAq7jDNhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725866, "uuid": "3111d131-29fd-481b-beff-eb3d066e276a", "value": 4188861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725866, "uuid": "c88239ec-dd4b-4054-bc85-d715e388978b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725866, "uuid": "0f1c42c6-db3d-4985-9a29-30ac1d6ab777", "value": "786983db0145af2d9145bf707d981ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f60384-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725890, "uuid": "f8387f2a-6ad8-48c2-8d73-1f642137f000", "comment": "Malware payload (Vidar)", "value": "f5b2e78bc94f9107cf558169cd862bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725890, "uuid": "d0237fa2-d7a9-48db-949c-2ae1f6cb63e2", "comment": "Malware payload (Vidar)", "value": "758fbf8abfb85042aa7bbe6195b5b47f2fbc3c047e261067c776f6d2ec059f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725890, "uuid": "12057ad7-9d5a-464e-9ae7-73f353bbb91c", "comment": "Malware payload (Vidar)", "value": "004a95a726ae5d424f236e3b2b6ee7aa8813ee1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725890, "uuid": "4344c28f-c0bf-45a5-af19-6eb9c0f028bd", "comment": "Malware payload (Vidar)", "value": "97936b3b15ac667b38df85209a4b34c3b93433a0b5785302de4cc6cd0ceeefb02834ccb96f355ed83908414a2f1d707f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725890, "uuid": "97ed8475-9c7f-4207-8727-98fb26e7593b", "value": "T15D15AD8382E17D79EB258B728F1FC6F8760DF660CE097B6922289E1F04B1176D263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725890, "uuid": "4942fb06-60d4-4d80-b436-36dcea7ba670", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725890, "uuid": "c396047c-7ae8-4474-88bc-0f0d26b589b1", "value": "12288:mEQavVef8LdwxqbV8R+AOGMblJxSXJ0S2vEJzD2+mjFThpgLUeL/:mD+ekaxqB8RcGUsJRjz6dnpgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725890, "uuid": "646e9526-cbbc-401d-8c19-905890a24b11", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725890, "uuid": "ba861658-5de1-46a1-a01e-1672e5184999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725890, "uuid": "c2c782de-d79d-4058-93ff-b12216a83b7c", "value": "f5b2e78bc94f9107cf558169cd862bc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd4c29e-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748559, "uuid": "f270621f-e500-4411-b547-26ee929514ab", "comment": "Malware payload (Mirai)", "value": "e0d90dea1005eb3454c7265c226cc561", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748559, "uuid": "100f01b9-fdb5-49ed-b1ec-578a9cbd16a4", "comment": "Malware payload (Mirai)", "value": "759aac574e2d79401ce6d3271f48a28995fcb63138ec6e6a498d28e1e5234f93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748559, "uuid": "c52f65da-0c0d-4385-bd15-cdcd58392a8a", "comment": "Malware payload (Mirai)", "value": "bf17daaec5d2cc404b067f596ca9a76a84e79b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748559, "uuid": "26aa7125-0e55-4f08-9100-2a8c6b74502b", "comment": "Malware payload (Mirai)", "value": "6330cbc81c7f5200ea2d547cc3d110a05c952aeb0722bc5e07f847bad98115cc73d0b39e6f8cd8b6c516477c5a976e28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748559, "uuid": "db0f7b56-47bc-437a-8105-9431c2942442", "value": "T123D2C08DD2C27909CB9D557C51CC26243D8531C1330ECD9E2717A88A32BDB9BEC6E5B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748559, "uuid": "b911e08f-29dd-4863-816a-5b3f576d9f58", "value": "768:c1uUtLrVDsAp6tLGgxww1rGvjHc9adtjSur8czKJbkWUQ:cbDs06ttxwDvj89adtOFdIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748559, "uuid": "5582bda8-ebff-41d6-862e-56249123ca8a", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748559, "uuid": "5aff5409-47f0-4fd4-9e95-f1a15e1814c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748559, "uuid": "d1df78b4-2f23-4c50-abcc-59ffd5d10eda", "value": "e0d90dea1005eb3454c7265c226cc561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c03976-4a6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693754721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754721, "uuid": "0f2f782e-b892-4701-b9f6-607bd2d9611e", "comment": "Malware payload (njrat)", "value": "680bc11fac237b688cb893945ef765df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754721, "uuid": "1fb248fa-9b06-4c12-bbcc-e2e75d96e24b", "comment": "Malware payload (njrat)", "value": "76359f511ee2f456f22b294a03afb18910ba8d61ccd09e8a37a2e5dd996ee760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754721, "uuid": "bbb25ed0-fa62-438e-9c2c-7d16e241fb81", "comment": "Malware payload (njrat)", "value": "d516382f4941f11f70fd321cc98e1ac3c712df9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754721, "uuid": "1a60c7c4-4c78-4e78-a204-fe44d5e79d43", "comment": "Malware payload (njrat)", "value": "2c651fd08494c845971646f907f809e9ea11fc3d9743811206c1073502ea6b8cd327b081689c1ec8dae530bcee70d771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754721, "uuid": "7db7a243-a127-4cb1-9bf5-11fd88363aa7", "value": "T13413E78CB694E174D5FF8BF1B4A2B2890B71A017A806930FD9F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754721, "uuid": "e4cc5419-7e78-4ab1-a5dc-cfd6e5a0a456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754721, "uuid": "54c9865f-dcda-4371-9edb-f462af9c74de", "value": "384:OZyK6NUst+3gUy6tZFIEEEoHjtJEzQIij+ZsNO3PlpJKkkjh/TzF7pWnq/greT0k:0qwQh6PFtkjGuXQ/oz3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693754721, "uuid": "04c31ccf-a6ff-4f59-9e02-f6c30286a0cb", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693754721, "uuid": "c9515b5e-4b19-4c3d-8b05-01f7caab14ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754721, "uuid": "2c82f594-dc10-4c35-b1e1-de1ea25f57b3", "value": "76359F511EE2F456F22B294A03AFB18910BA8D61CCD09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f2d78b-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770605, "uuid": "f29834d8-373a-44ad-a0fa-f23ab7659233", "comment": "Malware payload (Mirai)", "value": "9a282b6133e3ac74b111a645eb642f1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770605, "uuid": "79b963c5-79b5-4755-b854-02383dfcf519", "comment": "Malware payload (Mirai)", "value": "7642d5e5f20af149b4d24fda92c899e820f9900067a8951b84c17938284173d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770605, "uuid": "d50c52a5-4ffa-4e31-94df-5d19be771d65", "comment": "Malware payload (Mirai)", "value": "b089b9eb13f92939bfae44a430473e8fd37aaef7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770605, "uuid": "976fefcf-1e5b-4310-b414-45d11402709e", "comment": "Malware payload (Mirai)", "value": "7d36a24b1ff9d0f458e4bc2f3902fd3050a4709a8d92d28bec14690be8b988d667162052e2114ab845bb493d5e2c5f20", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770605, "uuid": "d9a94b73-190e-4729-9de1-b526f4f95070", "value": "T1E043F2124309397BF5B72475E6B9C286A819C73C8B7D2E2A1340E42C9FC33851EF5789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770605, "uuid": "72a73208-a714-4fee-b863-059d8ec5b7ec", "value": "768:85IH+xFkIYLqPv8LER6FlUElIzPcLOUW27to9q3UELU3GaqyWS4Mq8qpygv2:wewFpYLkvRklUEEBwtRLUtqe54P2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770605, "uuid": "4857d9f3-fd55-4c5e-8b87-89b178ebca07", "value": 55392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770605, "uuid": "50f31c38-23bd-49bf-b584-fe8320e09a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770605, "uuid": "cf80c4ee-07e4-46ef-90c0-7d5ffc2c7160", "value": "dark.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f646a0f8-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720304, "uuid": "7ba0e58a-8f7f-4fbc-b1b2-4ca88d767dc9", "comment": "Malware payload (Mirai)", "value": "ba9d1720ee9099109bafac2ba43b85d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720304, "uuid": "d4598b1a-b7aa-43d6-8f6d-2561ec41fd6b", "comment": "Malware payload (Mirai)", "value": "76fe5b40ddad5e32c579d179ec09c508365f6016835dbbe9272ecd8038ed8af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720304, "uuid": "4c541c5d-7dcb-479c-a625-bde4032fdcc9", "comment": "Malware payload (Mirai)", "value": "440da058b2e120642b64e0e4004c3f742f8b3989", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720304, "uuid": "b7d9219d-5afa-4835-82fb-9a36dda5aa16", "comment": "Malware payload (Mirai)", "value": "15fc3bb4da649013c2833896afe89dc198f4e242261f4fa566a36affb62341ed9c5c31e9cb02e003b3d179b4c8746b8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720304, "uuid": "1dc13957-9453-4efb-8843-79783ebccfe1", "value": "T14BE2E02172B62EB5C2715C388426CA48671207F0AD9EB24B35FE89187CD3553A7F50E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720304, "uuid": "e105b6ef-39ab-4387-b1b7-3cf808fb03ee", "value": "768:8EP0ibs+J3cFmMroYMhjAhsa4+oD+Yih9q3UELtH:LP0iQ03kmM8YMdAhsKavLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720304, "uuid": "21fb132b-0bd5-434e-b74f-82bfd5bdb8d6", "value": 31256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720304, "uuid": "a2f4219b-4d7f-4b6d-a5ec-e551885aec00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720304, "uuid": "34e46e70-7163-499e-9b29-88f9663143f9", "value": "ba9d1720ee9099109bafac2ba43b85d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccf2cfc-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693750836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750836, "uuid": "7952ccb1-0564-4d92-8a45-97407a7e7f88", "comment": "Malware payload", "value": "d3457cfb99ec4b92e018fc215eec78d6", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750836, "uuid": "9dc3de31-3425-418f-b293-2dd0211c3cbc", "comment": "Malware payload", "value": "778e84fab456349fe5c466c16c931446fe3e7b2c76fd89d3a3372f9b75eaa5a1", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750836, "uuid": "4a89656f-019d-4511-ae4c-84b2961b9f77", "comment": "Malware payload", "value": "d54d555220ceee449bb1735cd269d6ef38720949", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750836, "uuid": "65ca1cb5-6360-43aa-8d74-c14f567c6fe0", "comment": "Malware payload", "value": "f6d5fbc2b53e1d02b11115a6ce03b10c876e095bbf96066a29e27f65515e70cb68be253c9e68ff36c6e8b3138873d4b5", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750836, "uuid": "fabde5f8-54cc-4e96-913e-ca6ba2f1f513", "value": "T134050113A808DBC3D11983F97E537AEE1E0D7F29A5C179EB19527F4B3935A73085A00A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750836, "uuid": "9144335d-3a99-4b21-bc54-42ed4b2f0259", "value": "24576:cWQmmav30xJZy/w6V06NCsREWn4bXXvbiksrYpU1Uzw:xQmmQ30Br6VFg247fbJZUms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750836, "uuid": "c5075cfa-7d10-4270-92bd-53a6861ce674", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750836, "uuid": "0685e171-8f1a-48c1-9245-40cd1f74d133", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750836, "uuid": "a2f01ba3-17bd-44b1-8f61-b960c8be376f", "value": "ORDER 64534.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399878bf-4a94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693771097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771097, "uuid": "3610b9ac-fb9c-43a2-949b-60450a4b2b30", "comment": "Malware payload", "value": "206735f363500d793c4890de38954dd0", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771097, "uuid": "e7f659aa-44c1-4b45-beb8-e51ebbe03b7f", "comment": "Malware payload", "value": "783582684fab931051f33d2c5bf938c78b284af76b373f069ba67ac6da43f598", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771097, "uuid": "80f4ffe3-c752-4b59-9cf1-7cbfc97729c2", "comment": "Malware payload", "value": "2d7b9b398a31f7ad85910daed29010246d92be75", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771097, "uuid": "0f0fc203-8862-421c-81da-5219265f17bb", "comment": "Malware payload", "value": "c0031c275fc42b0f75a08a4126e2fa2bca7ca7d5af4fd1219ce7681aa49c5467ec31d304bf5579ea60d5bc50417d27d9", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771097, "uuid": "ea7575f4-3c08-4725-8615-d8f485e49469", "value": "T1A5D6333EE61324C9D82751FF2D8D0F0B347557E82DA62A3C7D8834CAB2C9E1976A7950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771097, "uuid": "7f50eb19-e3d9-4a2a-b8a8-0d20c3373543", "value": "196608:iq01cSm9tUnPORSlBeYQprzbHpDR0GYivxJyZUAvUuRw5W6v0FHnMs:701cSutEFlBgzHpHTAvUuW5pcFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693771097, "uuid": "0a7c18c8-fed2-4aea-84c5-8ed22a1f761c", "value": 13675525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693771097, "uuid": "f490aa9e-7ed4-4624-880a-38759ed17079", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771097, "uuid": "62dd942e-4b9c-47e6-873e-7932ec4442af", "value": "get_started(unique(silentupd)en-local.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbe940d-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693725495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725495, "uuid": "b73bc6fb-ff72-4b10-8519-d38e16d818ce", "comment": "Malware payload (AveMariaRAT)", "value": "022c934e661b41a2bb3067e9960be8d1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725495, "uuid": "9e7e21a4-704c-4e3e-95e2-2823e5d0edde", "comment": "Malware payload (AveMariaRAT)", "value": "78a659fa3482012eab333ab52b550f58cb7e2d8f72d5023bfe6a2564413a9696", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725495, "uuid": "43630e3e-2d48-49be-ac09-8c53c3c68a93", "comment": "Malware payload (AveMariaRAT)", "value": "b70125a47dbcc6f0bb623fdd0d3ffacd838dc7a1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725495, "uuid": "e8e860cc-aab9-4b56-aa16-952000df7174", "comment": "Malware payload (AveMariaRAT)", "value": "bf11c5767895bfff9a73dcf4016bc8e9f876ae3b167f112e309b30838851e732a238d5817df4c5ff62c1ba30b55c835e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725495, "uuid": "3307d08f-bd85-407f-b789-56200cd6f6fc", "value": "T1DF45E05372345172DD44DB75C5F68E1182ABEE9D67E2D20A24C9B36E17323BE8F03982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725495, "uuid": "a9d91a9c-4b55-4ac1-89ac-9456c43241f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725495, "uuid": "7a4ba47b-e109-4570-b367-21d8851a2700", "value": "24576:rvZ5Y9VBJEvpJU0BLULpIdZX/SioWA2ERSi:jZ5Y9DGhJUpLovSe2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725495, "uuid": "b1fdfdd7-5c28-4726-a954-68993ece2d14", "value": 1204408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725495, "uuid": "e3c3dd73-04e8-486c-89ec-6411b85d55dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725495, "uuid": "411d8903-be34-46fc-bdab-ba7aba10e7d4", "value": "QUOTATION_SEPT7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3545e9-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720203, "uuid": "27aad2d6-6900-449a-9749-cdb0fd6bdaed", "comment": "Malware payload (Mirai)", "value": "fb4bda5e61db5ce68d23371de5cbd417", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720203, "uuid": "751a1c10-8f3e-493e-804c-57d76d447e21", "comment": "Malware payload (Mirai)", "value": "7936ed4aa535e96373c52ab9e783e8985aed6c237e7ca6c8992921f0b24e84fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720203, "uuid": "aa7b92f4-8b21-438a-bb4c-3ac5853c7ba6", "comment": "Malware payload (Mirai)", "value": "42cd0798e7ab48c31a1cad5c4e28b9651e86128a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720203, "uuid": "3474bcb2-5bca-49b9-8724-49761c0c78a8", "comment": "Malware payload (Mirai)", "value": "ba2a13e3d427a7349e3d1c6968e37d4dd1c0995e8d8af2bbac5f0ae912c7e0f2a2f44142f3541aaa7bf6a06dc8e89952", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720203, "uuid": "fcdb402c-0c7e-473f-9ad1-5a07ff3fe4f1", "value": "T1EA330279936218EBCBA54C326830450518E6793B53F27AEB3B5D8ACCFEC655433D109B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720203, "uuid": "a8349aa1-2ec5-4381-9e70-8b1e0d9dbd33", "value": "1536:wKEndpp7jZpvd2BkTlaF2wN3LbJZPud4J:w9jpZ3YbwE3LbJca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720203, "uuid": "c8ef0606-c10e-4d98-9577-ae6562e6b738", "value": 50848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720203, "uuid": "d4d23047-0c16-4ed1-91f5-a8f953cd421a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720203, "uuid": "812d6a08-6c29-44d9-8319-2860d15443ad", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00797ee6-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726334, "uuid": "5c65c31d-1b1e-4d53-892a-0c8cce4904f9", "comment": "Malware payload (Vidar)", "value": "c779b3903c2028975d1b798a876ec4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726334, "uuid": "8d73c14d-9646-4f00-9665-40215f497adc", "comment": "Malware payload (Vidar)", "value": "7fac74989ed4d6fff2175833ab052cead63b4279dd9ede3de5d6a3d4e675f531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726334, "uuid": "83229a79-e56b-4e02-9a80-16864d2064dc", "comment": "Malware payload (Vidar)", "value": "bdefc646625de3e15a21954940db2b400af363c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726334, "uuid": "7e76a185-211b-47f7-ada7-37d63fb700d7", "comment": "Malware payload (Vidar)", "value": "a600adcddbec24d8ffe5e4111dcbd48138bc60ba43fcab367ffeb7732af12af2a6dc0a79d2404f187ad81bbf5ac22c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726334, "uuid": "1a3b659d-b029-4b52-aaaf-a2f512b45c8c", "value": "T1F474AD83A6E1BC79D5214F318F1EC2EC772FB8719E15ABD723481E2A59311B2D69B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726334, "uuid": "a0c0149b-863c-4c98-a569-abb95c8cd71f", "value": "a90bfe185c06be0aa4a37134cfb76f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726334, "uuid": "6b6e6557-284b-48b7-bca8-ce04e89c80b9", "value": "3072:dEdx4VmK0ufL8I/eClWAs8AzZqNPhiGZuKgUO1y4Q0cN+T2s1kyBuJ6ihLRTwlmo:Ux4fLt2ClWx8A4DPuKgVmet6yeRk7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726334, "uuid": "516180b7-91a4-4057-97ae-0fbda46ea2ce", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726334, "uuid": "44c347d9-d94c-4eee-9eb5-0809a1fb2227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726334, "uuid": "2fb1781b-0e25-4201-8d9d-4c9e2883616c", "value": "c779b3903c2028975d1b798a876ec4ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98f1076-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725758, "uuid": "a5d2dad2-386f-481d-b1ac-38a32ab0b257", "comment": "Malware payload", "value": "0cb531172188c6df849189a308431ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725758, "uuid": "9e47bd67-15f1-40cb-89af-21de3e162da5", "comment": "Malware payload", "value": "80ce75be063e8a3f5f734beff4a7b8a17451a1855254674573ec566a3bd1a293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725758, "uuid": "50e31240-95fa-4e2d-bda8-08c2dab0b6e9", "comment": "Malware payload", "value": "358df85bfd1f929cb7e6158d88746adf7f7dcf40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725758, "uuid": "67d7c297-ebf7-44c7-aa5b-a4a159919009", "comment": "Malware payload", "value": "17f488a47c8ce128fe5576bb7203b29488edc1b53bc8acb953ea4b44452091df561b7bc3c572edde0a7637d5558eaa3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725758, "uuid": "42ff65ad-7a14-4c49-8227-d57e3e0aca3b", "value": "T105E47D4382E1BD58EA254B728F1FCAFC772DF6E08E497BA522189E1F14B1176C263315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725758, "uuid": "a69f9df2-c025-4211-b35d-c39ab889a2ee", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725758, "uuid": "74a5414a-1fe0-470e-b7f9-0cd69ec4ca8f", "value": "12288:bn/fVXDLrue44zGSjR0sKGGyrIbJ99XgXJgLUeL/4/:bnHVamzpRqyrygXJgLHL/4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725758, "uuid": "64699d73-174a-4a60-9f4e-587ca07ad664", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725758, "uuid": "48110d90-4ef6-45b5-94d2-c1698545847c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725758, "uuid": "701c9f66-07a4-4d2c-9222-e3ab3d5a0839", "value": "0cb531172188c6df849189a308431ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8ac51f-4a34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693729929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729929, "uuid": "3302a838-522e-4da1-bada-dc4418ec610c", "comment": "Malware payload (AgentTesla)", "value": "3d2bcedf7ea00a2b1a43c8ce12584049", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729929, "uuid": "22fed7d2-ebf0-4154-9154-d3edf140d741", "comment": "Malware payload (AgentTesla)", "value": "816714d88d585f569ae56eb4805b887bcfeda1834c3a796dfa9e21165678d0fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729929, "uuid": "bb9dd6dd-fc3f-48b5-910c-fee2f2e9df27", "comment": "Malware payload (AgentTesla)", "value": "74c3bac0075dee7465778636bb03c67fce067e52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693729929, "uuid": "6fb3f612-8c21-4dad-8cbd-aba1b4ae3c9a", "comment": "Malware payload (AgentTesla)", "value": "2046e0ed4db530e270b202fcf37517cfd4c4acaaca25dde145104756734e23877995a787d8e0c214e11c2da637d53b16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729929, "uuid": "d8cfec85-8a87-4178-b3f4-7308797058fc", "value": "T1256600F6F6052AB2E28FD1750054BEAD83687CE3C9D2832CD73D65A00E2AFDD5D15886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729929, "uuid": "5becd78a-b65d-4cd9-ad2b-70f35234d5ce", "value": "384:0Gfw/NHB4kdSUIkr/VH9iH7jbi8n3KMyUE/bywaWnBkHP3AeywowuQ3kOe3JvwA/:hc+pU77x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693729929, "uuid": "b3fce194-c732-4aa9-8f01-25227517bf83", "value": 6490261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693729929, "uuid": "f48b436e-e68a-4e2d-ab3e-8964271db692", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693729929, "uuid": "721f4ef8-c52d-43ce-afbc-89e1957e2c38", "value": "atom.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfc8eae-4a6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693753520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693753520, "uuid": "7754b348-ab9d-46f2-96c2-ed035044c5b7", "comment": "Malware payload (RedLineStealer)", "value": "031934245b0518e2dc43944319899beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693753520, "uuid": "971e24a5-518a-48b5-b00e-cdc799f4d3b2", "comment": "Malware payload (RedLineStealer)", "value": "81ea8d3523051fbe61101290597fc87926c3f4f0ef098d855ddcc5c6f140c926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693753520, "uuid": "6d1bd5e3-641c-4893-a8ab-1d0e9218db62", "comment": "Malware payload (RedLineStealer)", "value": "68211cb76c3b769fd2703b6c8f82369e925d0b8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693753520, "uuid": "347b21af-5331-4789-a5eb-61b71a79bf54", "comment": "Malware payload (RedLineStealer)", "value": "0f467dfc528076c168538040c87d8c305b185b387da1ea9600b1b7f8f577ded4d95bffcdbed245a741ab1a11c29d4416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693753520, "uuid": "513f05f7-14fa-4bd0-8f4a-4f064b7ae85b", "value": "T103B41218E2E42B43D63892BD9454371407F496583332FA2E6D60A4EF9D53F4A4E36B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693753520, "uuid": "dc95bb16-52c0-4902-a719-c1832e43f669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693753520, "uuid": "998e5c33-41cf-4b66-9ccb-89077d2de099", "value": "6144:NIXk3KC1iOHzDB2acExGIm+taiZOt6dSiw+HEcevHc8Y4a3dl9k0604lg2FpJssz:NafOZ1ZIVt6A1Xvzfaf9J6JgYzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693753520, "uuid": "69dc8cb1-e188-4df4-873f-7dc19fa41760", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693753520, "uuid": "a6e15803-8371-447c-9c49-4d5b6f5bb4ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693753520, "uuid": "c328d779-762c-4927-8c8a-17b8641710a4", "value": "031934245b0518e2dc43944319899beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d424bc-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720308, "uuid": "81219a01-f3c4-430f-83c6-8e9d79bf3a03", "comment": "Malware payload (Mirai)", "value": "45d9ef34f26f804490d35b45afe2b64a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720308, "uuid": "405d4a02-63bf-4a8d-bce2-00a0cd6b244d", "comment": "Malware payload (Mirai)", "value": "820947c9b2f1fc4aefd62131336bdc87eea08ad22ab42e70fc62add577a10752", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720308, "uuid": "cef17ce6-6337-461e-943b-9f4dc04e48d9", "comment": "Malware payload (Mirai)", "value": "d4c503400d82ef6cd28fdfc1fd251396d321a3f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720308, "uuid": "02da0298-9140-4c3f-a044-6e3524eaad87", "comment": "Malware payload (Mirai)", "value": "159274ba4e0c0a46088fca38c74342f8b4630be14579035b918ccab7c6b7cc53956467defed494fe50535dd020961930", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720308, "uuid": "29d10334-e688-4fb6-8e79-ea2901552e98", "value": "T191A2BF95218A1C72C2318A7648BA8DD2765206F5F0F63263BDF0C98CA68741729FF6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720308, "uuid": "8ddc9f84-d76e-411e-8265-006a0ea29c61", "value": "384:gdLWDkLLe8jUBxUgYFC1EtOvfav6QWhj8hHZfa7t1jTr3DRMjeLFCW0zhymdGUoz:uWDkTjCanCbQu26MgCW0zs3UozavS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720308, "uuid": "8768486b-ccf5-4af5-89ef-7abcfc66dafb", "value": 22524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720308, "uuid": "a795daf7-9008-44cb-95fe-0937dc568a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720308, "uuid": "1d565a79-e664-48b2-9960-b68003627207", "value": "45d9ef34f26f804490d35b45afe2b64a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00984d75-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725904, "uuid": "01c58807-7a7c-4801-b037-e860037dc3dc", "comment": "Malware payload (Vidar)", "value": "3f84b02973ea8bcd581a13c1d232f97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725904, "uuid": "d7c609c1-d4df-4202-9d6b-2ce049d75007", "comment": "Malware payload (Vidar)", "value": "879a4aaf737671a0d2f91a1535d1239a46716e824634787b089550099a4277ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725904, "uuid": "6a2e6f89-6736-4b23-a9cb-a624e05be30f", "comment": "Malware payload (Vidar)", "value": "2fbf7ce068b2f36aa3a5c62ebdcaaa08cbd628e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725904, "uuid": "bcd804fc-af19-4bec-aa8b-c8c9293162fb", "comment": "Malware payload (Vidar)", "value": "8401f0a6c790f47ffbf3a2bb216db95ad1b3668b15cb0f0d7acf79c3173a978eddd5c41cc88a931a7d155aa8290b25c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725904, "uuid": "3f725d9d-2e4b-4ed0-9349-f97d2b169c06", "value": "T12D05018361E0BC79E52543718F1EF6EC371EF8609D24AF5A27446E2A1970E72C9DB342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725904, "uuid": "c11aa7ee-1ef4-41e0-bcc4-54b278de637a", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725904, "uuid": "c8028103-80ee-410d-a767-438d5656f6b0", "value": "12288:W+TJZC834+T78QugR6Ql1e6vrAl5LeUzh05lfCo4by:W+T9o+k9i7tvrAl5LxM74by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725904, "uuid": "2cb13c6a-e7b3-4a9d-906d-51aadb38b44e", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725904, "uuid": "e91cb4fd-a947-4537-9133-dec55a220c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725904, "uuid": "f1899330-7a24-4c3d-88fe-3fea69c9c9dc", "value": "3f84b02973ea8bcd581a13c1d232f97d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b45a44-49f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693702856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693702856, "uuid": "cfb8ec63-9aab-4e92-b561-88771e19e1d9", "comment": "Malware payload (Amadey)", "value": "bb0775d62b675a99bf113a5282ee527d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693702856, "uuid": "b0006a29-64ed-4c44-9898-3746bdcafd9a", "comment": "Malware payload (Amadey)", "value": "88d82f209133f753957f901cead443ad4e6a0daa148c098dacb565a64be2e80d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693702856, "uuid": "d9bf962f-0b4b-40cf-baac-a9b07d705174", "comment": "Malware payload (Amadey)", "value": "85bbd1fa8a66fe7dcf53df16dfdf0cb5511cdb73", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693702856, "uuid": "df212754-d319-4a23-a1a6-5457efdea792", "comment": "Malware payload (Amadey)", "value": "063c280e8dec44df8a41c000c150f4e200f4f288ad522ebc2f0b723d3b493df3796cb4701fa59c2c810edafafea135c5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693702856, "uuid": "c3a303f8-da53-48bd-a551-966a318e56de", "value": "T19E357D1BA26601BCD4BB9178CA235A47E775744603309BEB17E05AAA2F13FF15E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693702856, "uuid": "484632c3-d579-43aa-92c6-c1a3c4741c2b", "value": "907e684baa019f5bd80cf160486e7eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693702856, "uuid": "a86e5972-18c7-4fa9-8be0-6b531191c4ab", "value": "24576:taSMLyrm87DcT+RZCPbZ1HslyolNVw8mGivKBDy:Fm87DcTsZ6Z1HDWvmGivKBDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693702856, "uuid": "46a1bdb7-5628-44d0-9749-b4f38fd5a5c8", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693702856, "uuid": "859f3eed-ed2b-4dfb-8ae7-63338568fad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693702856, "uuid": "67f93956-8061-4e81-ac6c-49deb951f5e8", "value": "bb0775d62b675a99bf113a5282ee527d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f57383-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725729, "uuid": "c9d78eaf-97aa-4c19-80de-2eac97d72c9a", "comment": "Malware payload", "value": "ec7c0f24c2fd9a31712a570c805cf0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725729, "uuid": "8f21990d-5f00-4dec-8f0c-54b8a4311313", "comment": "Malware payload", "value": "899c9fd9e2a04ae165140008b789defaab0691681ac99f64de65ed14f5e35195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725729, "uuid": "f8ec9b96-92f5-4bf0-8618-ba5a8b81f947", "comment": "Malware payload", "value": "12b815a83847f8c0269945a7d487ef1f95e5aef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725729, "uuid": "b90a0376-de17-485d-abde-9c0233e886e6", "comment": "Malware payload", "value": "c84d6e5a4ba2ccc43e5d104511e2c490c156205ec08678a964cecea4d27e6fb959d45f43f139490c9fe5f39c91e89c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725729, "uuid": "efd74388-432e-4aef-b7d7-1db5d74b9ce3", "value": "T17C75D710D701521ADDBB35E94BAD713DB10CEAE0130464C781C86AFEEBAA6F13E355DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725729, "uuid": "4d92d4ce-cdab-4d89-994a-176e5961e41c", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+Lk:HLz6va++3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725729, "uuid": "c1b7c656-b5f7-4fa9-94ed-30b80a172beb", "value": 1597536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725729, "uuid": "67fadf7c-c5b4-472b-ade6-805a51c208df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725729, "uuid": "e7bf8bea-dae8-4ef2-8b8f-9cd472ce1548", "value": "ec7c0f24c2fd9a31712a570c805cf0fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea601db-4ab1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693783776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693783776, "uuid": "f117818b-a6be-40ba-91d0-ba720c00f7e9", "comment": "Malware payload", "value": "32b107a389e72705a31bc14ac21b1436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "StayHigh", "colour": "#F968EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693783776, "uuid": "41b26fb9-a1a4-4955-95b7-3897c852aae8", "comment": "Malware payload", "value": "8a020ebb14c15336cc2f8026138176a1241dbb54ddd4a087dc94c27a9af998ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "StayHigh", "colour": "#F968EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693783776, "uuid": "ced3116e-9a59-46cf-8d1a-ce1fd3abc77a", "comment": "Malware payload", "value": "2d3d249f733f5e4b80f70e730b22c11c3a8aa3c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "StayHigh", "colour": "#F968EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693783776, "uuid": "e0caa0e4-bf9b-44ae-a8db-904f7ce5d0b3", "comment": "Malware payload", "value": "91981010dcb96eb5324ba5de445df53d4f76f891bcd478fe7a485db9fbb69402f54d7995b6ae276a6d4cc15c8dbf54ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "StayHigh", "colour": "#F968EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693783776, "uuid": "e85379f2-3f29-43f5-a0e0-b4ed36bb9951", "value": "T1F2F4F19C3991F58DC957C8F48EE99CA8FA6560364B1B4103DA2319D99E2C8DFFF440A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693783776, "uuid": "df78b8de-1899-447c-93c7-6ab2aa122622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693783776, "uuid": "c2b2c156-e989-4467-90ea-76ae0140e263", "value": "12288:qzdhyhHOhvoAoDGHYS35dC+2FdL27ydDo7AwpxHvolS68+czCog+1OoUV+:qXyhHe2WT5dWdL2WGolS61aCodxUV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693783776, "uuid": "9d5a4a4c-671f-4f4c-92cd-176169bbd3b8", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693783776, "uuid": "70c42209-2948-4e56-8415-57062a1bdb3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693783776, "uuid": "e44d1f2f-c236-45bf-b7b9-47ea364269cf", "value": "Stay High Ransomware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fda2ac-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726028, "uuid": "cd066d4d-078e-4332-b394-617e4d6cc300", "comment": "Malware payload (Mirai)", "value": "765f908ecf5f70b005df7685668ea042", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726028, "uuid": "39f88b60-f795-452e-b0a0-a129a4eec76c", "comment": "Malware payload (Mirai)", "value": "8b0ac00f2d3378a745118d937e7d53cb52ccb16884492f5a599f021b67194461", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726028, "uuid": "aaf9d0a0-dd0e-4a64-ac4c-dfcad5ab5836", "comment": "Malware payload (Mirai)", "value": "af2b6fcf4ab06f95701ee5aa84a954270eb012c2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726028, "uuid": "3ea4d7a8-1858-4e60-856f-0be6cd8cadc0", "comment": "Malware payload (Mirai)", "value": "6da65e6d1d8d0f7ee79b4f432a8537c62ee5325cc28182ab8bd06100adb44180d53be1fd7fa8a2565bd67637271e2fcc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726028, "uuid": "42f387c4-b19a-4b7b-89a5-114dffbf6a58", "value": "T151B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726028, "uuid": "19ec085c-2006-4432-bd0b-b578ebd6e6f8", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeA8+TRCm7FnVqfJXFWbNb:T9a2aLqkrMTsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726028, "uuid": "a794c75b-d833-46d0-992b-590dffa6c743", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726028, "uuid": "c4713f9a-5930-4fae-9be5-bdb3bcbef91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726028, "uuid": "05527fa5-f7c4-4779-b371-706a8fc63e86", "value": "765f908ecf5f70b005df7685668ea042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4403dc6-4a3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693733131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693733131, "uuid": "aa00beca-51c1-4fb0-b40d-9812dbe5f3ca", "comment": "Malware payload", "value": "8611f1e9a213f42813b05386a8198c87", "object_relation": "md5", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693733131, "uuid": "b05a0de2-c742-4507-9393-51d55bc45b9d", "comment": "Malware payload", "value": "8b76eaaad2dbc4801b3424571c3218c8a63ed3e5adf55b566188e1d8825fc9bc", "object_relation": "sha256", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693733131, "uuid": "3dee8616-f024-4c17-b9ec-ed73db2f4ae8", "comment": "Malware payload", "value": "e82100aa9eb3cac8d6cfdb81fdd1e0bcfabb4df1", "object_relation": "sha1", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693733131, "uuid": "3ae37fa0-5e7d-4dc9-852e-f329288f4d82", "comment": "Malware payload", "value": "6a0c30d8b25229d5431f4e7a5aecaba3dd605745ee2400b6188ca64a4e879271f40a431d19b22d16d0d0d1d5702614d9", "object_relation": "sha3-384", "Tag": [ { "name": "berndware", "colour": "#22BF05", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693733131, "uuid": "1156f987-a1da-433f-9dbd-f4967d0ab1ed", "value": "T1BAA35C417680C075E6AE193D1834EFB48B7EB920CF609DAB7B9446BA4F711C1CE34D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693733131, "uuid": "49937c4b-61c7-4517-8d78-6c2de48ab279", "value": "9161ff3d2307c146341b93e292bc1f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693733131, "uuid": "a6fa9404-ceaf-4038-a250-3cfb6283de2e", "value": "1536:JnUznQeTUB58zDnHHsYW/sSvIYd6WKDk1cYcZ5ONUEtmfsb/+4kaGQ2TS:Jr5aDHHsYWnIYm5ONz/+4kaR2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693733131, "uuid": "541b3117-d658-41a0-80d8-11e5de257447", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693733131, "uuid": "b3b8c9cb-12cb-41d0-b933-5c274a7d513e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693733131, "uuid": "9d3f27e6-3312-4b05-aae6-61a220092309", "value": "berndware.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dd72a4-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748534, "uuid": "5668e0c5-fc97-498e-a84a-adfc60d12519", "comment": "Malware payload (Mirai)", "value": "eb8e0e6cd552837ef620346d383fee0c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748534, "uuid": "8f9f93a8-391f-4a99-86be-0357593bf361", "comment": "Malware payload (Mirai)", "value": "8db151fabf66016c0ca3b34e36c35f986c20072e7e723c7471a930c6e99e9c68", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748534, "uuid": "98cd96ed-6de9-4bde-ac45-342410564978", "comment": "Malware payload (Mirai)", "value": "83564ee6eb8e6ef392a375a6800dbe12cd0e6c90", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748534, "uuid": "53fb4465-c2c5-4166-9869-73271d860b81", "comment": "Malware payload (Mirai)", "value": "e1ba80b3fe7d5ebcd304b2fa1ca49e5ba8a7a9be732e176d8cee4a1eb682e6592037da695ca557b588659332aff80437", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748534, "uuid": "ba10c0ec-ca58-49f5-aec9-23e1a6b32152", "value": "T1B8D2E0D39B7FE1B4C0B6A5B444BA8A80F5A4744EE226C753099F082ECBD918D04256F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748534, "uuid": "faff84f5-8192-4e00-b97d-8e7ab7e055fa", "value": "768:rYSoXdJZgicC0ILWkdZPY7vhdThHNyN9DJSx0sO:rYJdJZuC0cWkz0vhdThHw0tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748534, "uuid": "9e567642-6bd8-4324-b545-a0c0ea4de55b", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748534, "uuid": "1e88fa48-2260-4284-b271-84bee042f48c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748534, "uuid": "09cc271c-ef9f-473b-be6d-24b4be11d7a3", "value": "eb8e0e6cd552837ef620346d383fee0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3defaa47-4a94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693771104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771104, "uuid": "5df531d7-0769-4fa0-a8ef-3027bc8e62d0", "comment": "Malware payload", "value": "a38f6450fddac874c128c199cd5dd3b7", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771104, "uuid": "b9a0623b-7523-4dd5-a129-e7fd6a33d051", "comment": "Malware payload", "value": "8ec2b5ea897cc92f86ab026921607267569f12afa53f73a770444e0cbc725c77", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771104, "uuid": "c68cbcb8-d122-4958-b3ee-4f40d5788655", "comment": "Malware payload", "value": "283ed1540d83370f9a406c24f0d30c89d468cf99", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771104, "uuid": "5a182032-9912-4ac3-b26d-805588e3392f", "comment": "Malware payload", "value": "3b9096f3f79105fff37cced5899babae41eab3a834a1360dee88f22d6b95dd49b32c1f814151b94348a4bce7e79cd24d", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771104, "uuid": "46b8f533-698b-4cc2-9fc6-a6ca779651e2", "value": "T1AB667D31E544C872E1674079DC7EAADD45273C600F1885DF268EBA6D2FB63C022B9B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771104, "uuid": "af509a40-4598-4b6f-862b-5cd8cad9b843", "value": "98304:/EV5DHW3s2v3CCwTXNo0cpKwstTJIkS43mCFPH4BXIE:85S3x2ox8tQe3mjBXIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693771104, "uuid": "a11b5640-6463-4ad4-8900-722f275c5bc6", "value": 6702636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693771104, "uuid": "74169b05-b309-4a49-b80f-af91968f4f8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771104, "uuid": "d9ce09a4-479c-4226-b282-f78d781f106a", "value": "ColorTemprite.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4278a03f-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726015, "uuid": "2bf233f4-9f04-4569-a1de-ed4b794ffade", "comment": "Malware payload (Mirai)", "value": "002c9508adecb7742a547fb3244c0e9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726015, "uuid": "116a0b88-828e-415e-91dd-ff08096dc448", "comment": "Malware payload (Mirai)", "value": "8f1d9867f21d3d0e77e93ce6b486efa1fe1d34e34c8ed6ce1f33dea4b6250c97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726015, "uuid": "c4c9ee75-a252-4650-985c-8ad10514813c", "comment": "Malware payload (Mirai)", "value": "ae02bf77b1657165ee01c43e2748cf9489b6310d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726015, "uuid": "fc90db47-db0e-4704-9b88-a97f820f7223", "comment": "Malware payload (Mirai)", "value": "fb84cf7afe835d17c71f4567431c795cc1adf3f33fc067eb8fb4f75958f32d9e8677321fda3f42269562cb604821160c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726015, "uuid": "567a6af6-dde8-4613-90d8-87fc3d0d7ff8", "value": "T1A4A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726015, "uuid": "7816fc19-32ae-4989-a31d-f16576e2ee3b", "value": "3072:VK1z13U6HzHoXRtmTUhQogwEmmFVcqq0GnDZT:VK7DDeKlogwEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726015, "uuid": "72f6cdb3-9af1-4121-8dcb-ba5e953d6875", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726015, "uuid": "b3209d61-cf9a-44f3-8ff7-cab3027e451b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726015, "uuid": "282894c7-b43c-4379-8901-71d9713a312a", "value": "002c9508adecb7742a547fb3244c0e9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2b273d-4a01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693708284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708284, "uuid": "42e3457c-5417-4681-ba0f-73cab5dd8b45", "comment": "Malware payload (RedLineStealer)", "value": "2873f6ba377170ae5d722855ee4de3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708284, "uuid": "ead21353-b639-405d-8f5b-f07f3da891ba", "comment": "Malware payload (RedLineStealer)", "value": "8f90b5452d2899b11f7e7da54c1d33a758cc06654acc7cb07f63e8f3d2c51f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708284, "uuid": "8fc7a15a-1cb0-46d5-b14a-19d2c75806d7", "comment": "Malware payload (RedLineStealer)", "value": "c0751ed2e429b129bac22aad226487762761b4b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708284, "uuid": "343761f9-c384-4e02-90ae-91c8a082567e", "comment": "Malware payload (RedLineStealer)", "value": "49aae6d8cb110f50b09c25665c20b07f6c69951f114bc0b994bfe66f795233356cbd55aedb08d4ce556f4b199d7e734a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708284, "uuid": "dde3d931-d1a5-4e68-b19f-00004246ef8b", "value": "T1611523072FE84036ECB41BB484F646D75B37BD925E78876E6B0168180C727C8B83A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708284, "uuid": "87a71f71-989b-4380-8af9-fbb81ee47fbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708284, "uuid": "dcb0ac7c-b578-4936-aefe-6c880dc6a1f9", "value": "24576:Ty+vzxbkAvepwVU7n1DBcSWfBhYzYYNnvPpY:m+VYR+SdX1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693708284, "uuid": "e6482444-4322-40c1-9180-f3cb7d085300", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693708284, "uuid": "6a89bde5-6d87-48c5-a46b-7b82fcf294d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708284, "uuid": "a9a52a97-64a8-4ae0-ae98-a647bc17740d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695c62b1-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725651, "uuid": "004a3216-e447-44cd-865b-cc9433b1afb4", "comment": "Malware payload (Vidar)", "value": "8bc2435d24dea9ffb372e06cb1387673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725651, "uuid": "4d97dbd3-f0ff-4892-ab7a-b41ceffc8e58", "comment": "Malware payload (Vidar)", "value": "9164da9fa68e717c7d9d648d3c8d608bccfdafe31ede8cfe67876953d27f1f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725651, "uuid": "d6653025-456c-4ef7-8852-6a8222f61a66", "comment": "Malware payload (Vidar)", "value": "b5743784a12ddd3b2b49630b9b2f032c84e5f120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725651, "uuid": "91128445-fa33-45f1-9c62-0384760deec1", "comment": "Malware payload (Vidar)", "value": "dd2039a681d4dec612bdf8105194a44a662ca3b15463f0954f8d8c3dc5b2d4d4e7c8b264d30bf17d46bf0cf810e157a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725651, "uuid": "637c9a43-4a18-4718-aa46-6db0c56314e3", "value": "T1FBA4F843A2E17D58EA258B728F1FCAE8770DF5A08F097B6D22189E6F04B1176C273715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725651, "uuid": "1de99008-53c9-4888-b220-6e019ee68539", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725651, "uuid": "8cdc76a6-18fb-4f0b-9218-6850f43aeb47", "value": "6144:GnxxraUbhNGZU+IBUoDQf9oTZyzWtVMgLUebH/La:GnxxrauvG2Wf9oTAzymgLUeL/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725651, "uuid": "76bd2f3e-0206-488c-8b68-65533e92da0f", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725651, "uuid": "40cc773d-19fc-4aac-907d-96b400258218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725651, "uuid": "0f749356-ae16-4b56-8bde-5115d9310807", "value": "8bc2435d24dea9ffb372e06cb1387673.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7402f30-4a5f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693748572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748572, "uuid": "5098ff57-f01c-4efc-beca-a842569771a8", "comment": "Malware payload (Mirai)", "value": "8c625c4ff22249ec8f13b84c775cd555", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748572, "uuid": "27c0d0e9-b6ab-47c7-a5b5-62e51007d65a", "comment": "Malware payload (Mirai)", "value": "91ba50be4f0abedae6ced430395c1a160ff640935bd7153c03e1398750fbd75b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748572, "uuid": "d6175d87-6379-4449-96e4-44ec715e2e65", "comment": "Malware payload (Mirai)", "value": "0aa05b9688181abc3fd0c4ccb24a13b07859438f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693748572, "uuid": "654034b1-c2fc-4e88-afac-c939681fe302", "comment": "Malware payload (Mirai)", "value": "7f45efb577234f80bb4d14080928ce0ab151cc350fda40d145307a047f2b5d4ff6a036347166fced459ff8bc1927bf67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748572, "uuid": "2c65bd92-1633-4144-8a30-0cf3171177e8", "value": "T1CBC2D010F090CD46CDBBF9703E61D7EABBA0171E7B63DDA2624117C26B0BA56095AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748572, "uuid": "ff691884-4b4e-4464-a81a-bbad75460b4e", "value": "768:/VdafO76jpmNJ6bNU8hhVgGuQTX82Vg84uVcqgw09f:ram+AyNU8fTuQTMA54u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693748572, "uuid": "20170be8-59d3-47ed-9fca-71a8bcbf19ce", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693748572, "uuid": "7b3c7969-2dff-477d-bf1b-400745e8633c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693748572, "uuid": "291b0708-ca85-4e50-81ac-5765663f9c87", "value": "8c625c4ff22249ec8f13b84c775cd555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a324b3-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714904, "uuid": "3d83cb84-7f5c-46df-80bf-089877d2e318", "comment": "Malware payload (Mirai)", "value": "796bc6b0389189f0647c2d3019a097e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714904, "uuid": "e681f442-c1c3-4d13-8de3-8c8f1c448fb4", "comment": "Malware payload (Mirai)", "value": "926712124bf7fb43b297e788372ac7090ca66d94cd917c324ad373be6d881897", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714904, "uuid": "59f9f48d-400f-4d37-a5b4-f5682959aeab", "comment": "Malware payload (Mirai)", "value": "4d894cf81e574f2c8eae0057d0867d743b7960d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714904, "uuid": "80d89d47-f778-443a-9566-ea6c9acd8b7c", "comment": "Malware payload (Mirai)", "value": "bac24e5c3b71e61faa138228be8b842fcf0a22a6a0f40d124e726b16fb7939ca152088063e5219362509d713fc6539bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714904, "uuid": "c7973e29-71bb-4c2b-b612-37d9cbf25344", "value": "T12E53F84AFC818A06C5D51376FA2E118E33136779E2DF73129E106F2077CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714904, "uuid": "2c5387b9-7b24-4d98-8ea2-24a635c1140f", "value": "1536:0pn+39nBXajVtkmEmyr6D4czK/LlV4IgjkqLpILiJUwxZW6m:tnwhGmPE6sczKxVtuUwxZW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714904, "uuid": "ddc99c6a-2217-4a37-a316-728fd6f45a43", "value": 63168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714904, "uuid": "e480f5cb-8343-40dd-900a-36f3a409981c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714904, "uuid": "de8381f4-8bc2-41af-9944-bef49838ca58", "value": "796bc6b0389189f0647c2d3019a097e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3b65ad-4a16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693717173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717173, "uuid": "bcb944da-bf62-4640-b80b-9a52047eb087", "comment": "Malware payload (Mirai)", "value": "1174d3c347d50928e5832b147497981e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717173, "uuid": "53cbd8d0-49b4-4178-b80d-bfd00a2d4d35", "comment": "Malware payload (Mirai)", "value": "94a14b378e5c803074bf4750549ed408d25ad1142609093e5b851fb1a0807b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717173, "uuid": "e148c502-72f5-457e-baea-3250fe7a29d8", "comment": "Malware payload (Mirai)", "value": "213953f512397a0feaa315acfc0a97a3f0ad7688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693717173, "uuid": "63d7dd2b-5632-4c66-aa1f-62b1605ce550", "comment": "Malware payload (Mirai)", "value": "efd44a9001c1dbe4b81dbff37aa990761f06af33d47decfc333ffd316ad584e80f11a4d33760a7e8526a23ee368b9781", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717173, "uuid": "e0e2e495-981c-4653-adf8-68538aa65582", "value": "T1FC83D646EF610FBBD86FDD3746A90B0631CC554B12B93B3A3674C82CB64A54B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717173, "uuid": "1aa79119-0abd-49ec-ad15-e815dca0c588", "value": "1536:9PeXhPMTdzsYrrDX4ZNQAF7+W5KJs+NrplJOLzk:9mBur74V3KJh9Yzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693717173, "uuid": "8f8845f3-e7b7-42ba-b4eb-b5ac73d531ad", "value": 81660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693717173, "uuid": "5d88a997-24ed-4f5e-90e5-5dff48d688d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693717173, "uuid": "84d97f1d-907f-45f3-9b0f-84c6d053e64f", "value": "1174d3c347d50928e5832b147497981e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ac8ebc-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726376, "uuid": "17c9a4bd-b545-4624-a28e-aaa8195e7d9b", "comment": "Malware payload", "value": "18594860f2e10e6c0a15ba984ca6c75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726376, "uuid": "032f0ee1-7e18-4f12-b07b-c5ee6d86ea88", "comment": "Malware payload", "value": "965bb3401722460b7dba01af82b47c76ba328938623d3519b0fccd9eebe36580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726376, "uuid": "49d594f5-6506-4a22-83f8-2c392e140b90", "comment": "Malware payload", "value": "ead2da9b8ea1e4869e2566a421ef36a5e1d7992d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726376, "uuid": "50c770e8-d88c-4b76-b792-232a52deb7bf", "comment": "Malware payload", "value": "2861c3711645c6e6783a9812c2559da65c33578a75a210fcee720652fe53dca81dde4f946c41e9a739a0b80cf16e61dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726376, "uuid": "c7bb954b-ba0b-4d48-85f4-11925fd561e1", "value": "T1A6C4F0836DD3BD38D52583714F1ED2FC7B2EB8614E1AAB9623545F1A1A301B3D99B302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726376, "uuid": "57220803-715d-446d-8420-a3b2ef999d75", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726376, "uuid": "d34f7667-08dd-4239-8902-bf34d3e1117f", "value": "12288:kIFK+1lqwakcnFDOPQS9V9JmR2CSuJY4z7wy:kI9gw7ccNPAL0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726376, "uuid": "e1e53ee2-76bf-4bd1-85f7-6d587195b966", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726376, "uuid": "290c2961-1130-4083-99a3-bc4d8482df2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726376, "uuid": "39d29f5a-c009-42d1-adf3-9f96d1d2ada2", "value": "18594860f2e10e6c0a15ba984ca6c75f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e5f85c-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693777433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777433, "uuid": "6457713c-390f-4194-a802-3f9268017e91", "comment": "Malware payload (Mirai)", "value": "2e89e763c791a42454a2ec1d08348706", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777433, "uuid": "7781f333-9f7a-4396-acb6-2c471ded3962", "comment": "Malware payload (Mirai)", "value": "96833401d3c1c9ec491c1148dce18a347578f534714895f513c7854e7989cdcd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777433, "uuid": "92d3afa5-55b4-4340-ae81-7c821ab6a2c9", "comment": "Malware payload (Mirai)", "value": "53e30b2d6161b05affa7e055d8ce45ca25822e04", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777433, "uuid": "86c6d2dc-c22f-4fc8-9f74-978263c9255c", "comment": "Malware payload (Mirai)", "value": "e5a24398466bed06a734821fee0b0ef714d74fb0926d758d1fa6b4aa4044003eeadea30d852091693c49f6b169ea3ea0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777433, "uuid": "c99b995f-84da-49d0-82b6-b9f001f5628c", "value": "T1B1D33A17B6D190FDC8D9C5B44FAEE13ADA33B52D1134B25F2BC4AA232E59E205F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777433, "uuid": "88803d5d-8f81-43a9-8a74-05da3e676bfe", "value": "3072:Qny+b8Y3U7o3hgCVcveRwt4i9H+34G90yNTWD/:Qny+4Y3Pmt+nNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777433, "uuid": "b33767b9-beb7-4c92-a1e9-989795073384", "value": 138920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777433, "uuid": "108281d7-c1d9-49e8-b292-ef633d1e1006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777433, "uuid": "622ae8ee-2d0f-4dfb-8acd-631a0c3cedb6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277370a5-4a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693774073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774073, "uuid": "d2262c42-4ae6-4f60-88c3-2c77e15df305", "comment": "Malware payload (Mirai)", "value": "412eb324aa6a298d5df61fbf43642084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774073, "uuid": "553053ce-9702-4b3e-b209-f2b29dee6200", "comment": "Malware payload (Mirai)", "value": "97cb1705ac0c8530dad13e9f0bc80c51cc11d575dba7da73dcfdbe1751a5151d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774073, "uuid": "9b97d085-b614-4e4f-aefb-f63d235c8c54", "comment": "Malware payload (Mirai)", "value": "a3f17e12e7f29a85388d4a53e7bb75f37117715f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774073, "uuid": "78fc2ebe-fb64-4e24-914e-960b7ebbdbc8", "comment": "Malware payload (Mirai)", "value": "593425a6428227285545a7aa96869321e9fcb4e6c3216e66d024674ea2e56e44db3c703ea7c9e203bd1011964b0cd99d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774073, "uuid": "8dc82b2c-02de-4fbb-bf68-287c5933e4e0", "value": "T16CB35A77C8296FA8C159D1B4B0B09F792F63A58182872FBE54A6C3764083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774073, "uuid": "feabb152-5286-477b-b6b0-53b2f3ed924c", "value": "1536:GaGTHW/qIAm65vKHFGEWCR0KNKlnL7lvyinz4tWkEvxRcLwi3J:GtWLQvKlDWM7NOVvyusWzvxfi3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693774073, "uuid": "ab5107f2-c129-4994-ae2f-07d6fd64afcf", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693774073, "uuid": "51f99098-d59c-40ec-9da5-96afb8f1cf99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774073, "uuid": "55219159-472b-45f1-a564-11f99e4d2c38", "value": "412eb324aa6a298d5df61fbf43642084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb38edf-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693725982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "ae62eb10-f45e-4285-ac76-2db1fb8f40c2", "comment": "Malware payload (Mirai)", "value": "acc1a9ca484618c12a7507ed687155f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "12b67f52-c878-4d33-8ac0-9a8af9e6dc8c", "comment": "Malware payload (Mirai)", "value": "97f8ef9dafa5096ad429e956ee2c28042477d22506eba3cad013e88f96f5149b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "5700d125-b20e-46b9-b0e4-fdbfabaa4070", "comment": "Malware payload (Mirai)", "value": "29b8701ee656597fd27bccfd6a618556e23dbf0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "4658689c-b1fb-4783-986f-cf8f7a1054dc", "comment": "Malware payload (Mirai)", "value": "12587cbf732f1caed7960972d33af52fbdb0f145f36aecec527de1dfa5c55367d01854173cb738b413380ce95ad21cb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "7412ac51-3393-4578-8159-cc434eb70404", "value": "T1E3B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "e2e0a14c-0dbd-4993-8ac6-fad2781e8c7d", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZRoamm/QcuLB1niDNb:YuFX0GIk1MHyphWamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725982, "uuid": "1fb5cbf0-c634-4e5f-9493-81e5deded0f3", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725982, "uuid": "4020739a-0e05-46de-a117-d04f99748ca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "08b6ae2c-c018-4e89-b816-0449872bbcae", "value": "acc1a9ca484618c12a7507ed687155f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4176efb-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693777423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777423, "uuid": "c84983b3-9d0d-4263-b4d7-8acb467a836e", "comment": "Malware payload (Mirai)", "value": "7bcb6d9fd30f87ed9dd3f6b97798f858", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777423, "uuid": "81650947-94da-4e92-b5b8-1c6419e325ed", "comment": "Malware payload (Mirai)", "value": "987272fe6598ed848310cc9da10312cb78f74e99b89bb843bface0e7c26c83e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777423, "uuid": "a9746e51-c2b8-471b-8b90-38d8657d21b6", "comment": "Malware payload (Mirai)", "value": "80088c17ec34349e6c66f2aec819e546361c608d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777423, "uuid": "b2a65afe-eeec-449e-9b08-b1ad685d88c9", "comment": "Malware payload (Mirai)", "value": "5449a8f6b23ca5163885d206643f46f703887166a82bd00a1fd35018a4f249ddbf1dbe9afb5f68b48848230fae47ed42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777423, "uuid": "076f3556-a30a-4ae4-9c03-600e6316a040", "value": "T110935CC5F683D4F6EA5705B15137A7329733E43A602AEF42C329AD36DC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777423, "uuid": "e40ce3d9-d225-4180-ab02-f12b8846e26e", "value": "1536:WWmseUZNsbtQ+ge96KM/MQuggIyB2PRf1SwRXXZ:VOUZctQVM5aMvgSBu8w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777423, "uuid": "c910a659-a438-4547-afab-93012652235b", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777423, "uuid": "3103d910-c338-4430-8fd5-0693f461ebe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777423, "uuid": "8eb61d6f-8b8c-474b-82a4-281d673d4cc6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78032ddb-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693725675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725675, "uuid": "cc75da09-aac9-4593-8328-c5aa1ec005cc", "comment": "Malware payload (Tofsee)", "value": "edd19304cd5c773ffd73331e02a60190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725675, "uuid": "2efe19a1-73fd-4fe7-aaa4-6bc77e94a902", "comment": "Malware payload (Tofsee)", "value": "9aded5733ec844d31a675d461968a7f3dffd3b2287cb932e8442d09c8cb2bd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725675, "uuid": "41637dec-a697-46ae-9675-5034923cce22", "comment": "Malware payload (Tofsee)", "value": "a0cd42c1400582d2331a31ab702049dbae32e1cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725675, "uuid": "48981d5c-2793-482c-924f-dc4b557bd78b", "comment": "Malware payload (Tofsee)", "value": "e0e1eeab798a00294776f10094a75ecfda1205af22ffebae17d0bb1bc64c11f75536ad6e0c7e7ee267efc66ac7c4883d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725675, "uuid": "a9623b88-61ea-4830-9f7f-c125a5356bbc", "value": "T1E384A34392E17D58EA278B729F1FCAF8770DF5608E097BAD22189E2B04B1177C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725675, "uuid": "61ecf591-3909-4802-8e39-84032a9bc24a", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725675, "uuid": "7cec3772-b278-45fd-908b-0be8c59cd947", "value": "3072:6pP2OQYHZsONiEE9bYBX6gQ3jsvwd+anq2b2GYTOXknx92FG5KNKLPcOJdxH/j+k:6pORWiEKgX6hd+rNTOXkxCBgLUebH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725675, "uuid": "2be1b471-2db4-4bd4-b294-0ee1c451e09c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725675, "uuid": "3ef5d382-0b1d-4d62-84db-4e78fdae62ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725675, "uuid": "dee9feb5-0089-44a7-acea-e6e5670c58fc", "value": "edd19304cd5c773ffd73331e02a60190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679bfd25-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714910, "uuid": "e96dbe96-6d2b-49f8-a8dd-59e39a7bdd43", "comment": "Malware payload (Mirai)", "value": "9faba8363b57c8f2889abd8007384dd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714910, "uuid": "25ae35c6-611c-4191-8000-5b785787b4b4", "comment": "Malware payload (Mirai)", "value": "a02066f298bfac0ac055979b96d97788e9867a00ef6031fc2fc147af365c3b64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714910, "uuid": "2c4b724a-80c2-4e87-bd3a-63f0898bcf21", "comment": "Malware payload (Mirai)", "value": "9954b8f652e8d9233b412f20f4adb3a2c76d2888", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714910, "uuid": "2fd774e1-93de-4888-8e1c-b8c6caa4f8ba", "comment": "Malware payload (Mirai)", "value": "bd1d907e0ce643aba09884ceac74d02efda56eb734426f9ed2ab6bd2f90af459f0d5cf6946a2f8e6c1d95976323c4201", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714910, "uuid": "58e52539-fa6f-45ef-b9cf-48417294936c", "value": "T110435DD6B400DE7CF98BEBBE81224A09F935722154A30F2B626BFD936C720564D1BD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714910, "uuid": "f4ab571e-fd76-4013-a256-8c1d20f12bab", "value": "1536:YO3wdiIWzUADphhq7ZxGL0nkKrpE9slnY9iI7VtVkA8l:Y9dTKhq7zGLvyBYbtyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714910, "uuid": "3df89825-9521-48fb-8931-a7dc112ddc9f", "value": 59708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714910, "uuid": "7f022a55-582b-40eb-a405-56cb32d99f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714910, "uuid": "6f1e3ea9-5791-4b76-993d-befa0f27a51f", "value": "9faba8363b57c8f2889abd8007384dd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0fc3b9-4a10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693714567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714567, "uuid": "4aeee1a3-f8f8-4031-b3e7-ee909ff6fadc", "comment": "Malware payload", "value": "878666961d42fe694fd4fbea9c121580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714567, "uuid": "a5870ac6-8ec6-40ca-a893-fb6472f01802", "comment": "Malware payload", "value": "a0a256198f93aa97cd2cf5447366a13f36b399150aac09bd7a91bee8d6d04b41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714567, "uuid": "0a3fae58-798e-4848-86b7-8248dae2fdc9", "comment": "Malware payload", "value": "1ac72ae0b6e165e7562de0218fc9cbaceb222d2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714567, "uuid": "cde48b45-a84e-4cbe-9bd8-ce6e020c85b7", "comment": "Malware payload", "value": "cedd00c057c383f107c90c76878cfb430811479ec5f64d594609ca0d396a23fec3534f8d79898bb1243b506d81167fc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714567, "uuid": "0ba2c759-1d6a-49de-9c6e-eb92be42eae5", "value": "T199E53303F1916379E2265B7318BE98A8423259DBE76BD86C4D6BB3C83D773514C04E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714567, "uuid": "91db9942-360e-4fba-92a2-3342e84501b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714567, "uuid": "38a85ff5-b7c9-4093-b339-32f4cd3e0d4e", "value": "49152:a/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:a/FTi++Ql4FEQaxuMBh/DqLdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714567, "uuid": "b87d16a8-91e2-4ce7-9d55-4df01ecc13f4", "value": 3233792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714567, "uuid": "a577d0ae-6e68-4f8f-b86d-3f66fabff19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714567, "uuid": "ffe01be5-7339-4b59-a882-4dc9b72c2ca6", "value": "878666961d42fe694fd4fbea9c121580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9a314e-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770889, "uuid": "3526d119-4758-43cc-8486-aae738c03605", "comment": "Malware payload (Mirai)", "value": "afaef9d9f4d8ef445009fcc41c1ac4e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770889, "uuid": "e271ab55-5c92-49c0-9df7-08cedd0775da", "comment": "Malware payload (Mirai)", "value": "a0feca0dbf4af01c2e2d646017f723aef72b137c7da17b329d6e6886aa073071", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770889, "uuid": "9740f993-26c9-47c4-8406-3e14f9333524", "comment": "Malware payload (Mirai)", "value": "9b4a4d45b45c843623fe9b6624d970c2ab78a3dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770889, "uuid": "96e974ea-c97f-4f84-8f4f-b7c8d2a1e361", "comment": "Malware payload (Mirai)", "value": "8d54172f15635fdd5ed0358b96d3a76bc7aedd0bac70e536ec42ba6568c9d537a829dacf262717d24eb0beee6ffe4ec8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770889, "uuid": "e6f4275b-7a68-4662-80f7-3501a80cd905", "value": "T1C2D33A17B5C180FDC4DAC5B44F9EF536DD32B1AC1238B16B2BD4AA222E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770889, "uuid": "347b66d7-e127-4b5a-a822-a19766f1627d", "value": "3072:pGtwnNiaOnUTKFiPT9OSQ7AOaogjV2iZlBWCgPiAJWPdL:pGtwnNiaOnUTwuLyNJWPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770889, "uuid": "6610d718-4034-4c56-af5f-c3a0de6e93b5", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770889, "uuid": "42d0ecc0-81d1-4a11-b76f-83ab89710ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770889, "uuid": "677fe808-ad60-4374-b8fa-a8c44c223b2b", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaee8bf-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "1cabfcb0-e96c-4cd3-9b5d-950d07091eec", "comment": "Malware payload (Mirai)", "value": "9df9163818ad546808068b9199894488", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "95520baf-7c96-481b-b5aa-19e017906214", "comment": "Malware payload (Mirai)", "value": "a15cad9a2cb7d3b9d1cc5eb890f9faf731672accff780fc9c285f3e9123efc6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "65258ea6-98c7-46c7-b2e3-cc34fe802d27", "comment": "Malware payload (Mirai)", "value": "d62fc956d8826f20613c6d4edf46715156f50e6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726009, "uuid": "901585d6-c75a-450a-9b46-9c5e7191171a", "comment": "Malware payload (Mirai)", "value": "f15b3a783024dce3485cba7ed6778e067573b72fc4a97a89f431bca2a8227e9a2e46b9af789ad6f2a7cac350aa6ac415", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726009, "uuid": "9c6a2550-143f-4368-a8d5-1503e2604d35", "value": "T11AE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726009, "uuid": "fcfbe6f4-d2b6-42c3-a35e-384dd76e6147", "value": "3072:JW6dm9tS1aRGQdK76t/zClI5mrThPaLEnvPrNb:c6IG+LC6mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726009, "uuid": "a94c6bba-8dca-42cb-87ef-ddde02614f82", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726009, "uuid": "ed1f2b30-6c7a-467f-93ea-834cb5bdae24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726009, "uuid": "50d31d88-177c-4a90-ac46-f6fc4714bc17", "value": "9df9163818ad546808068b9199894488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11e4fb-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "331aab83-6ff0-4812-9cbd-49a33e44a298", "comment": "Malware payload (Vidar)", "value": "c0272deaa2bd76e52aefb8c0ef77425a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "11347b68-4ae3-40ce-a160-8abb8863e164", "comment": "Malware payload (Vidar)", "value": "a2a390c45219ec6ac4c2c151341ba9c65e13b0ab1ab9f4f5e161aa6569cfe64b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "a5d5df44-ecef-41a6-8309-414f8182a40d", "comment": "Malware payload (Vidar)", "value": "221a41e891356d14d4447ac5a4500e6c188b648f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725982, "uuid": "72a495ca-148b-4528-a848-dafd036e162c", "comment": "Malware payload (Vidar)", "value": "8cba3b826734560d0c8268b04fbe7f4f3016cced18a5c023043e25b856ed60aa4c33ee1b02c1ce062a089583182c072c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "0f40bfe5-49c9-4508-81cd-cf52108d5ede", "value": "T116749D83E2D0BC7DD52107368F1EC7EC772EB8608D256B9627467E1E19712B2D99B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "03f6c0bb-872d-44ec-8139-a1679280f4d6", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "57e1fed6-3db5-4b2a-bb5d-7ff45d7c8d45", "value": "6144:Au72FNBO030D45CmnJfSLVKu+TmRzW6y:Auws03KyUKEz7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725982, "uuid": "b1672d12-4b71-4574-aa35-9a8c1a075ad4", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725982, "uuid": "c992fb55-bb3a-4210-97ee-f795f779a745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725982, "uuid": "a2b44567-614c-4d4c-ae44-56805002b09d", "value": "c0272deaa2bd76e52aefb8c0ef77425a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dbfe1d-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725663, "uuid": "d2c17b9f-0309-4e3b-ae23-18e67b0d917d", "comment": "Malware payload (Smoke Loader)", "value": "7fac1b7f74ecf6df91ee5dc6e134023e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725663, "uuid": "344b0f91-4ccb-497b-b45f-b260b4e0f30a", "comment": "Malware payload (Smoke Loader)", "value": "a6c64807b79ab2877fb41ac58d4d76936bfde0b614cce0862b9b2e6230335d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725663, "uuid": "145f8ab2-f87f-4d77-8172-f094dd204c3d", "comment": "Malware payload (Smoke Loader)", "value": "07b9901c56d0a2c39461cd6082421c104366b648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725663, "uuid": "0d77b032-abb6-4603-87c9-39c6afd5ac0f", "comment": "Malware payload (Smoke Loader)", "value": "66d14666ca9b3f22e640f085d56489e0ff3e54a9ffab998904c25bc565c8fb8dfba346b205e8077000959b16855b414e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725663, "uuid": "9cef5395-38fc-4cf2-a902-6a7691af5157", "value": "T10E84C74392E13D58EA2D8B729F1FCAF8770DF5608E497BA922289E1F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725663, "uuid": "ead53fd0-f71f-44e8-9f71-f1100e3786b2", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725663, "uuid": "1ff6cf3d-6909-4302-aba1-7d21a70f17b5", "value": "6144:w/xEio0RrAddLCC+WkRXuYa35OgLUebH/:UxEioi9Copv4QgLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725663, "uuid": "22dca569-6055-46ac-a642-f6c78042dc70", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725663, "uuid": "55e29cb1-1d51-4d1e-8884-2ac7cb5c5dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725663, "uuid": "3e4bf625-1e30-4a96-8645-48cd05f251ae", "value": "7fac1b7f74ecf6df91ee5dc6e134023e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee84fab-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714923, "uuid": "0d66f235-5ebb-4a7b-9a24-390ca96e4968", "comment": "Malware payload (Mirai)", "value": "3bf07eb263e85c4db5262d624468bd66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714923, "uuid": "2f0bb45e-e3d9-475a-a04c-578cbaedef6e", "comment": "Malware payload (Mirai)", "value": "a73f8832e319009485efb1e3f71b958bbc74e208fc9a7c2b6d25d92f3f88ea49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714923, "uuid": "8682d947-9025-4179-8f91-ffae470a0fef", "comment": "Malware payload (Mirai)", "value": "613ea6a24c6b851130c12301c6bbc8e321578bbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714923, "uuid": "eaa192e5-8f8e-4016-baed-7d1c32654fd7", "comment": "Malware payload (Mirai)", "value": "c618950e4c62e63a2e3b28e51e076b0561009e44626fcc9ee19a808541642d7883779853f0fc7d286b5d5b97cbf03801", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714923, "uuid": "0b5f2eaa-e6bf-499e-af00-81324bd7911c", "value": "T13563854E6E719FBCFBA8863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714923, "uuid": "89a2b86f-49da-4d30-b325-a9c7301ea464", "value": "1536:w8aCKgyaDrIjtb3stmjpYpt130+23JgmUQ+e7:THB0Jb3vyptu+23JgmRH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714923, "uuid": "eadaff50-9e2c-4e55-a2c2-4a58760cf0fc", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714923, "uuid": "ab8bc5b8-a7fb-48e9-8a61-3ce9681491f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714923, "uuid": "db850beb-ffb1-42f3-a9a6-7148b5341863", "value": "3bf07eb263e85c4db5262d624468bd66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8387a3fc-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724406, "uuid": "372fbaca-e7ab-4ba2-b879-95b899790387", "comment": "Malware payload (Gafgyt)", "value": "19244e297244ec4f6c3b3e8dfb43bf8a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724406, "uuid": "1ca452e2-879b-41d6-9b2e-c7a881e70bd6", "comment": "Malware payload (Gafgyt)", "value": "a857e0bce241a497efef28a6e4e283d1c4a438af03fb26d1a68b72217d008298", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724406, "uuid": "6c6dc9be-65e9-4acd-8183-2d5cc0b9f5a6", "comment": "Malware payload (Gafgyt)", "value": "362168ab9d6747b0582b24acb758ad30bfdfe99b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724406, "uuid": "a7b468e7-0af8-4964-9ced-7807ff14b85f", "comment": "Malware payload (Gafgyt)", "value": "0d1e452422275f08564d4a929e505062dab228b9260b8c64917a1a99c8c3eb2cf8d812e1b5cc4b9ed0e91d6a12815c1d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724406, "uuid": "2e2d9e6e-afc7-43ef-9ecb-7c3dca97d3b4", "value": "T19E04F6627707AD6FFC6907701AE2CF7127D8A5E23A758586E36A7F4D1E202D25D08EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724406, "uuid": "1e0b3f6e-1079-4113-85dd-6a3b73c4eaea", "value": "3072:62R3IBKl6eK0mEK4KZHslangQ7fphaPJ+E2:6IzK0mEcZl7fphacE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724406, "uuid": "bba9968b-5df9-4055-9cf1-51019ae18d2d", "value": 176335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724406, "uuid": "9658abd2-dcae-4c74-a97d-d09efe9e3ee3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724406, "uuid": "f27dfb5c-972a-4ec3-aa93-e99037713d36", "value": "64spim", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728e8288-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725666, "uuid": "be51865b-e66b-4c60-8d4b-1da2c8af6e1a", "comment": "Malware payload", "value": "6082633da9450793dd0ebb8f1298d919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725666, "uuid": "355eb472-f564-46cf-85e5-2b630b877147", "comment": "Malware payload", "value": "a945a5af7854525337ce6c26631d2f43f0cd8f9737542ed64991edc5e98547b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725666, "uuid": "c833384a-dc3e-4473-822c-e5a4602f2e3f", "comment": "Malware payload", "value": "25d1960b78579a855b90c0fd24160752f33649e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725666, "uuid": "c396db8a-dfdc-4fd2-b093-80f003c335db", "comment": "Malware payload", "value": "28bbf28f562be4c7849a96b007199a422ec1a6f0e167a2f9bd35a62095cfe73a5d02fc7623042b4bfc01a9bf89b719f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725666, "uuid": "d4d261d8-6635-4f69-9a86-e794792d158b", "value": "T18F95D600D701521ADDBB35E94BAD313DB10CEAE0131464C785C8AAFEDBAA6F13E355DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725666, "uuid": "a982c1f9-bd92-4807-a136-13e02e9dfe9c", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq8k:HLz6va++B6xNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725666, "uuid": "4d77912e-88a1-4cb4-9c40-2dfed9fd175a", "value": 2000644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725666, "uuid": "0e488014-ea94-404d-a7de-d360bae36184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725666, "uuid": "91fc7bd7-f9d1-4ca6-ba82-4927a5049633", "value": "6082633da9450793dd0ebb8f1298d919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb15a2f4-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720204, "uuid": "9fb0e022-a219-4f2a-bd55-579ee9dd78b6", "comment": "Malware payload (Mirai)", "value": "a888a3a0ebc42e986e650a4ca331490a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720204, "uuid": "589963f3-1fbd-40b4-ae26-9e1faf47f40d", "comment": "Malware payload (Mirai)", "value": "a9571b12ab88097408344add4e4c976909e54e88775471d757c17cd653039587", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720204, "uuid": "5d1704a6-f664-4038-a493-510e1f663062", "comment": "Malware payload (Mirai)", "value": "5601d2b947e0b8b59b715c53ae9d1df5ffb2ea4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720204, "uuid": "9ae83073-0d27-4912-8ba3-78e7574ffc9b", "comment": "Malware payload (Mirai)", "value": "f4fb8b6ae4c1fdffda53c1b5408fda003d4ed29056ef7a3a1b52ff4aa65c562b08d9425c8d63fbf588519d6caa1415b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720204, "uuid": "fe0fd0a7-d80a-4610-b530-f56935fac611", "value": "T141C2E005656EAD4EC27417FD8DB4C8A13D5A7C22B03AA9C9834BCC4FA0E9B1D9C21DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720204, "uuid": "c91111bf-9df3-4930-84e0-3c30bb7ff452", "value": "768:+NJVvpxA58C5nuErGqMsCG9aMBa9qNArNU:GJVQ5nuErjWMw9qiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720204, "uuid": "315ef2c6-4ed8-40dc-8569-f65ab47653f1", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720204, "uuid": "6b635689-998a-4773-83bf-3fa797a2e90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720204, "uuid": "dc2da8e0-c077-451c-ab4c-f1ad3d1c50fa", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7367133-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725835, "uuid": "bf8d2eb8-ebea-47b2-859f-f7f48730c67a", "comment": "Malware payload", "value": "a995951f20387ab9218490b8234f57e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725835, "uuid": "99476dfe-1230-4d56-afda-d95226bbfd43", "comment": "Malware payload", "value": "a9ae263feea25be9facbcc6bc5942379a07bd08624d74f2323f714c3db5dae15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725835, "uuid": "f374f2fa-c18b-49cc-8e0b-744bf394257e", "comment": "Malware payload", "value": "d6d9b372358209b7b503a35e8aadbd2421c4ee40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725835, "uuid": "4a06686b-a22c-4341-844d-3db89bc453d4", "comment": "Malware payload", "value": "390bfd429f3d42cac3d73159e8d68fefb7539fbdeba3a75ac24f9723bee8e30dc2e736134c0e7748e8f8160d02af55de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725835, "uuid": "2a3e3998-42fe-49cd-b8ef-905ae184852a", "value": "T147E533A2B26611F9E63391388C560D85DFB13C090761DB6F07B05A79EF673BA0E2DB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725835, "uuid": "71bb10cb-693e-4df6-a98c-a8aaaf43022f", "value": "d7baf81e124df171306667f9b54df97c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725835, "uuid": "463d3b45-eaae-43ff-8559-6d137c898d7d", "value": "49152:3nFkBwoOVVizDcVyogoxDRz8pFsjO3mEAyL2hcBcnmDCCryvF5yAmWeRsJjh:3ueZVVizgyodtMF/mExwecnSNyvPEWew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725835, "uuid": "481bfb70-16c3-4a88-a045-95a058d1a7ec", "value": 3081091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725835, "uuid": "89088db8-f54d-44fe-a236-115f1f271ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725835, "uuid": "d6b78080-7360-46ef-823c-981806fef021", "value": "a995951f20387ab9218490b8234f57e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b608f6-4a10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693714582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714582, "uuid": "0452f1cc-6706-45a8-be95-559f9fbc28c0", "comment": "Malware payload", "value": "22b68c2a1c11338ab377d6767ebe31b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714582, "uuid": "9c279c14-f2de-4872-a298-40e6839f3acd", "comment": "Malware payload", "value": "a9e5549dc112cd38b3a3185a3d74fb70d82f32a28a275256f88fc73b87a9a4ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714582, "uuid": "5864c866-c31b-42a6-9b37-71b49790793c", "comment": "Malware payload", "value": "006e47ac409b152b4fd1b48142c5d03e1091020b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714582, "uuid": "8c89bc0e-db38-4003-9689-a5cc3f639085", "comment": "Malware payload", "value": "efef08e80ea9c3fd9956924923b133691e2a426db06a201f07f98a81925db3dc825b6409d2778e895fb8ac4a10082871", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714582, "uuid": "491b362b-8dac-4423-af19-1ee8ecf86619", "value": "T161A73317D543AEB3D1123A364D74251F37AFFDDEAE698E86A7B01D50C86DB60006C3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714582, "uuid": "6d66b093-8c4a-4dcc-9db6-df592f439b21", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714582, "uuid": "c55c0ea1-71d8-4d29-99f5-386d188de2db", "value": "786432:/bhWAKaGkwwO69eZeg6Amd5LEw4OUBKZKN1GJoayr0xmyVMtIa7o:lDKaGkw969e96AwmBKsN1GJovg/VoIOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714582, "uuid": "c57ccb8c-de83-4b0a-806e-f43b719e0ac6", "value": 46958799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714582, "uuid": "3760b3df-e8c1-47ea-8d81-aa6db8820308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714582, "uuid": "c5acba92-6086-498a-aa15-24f91b3550b9", "value": "22b68c2a1c11338ab377d6767ebe31b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6010c625-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714898, "uuid": "df2a39e5-4e45-4bc4-ad6d-4961f481c504", "comment": "Malware payload (Mirai)", "value": "2ef65d1b6d84c5c1192501eba8af2365", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714898, "uuid": "57dd1a3d-885d-4ea1-b8aa-41883e261f1c", "comment": "Malware payload (Mirai)", "value": "ab49ad360677a27e0a1b60cc287e09edc576e612a7a6e575d0a9891bc9253aad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714898, "uuid": "7de44e79-9f62-448a-9b5a-3a6b5a3b4e5b", "comment": "Malware payload (Mirai)", "value": "ca836e92920704b8dc69854ce5ab05921012917b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714898, "uuid": "ee311b13-e1a2-4c33-9806-321235a3503e", "comment": "Malware payload (Mirai)", "value": "913318f22ce318e4e6f5df718d3553a0b24900d2547c80ba807fff1cffe8746167e18d15bd7cee17c3e59acc6b2c4f65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714898, "uuid": "190536a1-b4c9-4399-a036-95917d24a723", "value": "T1FB330891BC819913CAD82376FA2E01CD332663A9D1DF72179D226F1137DA82F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714898, "uuid": "e9929d3b-6864-44d2-b170-7211d7bafa13", "value": "768:BMGLInGoXP3624ILThNGzGUiTkVpCDL0IIesBJNoiJSRdYBNwoxBA1ss9AUE:SMInGoX/r5xUiYVpu0IIeyJhadKxel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714898, "uuid": "08957ec4-cfd9-4def-80cb-3a4f0ac82ec9", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714898, "uuid": "79153402-7998-4a65-8cfc-a6a02a0f7084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714898, "uuid": "8744dbce-37bc-4c9b-81f9-cc0f0249a112", "value": "2ef65d1b6d84c5c1192501eba8af2365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf44f7b-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693777438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777438, "uuid": "0c199872-7ea6-4827-934c-8bf92092bfe8", "comment": "Malware payload (Mirai)", "value": "ea572cbc499bf387a04de9a933a5622d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777438, "uuid": "63a72b8d-ac8d-45c2-ac68-49d18c651692", "comment": "Malware payload (Mirai)", "value": "ad22287cc381a6a45a1491ae2268f3f67eb4cafa8cdf128b2aaa462bf8dad698", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777438, "uuid": "b1565437-47a2-47c5-a1e3-d035e6bc8f51", "comment": "Malware payload (Mirai)", "value": "8d1f3be89edb1187a9d33227057bcd4480036673", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777438, "uuid": "933fa674-09eb-42a2-8335-a0b748166465", "comment": "Malware payload (Mirai)", "value": "fab3d7ee558000d82ee4d7a0fe3813cd545831376be0dce029b0061b758418090ed39107cceb7aa92dd741de651dd10f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777438, "uuid": "107181eb-461d-473f-ba19-23403cc2369a", "value": "T1B604981E6E228FADF668873547F74A31A75D23D622E1D684D1ACC1106F2039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777438, "uuid": "1f2b4799-c1d5-4891-b47c-196fc98af2e6", "value": "3072:vKqYE2L8THS6f+uyeXeLlUfz4Fts2mUPk:vKqY/qy6rf6tsFUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777438, "uuid": "4258f80d-e5f2-421e-8c20-3af1cc43f3d5", "value": 173316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777438, "uuid": "460d0f98-77d5-49e9-9a74-a80e1e9fc3e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777438, "uuid": "54ceae55-7de9-46b8-a4c4-c3fb5a8a8247", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe571eda-4a6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693754677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754677, "uuid": "0294aac7-b45c-4279-92dd-711da14ab853", "comment": "Malware payload (RedLineStealer)", "value": "4b7d7ca21c2a2718da7c60f3fd8e9dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754677, "uuid": "6541e9aa-a8b3-42fc-8a62-a19279ab8c30", "comment": "Malware payload (RedLineStealer)", "value": "ae7fd45be260b90dee8eef80e0703ea005954cf8abca33b8b3b8b9d976814016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754677, "uuid": "068cc84b-2860-4fff-a7ae-a66bfe07bd1c", "comment": "Malware payload (RedLineStealer)", "value": "981b8583b4a94f96d6220db573b13d01e95afae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693754677, "uuid": "15013bb7-e32f-4fd0-a228-528f7571fb51", "comment": "Malware payload (RedLineStealer)", "value": "6775352c18fc56a37a55410bcfb308443534bb2ceb6dc681d2a43826d1825f490bc0e2a2bdbf96528dbb680c0f9c052f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754677, "uuid": "c40b5f0a-61fa-4eb4-acdf-04366ce2486a", "value": "T164A4BD43A5F4FC61D42043798F1ECAEC77EDB8629D246B572B942E5B29323B2D613B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754677, "uuid": "b0a1a50b-77f8-4964-87a4-2e96b2aa2675", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754677, "uuid": "59c21950-1aec-464c-a88d-e65f0915ba08", "value": "6144:eFaYm/Svr6ZmbEmK6XUdsLFeqvUmRnBMmchwoNl2ifJLcMshTS:eFapSuwTXxcmRnBJQnrTLXsFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693754677, "uuid": "0da467f5-2b0e-4d1c-85ff-cf753512857a", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693754677, "uuid": "c289feb8-4359-4a3b-83b4-bc0c127b80fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693754677, "uuid": "04a1fc2d-d562-44b6-ab8f-2e8ea0d3f985", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e13e93-4a36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693731015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731015, "uuid": "826468a5-4895-4115-bd0f-fb836ee05d66", "comment": "Malware payload (XWorm)", "value": "08a288a152c882bcb9df0737b67fb17c", "object_relation": "md5", "Tag": [ { "name": "after vbs", "colour": "#513E2B", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731015, "uuid": "6b26dcd1-d99e-4d3b-9a49-6df1fa46fb22", "comment": "Malware payload (XWorm)", "value": "afd972292b701197aff5e4bf68c616ff7f7eb1a6fb62f93d5ff94eae35ff97ab", "object_relation": "sha256", "Tag": [ { "name": "after vbs", "colour": "#513E2B", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731015, "uuid": "f9fde1e0-e1c4-475f-831a-92f9b3e66dc9", "comment": "Malware payload (XWorm)", "value": "3e2c0709dd7558937d739c7842676b80df821c7b", "object_relation": "sha1", "Tag": [ { "name": "after vbs", "colour": "#513E2B", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693731015, "uuid": "13e27da1-b7f9-494c-9c98-3640e7b42d3d", "comment": "Malware payload (XWorm)", "value": "c182276b255c0f2aa2b67cbbb6ade4de8c5dc369f3437d0f5dc4db20f6ec76f23047b909c42df321a0b2bc56d043f20b", "object_relation": "sha3-384", "Tag": [ { "name": "after vbs", "colour": "#513E2B", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731015, "uuid": "8d4df9a4-1f7b-491d-aa02-4514889c68d6", "value": "T1792600F6B61566F2F28FC1650014BF7983783CD3CDD2836CD72964A00E2AFAD9D19886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731015, "uuid": "cb72bf83-6821-4cfb-8d09-6f1b36323c2d", "value": "384:NOOOOOWCOOraJOOOOOVL5OeOIyj5OOqOO0OOyOOhOOW+jOOZaOOBKOOqSOOCOORP:vV+pU75/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693731015, "uuid": "bb22a337-bea9-472e-9010-dee200024042", "value": 4560420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693731015, "uuid": "83575de8-3f45-4b9a-870d-f16b05196622", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693731015, "uuid": "2d6f80c1-f3bc-44f7-9327-83328c26fa99", "value": "Sexology.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382b2be4-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693750908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750908, "uuid": "712970c5-9970-4654-b95b-3c4b43cb97f4", "comment": "Malware payload (Vidar)", "value": "9ed576976a446215649735cba2e5a776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750908, "uuid": "15f5cf51-2145-4120-8576-e85a2a06c275", "comment": "Malware payload (Vidar)", "value": "b06070443b0693394daced912c6e92a4123c9a47e0e5fd96d4fc345ece746e91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750908, "uuid": "f67cd97d-f222-4173-a5d0-757d22576803", "comment": "Malware payload (Vidar)", "value": "4d890e5c3d07fb1866a13beef7096114cf64986a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750908, "uuid": "1289d6e3-21ca-4382-8223-618ca5e81404", "comment": "Malware payload (Vidar)", "value": "68043fcbe7d016648fd163b0c5a5e05439fbcb8aa7c0b098ec39555d487f6039c12747feec9f53dd36ee5e06a0ba9f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750908, "uuid": "d4eefe5b-04d7-47d4-aabf-49e35b808ef9", "value": "T19705E083E6D8BCAAE515433E8F0E86EC371E78674D25EB9727541E6A15F12F2DA13300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750908, "uuid": "8861fe71-61c1-4851-a5b5-908def517cce", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750908, "uuid": "5bff485e-e76c-4f6c-b567-1c746b4eaf91", "value": "12288:V7ErFSBLr6EKPy/CA4EHGLDUAu2SUY3a1ID+sRNbcPPEl3R/iHsF:ZErFS8yKFUh2SUY3YSbciR/iHsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750908, "uuid": "8730fc42-a4a2-4398-8f6c-32e087e56b00", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750908, "uuid": "3f9ece8e-12fe-4204-a490-89343059de42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750908, "uuid": "873c72eb-ac6b-4325-ad20-9baef1e1ac97", "value": "9ed576976a446215649735cba2e5a776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b669e8e5-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725780, "uuid": "183e1cd7-67db-4038-9761-883611098a1e", "comment": "Malware payload", "value": "fc73de42a7e6b9ab75d302ccf2ca96da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725780, "uuid": "6a3131b5-753c-467e-ae12-fd1090385016", "comment": "Malware payload", "value": "b11593cbf7b92e0a01ad5b7685aa2af041c7ee4522f8a186c0ecca34d8b26573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725780, "uuid": "05b01353-982d-43b3-91e8-ebaf8ca1794c", "comment": "Malware payload", "value": "00692be63af8fa004417fff4b907524b5db89b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725780, "uuid": "bee2d3a0-12cd-40e5-a58b-3b23152fcbc1", "comment": "Malware payload", "value": "e4999e07f4b3b68936e39743851d5cbd6ea27142786ce0220e5bdfe9ad64f879c802e0e9e2d3d0b797825a789b82a76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725780, "uuid": "74860dc1-7bf5-4678-bb89-b311d7d59070", "value": "T1D5E45C43D2E17D5CEA258F729F1FC6E8760FF5A08E497BA9A2189F1B00B1076C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725780, "uuid": "f7c19afd-eb41-4941-b80b-74f4016bd8a5", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725780, "uuid": "d15cfc2e-8ac5-49a5-89f3-1c1bcd38fd08", "value": "12288:o+qUBWMsnV1wCGKOlzOLSsKXxQph5JiL467d9V7XXc8WaA18ZHtzgLUeL/:oQryVAvlA/KP4AdT7hWag8FtzgLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725780, "uuid": "c624da65-7a8e-4ed8-adf2-75b131b95197", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725780, "uuid": "cf7d9053-5b0a-4fda-9082-9c3e36649681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725780, "uuid": "ce829b68-5344-473c-800e-390f7d061a0d", "value": "fc73de42a7e6b9ab75d302ccf2ca96da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f8f52-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770874, "uuid": "7e99bf1c-587c-4577-ab15-3a617d17a508", "comment": "Malware payload (Mirai)", "value": "95c1c597d81c9c76ce7604de309a1c77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770874, "uuid": "7be7ae92-d687-4716-95b7-f6ea93a8e656", "comment": "Malware payload (Mirai)", "value": "b124728c052a8bd13ecdf5ef33ec09b9fd2e303bd031c49a8ce1ca071eece013", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770874, "uuid": "0c1a7642-56e1-4cea-b04c-fe8e9345b93c", "comment": "Malware payload (Mirai)", "value": "3ced5eb86eb39ed224a86693b3d9078d289c44c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770874, "uuid": "8b4e7fe6-38dc-454e-9950-8d60d9502b99", "comment": "Malware payload (Mirai)", "value": "46c71dd01ae8ea3ab005562f8c5c356e9b53791a62bc9f699ce828a8498d1b82e9a3066333bf6e9c630cd6c5322f1021", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770874, "uuid": "c39938d5-e588-4206-b605-dad792218b37", "value": "T18E04971E6E228F7DF668873147F78E259B6C23D627E1D644D1ACC1106F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770874, "uuid": "4ea16469-0c46-42ac-ad89-8d1268b73de2", "value": "1536:dNOzRPvgGsT7AwQ3WodoQUdz5DJ31EdB7Zx5ryKypm/4eMGKsqZGiTrpgJHqmMLi:d0PHF37Zx5ryKem/cGKGQ4HsLS3Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770874, "uuid": "3e3c9531-b1d8-4c85-b39b-9aa56d66de75", "value": 173756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770874, "uuid": "60a6125f-4ee5-40b1-a5ed-725da5a5b83b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770874, "uuid": "ab736c99-648e-46a9-a86b-6390222bc7b5", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c457dfb2-4a92-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693770471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770471, "uuid": "34b7276e-601b-4a63-b0c5-c832a34ac3d0", "comment": "Malware payload", "value": "34aee6682d4cf1f0541ce13554c540fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770471, "uuid": "1769bc4e-8a04-4d0c-b8c5-e7cc5f8799dd", "comment": "Malware payload", "value": "b126f012b066653b5005d397a0b184416dc067b2d590355dc6ef9c48166f627b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770471, "uuid": "15996145-b63a-4f62-9629-85608cf5ff72", "comment": "Malware payload", "value": "00074a344969b746ced5d928b49263bff1eb3da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770471, "uuid": "6f96ce97-ad88-4b0d-8810-27f4beb691b2", "comment": "Malware payload", "value": "56febc1de5189f912ceecae25e9f4b7c63810d178e2f66ac0daf4864b25c7db3007a25c8003ab749a8389dce79051044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770471, "uuid": "7db18b8a-fde2-4db0-95c8-a7683c54c4db", "value": "T1DF44168365D0FFE1E4124375BE2DD6EC772DB85D8E596B4326182E5B283E1B2E613320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770471, "uuid": "95ed8495-6cd0-49f2-95fa-ba05cfacd3aa", "value": "8f32d818dba805d643c0726702e5c31f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770471, "uuid": "f8f27ac5-09fd-4370-8b29-c590096ae1bd", "value": "3072:MoaoHN9Eh8WPW1lrQXRxO0Eg+kzdkPw47Bb/8FHtFLJcP282xe+vsFTwss:hamN9EhyqO2UjGxNcOi+vsFTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770471, "uuid": "2ba46a72-a88d-4449-9932-324ec1493d6a", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770471, "uuid": "80493e73-3c4e-42a8-ac34-44c594f18e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770471, "uuid": "4b951fa1-37dd-4128-afa3-49a3cea315a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1091b197-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693750842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750842, "uuid": "1110d1ef-2682-4593-8ed3-0c3a49cedc20", "comment": "Malware payload (Vidar)", "value": "dbac5ff9ede7d4b61d2ddb6b2bcc2bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750842, "uuid": "f7e665e2-03d9-4bde-ae08-00f7bca9d14a", "comment": "Malware payload (Vidar)", "value": "b32afb81a363656df4ffd94b8c27bbc2a8c0f97d2ca5952fbdfdab237cfce130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750842, "uuid": "d091f6cd-d155-4244-9ce3-96ceb7f30024", "comment": "Malware payload (Vidar)", "value": "cb5e441dd97491944dce657b4d39007bddbdc6ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750842, "uuid": "b787580f-9c0a-40c8-83bd-297428403a8f", "comment": "Malware payload (Vidar)", "value": "dc1584bd30b5d4f2d29d0dd0c56ad9df9f45cc735aaf73a34e73bd6a59da60b10c9883fff4eb68ad35387cf3e4517e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750842, "uuid": "99badb3f-47f8-409a-8d34-7f78566a02e5", "value": "T13374AC83A7F0BC69D42443768E0EC6EC772EB861AE257B572F146E1F6831972D58B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750842, "uuid": "2315a39c-6a84-42de-aad8-e3eeefe5d08d", "value": "ad153f8df4d5e34f536fce54f7340368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750842, "uuid": "03aa7534-e4ab-4ed3-8122-85689631d3be", "value": "3072:JaihA2NEOpSCpglFFXwBqxQhCjoauxwYGQi4mScVB0CxWsJ+atko3kCYPjoW53V9:UAHhinXGhnvz0rj3HJ+atkIGPjfy3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750842, "uuid": "47030240-762c-4aca-b504-52652dc86aa8", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750842, "uuid": "48dd668e-af8b-4282-ba31-a1cbd8c97ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750842, "uuid": "081517d9-9e0a-4d74-b242-3e71fc7367ce", "value": "dbac5ff9ede7d4b61d2ddb6b2bcc2bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee904fdf-4a62-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693749926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693749926, "uuid": "a5aba1a1-21d9-4685-8c26-1a526c65c741", "comment": "Malware payload", "value": "f0135e14840c350c60176002d74c6d0a", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693749926, "uuid": "61d4f5ef-5ee3-4c57-94e1-2b3d314967a7", "comment": "Malware payload", "value": "b408b7181ab5d530e5da80967be73f858ed93a2cfd172131bcea8f073164a5a0", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693749926, "uuid": "86332f08-120f-4a5b-a2d2-933495de86dd", "comment": "Malware payload", "value": "c7549e4c7fd7738afc34857626d6a43587f2d533", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693749926, "uuid": "8ad0d3fc-b3ef-4792-a8ab-c35fbd76e825", "comment": "Malware payload", "value": "a4c4fe967cc091ced5aa8aa9fa2efb04fccd0db9db8105944b0cd927f0f3fb88c3361f9a0ca1f90451c55aa977a3a898", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693749926, "uuid": "11051e6f-8f78-4bd5-b29b-63f01665dbba", "value": "T12BA67C30EA44012BCE8313BBAD6646D3A92CD621131221DBF6DD175D1BA74D8933EF6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693749926, "uuid": "24571e52-0679-4fb7-8e57-ee2ee3160a4e", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693749926, "uuid": "3908d959-6f5e-4ea7-b13d-90e5b0818d0a", "value": "49152:tWtfl3xiDZjSPQaLOpU0dpBYYZFfsqWGXwuO6Bpp5eIMXYpnF4tk11zppI04zmHz:wtfl0kYax0dMiNsqWGXwtyqIMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693749926, "uuid": "a2ea6fdc-d8b8-41f9-978b-f3a2f2e31b02", "value": 9784480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693749926, "uuid": "a514a77b-6bce-4417-a795-4a76ac12eaab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693749926, "uuid": "007c8a59-6e5c-4de2-8e5c-2f5708b5b78a", "value": "%D0%A1hr%D0%BEm%D0%B5S%D0%B5tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a73c908-4a09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693711318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693711318, "uuid": "4ef0f55e-4011-42ba-ad40-99ec5e884d66", "comment": "Malware payload (Mirai)", "value": "e855c1a7c44f8b7c48cdd6a6e7eae557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693711318, "uuid": "dea9cca9-f7e9-42f9-80f6-0e30ac0518df", "comment": "Malware payload (Mirai)", "value": "b40e974965090a23c5b22fba4649fdf7e56908e047a5e9a16f08769f4a4d8f17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693711318, "uuid": "9262b5de-25f0-402a-a1ff-3122f487ddda", "comment": "Malware payload (Mirai)", "value": "def4760f8e69c7f491e2e9cd4f9f586c9382408c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693711318, "uuid": "dac4d8ca-2da2-4637-94e3-29c9e2139043", "comment": "Malware payload (Mirai)", "value": "77417ac695a3000db998b37bc18711f3c1ff1e581c2063338bd74c8799de84d314b76dd5640ca6d7f7d2ace415a0dfd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693711318, "uuid": "c5f5e963-b8d3-48f5-951e-dc576c79785d", "value": "T101435CC5D563D9FCEC1026353077EB726676E93E2028E7C7D798A932A982603D90339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693711318, "uuid": "26675db4-39f2-41aa-b9dd-7138689a1543", "value": "1536:PRv8GgqHi/TkHLHHgGSzVspWyjZVZNexcP:eG3Hi/T4ngtVspWIZVZwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693711318, "uuid": "40852bb1-f43f-4648-9222-fc859aee38e5", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693711318, "uuid": "23b6ca1b-d05b-48a1-a13e-8cbbd4026fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693711318, "uuid": "2fe5e63b-e230-4560-bd30-0e4e3e57ffa5", "value": "e855c1a7c44f8b7c48cdd6a6e7eae557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40472ba2-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693726011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726011, "uuid": "15f8c4e1-a458-4ca3-8d0e-977d24ea9f52", "comment": "Malware payload", "value": "f18b81ff0e24d0d543a903d110256339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726011, "uuid": "e11a3a48-d009-4c02-845e-d215d77310cf", "comment": "Malware payload", "value": "b46c0dc2aae9a69f770d9c4d48c7f927f4c259436cfa49f23523e27a48072177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726011, "uuid": "7e72ec90-bb04-403a-9164-c83c853041c4", "comment": "Malware payload", "value": "7ac3b8b32ef9399ca1774cdbb7a75a2af1927f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726011, "uuid": "34f0c8f8-8334-47e8-9234-671bad970480", "comment": "Malware payload", "value": "2afb0697966cf4f841e090b4b58c83c93c0191e99f05316d7a59c2f1023316351166fa85bbedb5f9426fd2a941c9702a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726011, "uuid": "eee55336-eb00-4b29-8283-752bca70797a", "value": "T17CC41148336B5BA1F3020DB9A0BC1DC6B136FF58675D838EBC5093527572BA58E6E138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726011, "uuid": "6b041615-c4c4-4c7a-a44c-b61749fd2ce4", "value": "12288:uXXTeqeSGYbZtFLVbu4TbevjtxUuu7T0kmQDBSV7k96m7PH0:uXhGYZdu4Tb2j4uK0tgQVI96g/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726011, "uuid": "170fe216-b5d7-44ea-8797-613beb0fe47c", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726011, "uuid": "f7e6610a-fb1a-4522-9277-1b61e3807a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726011, "uuid": "bac41e32-194e-485e-bdac-90a0ae62c702", "value": "f18b81ff0e24d0d543a903d110256339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365ed3d1-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693750905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750905, "uuid": "b6996f7a-82d4-4bfc-84af-3c260e7fbbdd", "comment": "Malware payload (Smoke Loader)", "value": "276fc114c87b583ec26fae1a02fcf8cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750905, "uuid": "452c1848-f4d9-407e-8223-e0cddb51f095", "comment": "Malware payload (Smoke Loader)", "value": "b5092c84227a07887205d93213947d670014112568ef15f0f61cf6745aa9eac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750905, "uuid": "398f643c-47ad-4442-b427-d7f0961400b4", "comment": "Malware payload (Smoke Loader)", "value": "ec80ff6933b514a05f51b06783fa448165228872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750905, "uuid": "7f7003f8-8d6a-4a11-90d6-34e8c2685fea", "comment": "Malware payload (Smoke Loader)", "value": "a72541520d133bfd28ca658975c545e6df9b57fa3a5a863930b5b1eb39104c3e992af69585e289073935998fe2d1d193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750905, "uuid": "12a7781a-fa5e-44fe-b1e5-6986fb6f15bf", "value": "T100548B8361D4FC72D11603758F1ED6FC372EB8629E296B9727486E6B29322F2D643341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750905, "uuid": "d3834e26-99a5-4248-851f-3bd759e4b12b", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750905, "uuid": "284680da-cdde-434e-97ac-989e78b0c8d1", "value": "3072:BZ7nqzWW+ks068IxkMkwQ6xVBodc/hIr1c0Vh9shTIs:X7nq1V6zyM5Q6xnoeJITh9shT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750905, "uuid": "46e5b888-b39d-4e89-8fea-aa6ea124421a", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750905, "uuid": "687d8ca9-48a1-429f-a977-7cf454f834a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750905, "uuid": "e13c9070-30b1-42d4-872c-dfb2b5ce1b74", "value": "276fc114c87b583ec26fae1a02fcf8cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90393393-4aa8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693779832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779832, "uuid": "19df6ccd-fc4a-48d1-ac1b-b93b6422edaf", "comment": "Malware payload (Mirai)", "value": "5c5e0fd360311e234f3266762306e0dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779832, "uuid": "9502d628-f112-4e4b-ba6a-8417c2024f0c", "comment": "Malware payload (Mirai)", "value": "b5361b43b04e79394c37567f9fd25a3e356375f9ba52ac1fa15ad7264416c7a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779832, "uuid": "7e1af0b7-f849-482b-9952-dda276a7bbc3", "comment": "Malware payload (Mirai)", "value": "22667f6185cfcc6575a8beaf1c546a35b7cb5129", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693779832, "uuid": "5f61fe10-7deb-4b84-96be-dce3ca44256a", "comment": "Malware payload (Mirai)", "value": "5984e15c975cbb4cc37941c52df211e760e11a505b69001cb2baef2c7bb505accd84e7fb460c508dc6a8175043d20936", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693779832, "uuid": "619e684b-0e12-4b98-8994-bc4e40619aae", "value": "T16FE308C7F800DDFAF80AE73748530906B130B7A249925B373257756BED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693779832, "uuid": "07a45f88-baf5-47f3-b8cf-a163ee911094", "value": "3072:mIwrltT5nkqaZ10GT7kzHO6rB1p3VEjbiYLvXb8MyJQAM:mxAoGfk7d1pULvXNyJtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693779832, "uuid": "795f9697-0fd5-4547-9cea-3bd1fb585887", "value": 150860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693779832, "uuid": "86ae558e-bb24-46d9-a42d-fc7d94316d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693779832, "uuid": "48d4e158-b391-4118-bc49-98f1f16214ce", "value": "5c5e0fd360311e234f3266762306e0dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c228151-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714891, "uuid": "9e2a7bb3-0e93-49a0-935d-cf73d7d5057e", "comment": "Malware payload (Mirai)", "value": "0e799cee7a91c39d4def9a4344bac80e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714891, "uuid": "e6582917-5c0d-4705-8693-50d81a81b82c", "comment": "Malware payload (Mirai)", "value": "b53bad49dfa68680b09c1e656a195a7f4945acb8d65fd8badde2cf1ed65d9dae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714891, "uuid": "b91d42a4-4cc0-45ea-8aca-1762bfe6c86a", "comment": "Malware payload (Mirai)", "value": "3c7fb5e8238ff931d0214937f05738eca850663a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714891, "uuid": "e7a3bcb1-2f3c-49d4-bfa2-0ce20babfdac", "comment": "Malware payload (Mirai)", "value": "4b71f3d845ed7c9241322292ea85d5637fffefd846d6543d1bb56d3687ef6da6d9f2e0169041b43e8bbcfeaa50c54ce1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714891, "uuid": "3ca47ea2-76af-477a-8845-a54242a97c35", "value": "T1A3234B41761C0E47D2A65BF4693F27E083FEE9A020F4F588260F9B868175E77508AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714891, "uuid": "562c551f-9a08-49ea-b8a1-219d3a32bb44", "value": "768:ADwEd/2X/wnjv3E9TbSvusR0ws4hY5yuxK8WZ8oqr5CCr0GSvtFABU0s5m7/EZ:jvwUbSvLXY5yuxfKQPg8fss7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714891, "uuid": "1d15661b-cd4d-4f16-a837-4e9938fadf82", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714891, "uuid": "9112c4f8-810a-432e-a868-74acb4eaadba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714891, "uuid": "6af30034-8539-4b39-8942-237d178c61e6", "value": "0e799cee7a91c39d4def9a4344bac80e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37e678b-4a47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693738204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693738204, "uuid": "25ad3815-acfa-4b81-88ee-a14891762a53", "comment": "Malware payload (Mirai)", "value": "a1eb3e6b60d2124d6866e23d5ba322a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693738204, "uuid": "79cd64d6-33ba-4563-9307-7d6e903bf18f", "comment": "Malware payload (Mirai)", "value": "b9042181d0c11607f378014cad3a306cde4befa64f28dc203f72ed758c1bdfca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693738204, "uuid": "dfa34758-1c67-4307-85bd-6e448537cad4", "comment": "Malware payload (Mirai)", "value": "06ee4ccd69b3c22218c362b13dd34db9e0b0b82f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693738204, "uuid": "60863865-205b-4964-ad2f-d12fc00c8ee0", "comment": "Malware payload (Mirai)", "value": "3c987c46606b8455dfdfea0c50e9c5d39c08dc941f68ff5fb2603826bf513188afd80caf239a5a796685d035ed670b86", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693738204, "uuid": "d24615ed-225c-45d9-825f-2855f6b0c920", "value": "T1312339C59943D8FCE81505752077FB339F76E43A111AEA97D39DE933AC82A12E60728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693738204, "uuid": "b45f782c-6ed7-487f-b45f-9fe9a4fa7efb", "value": "1536:ZDUJOwGpvGNw6n1TEA6gFRV75gUyubBOq:ZDkdGpvGNlVEA7vx6Ulbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693738204, "uuid": "78547145-c454-4552-ba99-2ce95a5f34c2", "value": 49884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693738204, "uuid": "4d344bb1-34b5-4a19-b9a8-e2dc45f92f40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693738204, "uuid": "b76b85c4-c39c-4dde-82ae-3f8235db5d17", "value": "shellx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516ca797-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726040, "uuid": "fe53489d-d73b-4508-ac34-0df0488b618d", "comment": "Malware payload (Mirai)", "value": "6b03eba19dff4ff2765b414ad48fe5c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726040, "uuid": "c1f230f6-5590-4a9e-aa07-8639ef51faf9", "comment": "Malware payload (Mirai)", "value": "b9045ef4b54b58c1fc7e8d96ce2cf1618b8251bc402be99f12104f111af2776c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726040, "uuid": "0817d37e-a748-4962-bd7e-d74f5dd9df04", "comment": "Malware payload (Mirai)", "value": "e3b3deb3aac63a4908b2e458039505bfbc17d5f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726040, "uuid": "7c009bac-cae9-4076-883b-216f9db23ad8", "comment": "Malware payload (Mirai)", "value": "660f1ed9fb4edbc842638deea24f6e8916e5831c6826e3b2a40c2ebd369034fcef835dd8b4f98af4ea3243edd5ad08ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726040, "uuid": "10670831-020a-45bc-ae72-9d6df243deb3", "value": "T1F7E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726040, "uuid": "ba79597c-cf83-41e5-a094-c29a414461e4", "value": "3072:dgZc9h1jlnLA2PiXYeyCckVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZkVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726040, "uuid": "c0417de9-4fa6-4e90-ba52-936125fb7215", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726040, "uuid": "ccec79e5-c71c-4878-a3f8-a1921ddbbde8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726040, "uuid": "1ab1d3be-ceba-407b-bdde-89801e7c4427", "value": "6b03eba19dff4ff2765b414ad48fe5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04aa8ac1-4a86-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693764995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693764995, "uuid": "880b73fe-c060-424c-946b-23fce6c3ad90", "comment": "Malware payload", "value": "492bcb37fd78305898f30d19c94bc321", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693764995, "uuid": "404438aa-5a72-4dc5-845e-867ae5dfe90f", "comment": "Malware payload", "value": "b946b9f15ba9ecca3eab336df7b445aefb7b4bbc4392f775209440a2460dadc6", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693764995, "uuid": "9dd36eed-d22e-4452-bb1a-e6008e909a46", "comment": "Malware payload", "value": "814a7eea8809676ef624eb8bbfcf27fa9c43eb6b", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693764995, "uuid": "7096b4c4-7878-4f8d-830c-cfb19070251d", "comment": "Malware payload", "value": "5055c50f2c2985a8732a83c2340767e08a87db0e6685bc43c87fca65128ccea3ce8cf0f65d3eb58892cb3ca509d6c384", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693764995, "uuid": "9e8db8d8-b06c-4176-ba02-4ce39fedf627", "value": "T1EFF7E011A6E49025E2B33A3499B566B48B7B7D239A30C38F32AD791D1F71BC08C75763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693764995, "uuid": "2ed4ba09-201a-47e3-90d0-53d2d1208095", "value": "1572864:XI9ruI5Ujm9gLDxSm6gwehz5DPzhJoBve+nBCzwS:XI9ruIcHMHKz5joo+BHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693764995, "uuid": "b31520b4-ee68-434a-bd00-be4986deb087", "value": 75149312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693764995, "uuid": "f77dc79d-3f67-45a7-bf26-5482bb35bcea", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693764995, "uuid": "22f6cf09-a5de-44b1-a69b-eb13c5aba420", "value": "492bcb37fd78305898f30d19c94bc321.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fbd158-49fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693705811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705811, "uuid": "c8a26130-eef8-4930-a469-0c48d0fc534c", "comment": "Malware payload (DCRat)", "value": "a1a207939d4fdf436da86182072f1284", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705811, "uuid": "7a65616d-e931-4a9e-a291-4ac7f74ec6bc", "comment": "Malware payload (DCRat)", "value": "ba3fd5a2c707bd4fb7d4682649a9e26ba9c2921c838c0250a7773f3a1c7aba82", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705811, "uuid": "53df4b30-557a-44f6-9823-3e15aa530a45", "comment": "Malware payload (DCRat)", "value": "369800eecddf000036e4a7a1bc710d09fccf6bdd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705811, "uuid": "4026c430-98f0-4331-bdb8-9cbbc04f2aa8", "comment": "Malware payload (DCRat)", "value": "923fb7bc83b39f63d75388bdfc5d5bf202e7789307d2a82bd8d61abcd90741b58e1c9b9c7771454db7719e6b022979b1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705811, "uuid": "a3c87b4e-29d6-4a03-936d-113d537d59e1", "value": "T1BD85AD017E84CE11F0199633C6EF494887B0A9516AB6E32B7DBA376E15133A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705811, "uuid": "2652b707-364b-4a7c-8168-a0a5440344d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705811, "uuid": "7190c41b-c682-4761-a68a-ed904abcbfba", "value": "49152:OhjAJVllHZrhbBruPk+xjSMX4ODTDF8OcFSkMh:OgVTVXYNX9mOWSkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693705811, "uuid": "4d5828cd-fc6a-4f67-a431-62b31f55392a", "value": 1860096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693705811, "uuid": "8dc4b46e-ac34-4a6f-85b8-06470142e738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705811, "uuid": "8a7061cb-ac56-4d9f-916c-71f4e2740246", "value": "a1a207939d4fdf436da86182072f1284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285e79e4-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726401, "uuid": "fb231339-db6e-45d9-a621-4309112a4d41", "comment": "Malware payload (Mirai)", "value": "068cb85c9f621986b76fde8b20a02740", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726401, "uuid": "cf0591c3-9f0b-4816-91c1-3f3ed0d24b90", "comment": "Malware payload (Mirai)", "value": "bb9545b0c7ee3050a33b7210fe0a93b48af1c84996afdec64690f570ec68d3bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726401, "uuid": "3d51201b-0aa8-43fd-bada-e85a79aeea96", "comment": "Malware payload (Mirai)", "value": "26662ed3397dcd493eb923834fc0e312771e97b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726401, "uuid": "dfe0cdf0-ff69-406e-a3fe-896edb6434dd", "comment": "Malware payload (Mirai)", "value": "a61db128e3c7a4773f58fb6d485205bab6c648ae5217c44543654916f171fa34ca6452f71857a9389280f7dd12a1cf1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726401, "uuid": "f74cf2bc-ec0f-421f-87ad-bc956d33c75b", "value": "T167733B27A9791E2AC1D4B57A50F78604B2F5230E2AF4850EBC720F4EEF256446613BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726401, "uuid": "0b9fbae0-b285-4649-97df-06a2549969e5", "value": "768:EnoKuChFQjcq09Q9RHgPi74iXN6WsQs+X1ySdFqGbWdKO+bWvaywT:En7uCzQ4qQQ9RHgPU4id6vQzy5YYeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726401, "uuid": "5db182db-0e19-4529-a9a2-fa4925f75440", "value": 76432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726401, "uuid": "125e2e62-fdfd-4182-9fe3-9d14a662dc14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726401, "uuid": "699e9086-e9f3-4b7e-8a60-515298eba750", "value": "068cb85c9f621986b76fde8b20a02740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a44143-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726321, "uuid": "51b39e22-82b3-4c82-a1b6-8a4810dcddc4", "comment": "Malware payload (Vidar)", "value": "2ba7907ff04e64441b520e2e9b09bc4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726321, "uuid": "94f1fc98-7f89-4e35-a946-fbc03aab813c", "comment": "Malware payload (Vidar)", "value": "bddb6a04002e4d0dc4c0fa6a177b77a2086da4a0e71dd05bd93139a0c487637e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726321, "uuid": "640c7b85-9e04-4751-8a80-31809614fa8b", "comment": "Malware payload (Vidar)", "value": "b5e7f6d1a1ae2acb694b3d5f22d18aef644657ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726321, "uuid": "707a2436-a110-4863-b70a-7f3306a32bd1", "comment": "Malware payload (Vidar)", "value": "8527328e34f75a71bce579bf8f01447acab52ed419aaf7cbe0d25393e00aad6442c911d3bb0a724c1b9ab1b33895baa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726321, "uuid": "46687e28-cdc5-4311-8dc7-2595617ea8bf", "value": "T17B159D4382E23D59E9258BB29F1FC6EC770DF6718F097B65621D9E2B14B10B6C2A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726321, "uuid": "c725184a-c075-4c9d-9b3c-19c06b460bc1", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726321, "uuid": "f85b2e74-02bb-48f6-8a75-ad3b4bd9d3af", "value": "12288:YJjmU6f9yH6uDntELVNnEMReNAAf7pYY7iTfCr7VZTeQTSCmc6o9y:YsU61y3DncXhAtv7VdeQWCmi9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726321, "uuid": "d17d8f76-4de5-4f33-9caa-4b331772f924", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726321, "uuid": "faef87aa-6bca-4004-a028-c6e40915f1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726321, "uuid": "2b6b3303-1c91-4307-88d6-1542f4925dca", "value": "2ba7907ff04e64441b520e2e9b09bc4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e76fec-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693725777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725777, "uuid": "d8a6124f-5466-4eb7-b9df-d40eb4b43819", "comment": "Malware payload (RedLineStealer)", "value": "caaf23fc49e1810c03d943ad1f2c003b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725777, "uuid": "fade559f-b3e6-41ee-aff0-99e6edd59725", "comment": "Malware payload (RedLineStealer)", "value": "bfab1100122c3f2dc52479c08fceab6880bf96a20b355c71482bbc3f1fbd7953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725777, "uuid": "8098eb4c-5efb-48e2-931c-7e4cd02ef765", "comment": "Malware payload (RedLineStealer)", "value": "17c182f09b327a451f614f0180f2e3878271185a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725777, "uuid": "6dd585ca-9631-48f8-a964-a7d48f30bafd", "comment": "Malware payload (RedLineStealer)", "value": "e78339f9f9ea1b34f8ca22b6ab2882c426ecbb5f84d5843ea8e977e08cbeef5ae0a5b87080fe2e8189d55c1c8a050c66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725777, "uuid": "53b2c30e-5173-40ba-9491-4fd768c2327f", "value": "T1B7C44A03C2E17D58EA258B72DF1FC6F8778DF2A08E497BA522189E2F04B1176C263755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725777, "uuid": "84406993-0d15-4d06-b6f5-793db927a77b", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725777, "uuid": "fc0ac257-bce4-489d-b035-d6570cbdadec", "value": "6144:MKPxhVZT7PcXRkPeseMiGQV8buFoxJoPtqaUl8mngLUebH/n:MKPxhjzce87+d0P5yngLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725777, "uuid": "ad1e0b86-e935-40f4-ae39-a03b98533865", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725777, "uuid": "3a132be1-de2a-4af7-864d-2845af20ca04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725777, "uuid": "6791cd6c-3376-4266-9aa5-a1437415b655", "value": "caaf23fc49e1810c03d943ad1f2c003b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6264a955-4a42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693735947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735947, "uuid": "080c633d-02fe-443d-8e1a-ae071527062a", "comment": "Malware payload (Amadey)", "value": "fefd36fb3e7e38c793ab02243c3ad664", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735947, "uuid": "925f8c14-6096-4e3a-971f-2faf9a05342a", "comment": "Malware payload (Amadey)", "value": "c1f990342396218e7474cf1af7ccc1dc325c480eab04e3c303ecb0bba15a0688", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735947, "uuid": "c403f905-3985-448f-a5de-bd581cba2475", "comment": "Malware payload (Amadey)", "value": "4e0f586b52c8b0704a345d3556c8bb58714e33d4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735947, "uuid": "9d0de66a-5bda-46cd-a616-84705de15a86", "comment": "Malware payload (Amadey)", "value": "317adf870b6e1e71444cac69c620148891882a164c08ab9593cc2db49df3aa2be29bd779cdd6719475691f9e13a22a40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735947, "uuid": "46ffa20f-8259-4b8f-ab3f-57dde29b4014", "value": "T10515230297ED8433D8755BF02CF6079307397DA19E3C5BAA368A2D9A0D7348435B636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735947, "uuid": "99df259d-eb08-45ed-b887-1dddbfe491d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735947, "uuid": "ac810dc0-2f15-4cee-a158-29d873b71e7b", "value": "12288:CMryy90hH27bhfsdRQ6z7/ONtRdl78nE97+zVSUZv2E9ygOg4g1D6B8vF/o7+qjL:8yFnhUdZuTIQ2kE9jiI+ivFG35x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693735947, "uuid": "dac23b37-4943-4457-ad70-f52f4f86b22a", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693735947, "uuid": "fcced81c-cc5b-495f-94f8-1d0e15307597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735947, "uuid": "4721afe8-1c2a-43e0-bb34-0a8f951f7cf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a99978-4aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693777426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777426, "uuid": "5ab743c2-ede0-41f9-879e-3e38b7632d2f", "comment": "Malware payload (Mirai)", "value": "312e75931ce22f0a067cf4d9919ac01b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777426, "uuid": "a210b272-fa38-41c1-af46-2d8120fe9e7e", "comment": "Malware payload (Mirai)", "value": "c26e36df88aac5a17673db47b30ff777dc4691af14f2730699e2e655a4a08c12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777426, "uuid": "ee307ebf-0f38-49fc-9ba2-66ed9dd215be", "comment": "Malware payload (Mirai)", "value": "a7c31961d669f800fb946ef1b7bfafe6ca05d5fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777426, "uuid": "59d783dd-678d-4155-b531-9940052fa22e", "comment": "Malware payload (Mirai)", "value": "c1064eb2d65a7c3ec59103127f87e3cfe1c33c5b6f92f8981387aff9479eaec548579c6da95966682ca30a6d88eb3c87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777426, "uuid": "0448554a-6d90-4fcd-8511-5fac3db409f9", "value": "T193042A46EA404B13C09627BAFA9F42453323DB58D7EB73059528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777426, "uuid": "18f9adcf-edbe-47bd-b6c2-4dc951782114", "value": "3072:tfyzkBnMyiKjWLahAQimtiBDvWANgu/J+XPSorM/Rj/npJg:tfPnMB2wahAQimtkaASu/J+fTrM/R9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777426, "uuid": "ae217ae7-2672-4c9b-89cf-3153ca3f021d", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777426, "uuid": "8e24b37f-52ac-48a4-850f-a068f9dfd879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777426, "uuid": "2a5da979-27ba-4bc7-8a68-2318e6ad36f6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787671ee-4aa3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693777645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777645, "uuid": "c6d0fa5e-f0d8-48ea-bca4-af68aae53fe8", "comment": "Malware payload", "value": "184f9cf54dd24d966a684696d5c4141b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank stealer", "colour": "#F60915", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rare sample", "colour": "#07440D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777645, "uuid": "37f81c25-9442-4dc6-a643-dcf106714445", "comment": "Malware payload", "value": "c364a57da2e542582c457aee8f3aaa7ab5cf70c58e91a0d260efc87db403b6c2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank stealer", "colour": "#F60915", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rare sample", "colour": "#07440D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777645, "uuid": "24c912ca-448a-47a2-8ece-820fd5360439", "comment": "Malware payload", "value": "d0d593d9745b02ae9469e482acd46a5100661ead", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank stealer", "colour": "#F60915", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rare sample", "colour": "#07440D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693777645, "uuid": "c9676f27-4c67-4711-b04a-9a357db8579e", "comment": "Malware payload", "value": "0d44c027ebc274293b6ca94e5c57bbf46df9e10e4a1e99c75bbe436311eab598181bbb758baf72e3defe510a97d6ded0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank stealer", "colour": "#F60915", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Rare sample", "colour": "#07440D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777645, "uuid": "f4d5da08-87c8-4349-95a3-712964472fbc", "value": "T10A7723D7AB18F82EF4769632CA6F8137F16E8E051443DBB23505732824BB0465BE9BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777645, "uuid": "abf53ddc-b323-4dd3-bd44-fba0b4df81ff", "value": "786432:3lGffLThFqyIXZftzSJV8AbWv+W+E0/eantHx5Or9o7U2KXcC:MfDThFnIXZftzSJzCK/7kr6A9sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693777645, "uuid": "48841262-6f99-4672-b2d4-3a3b770b60dd", "value": 35584843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693777645, "uuid": "85037eaf-a582-4b95-bb79-a258b3f6bc67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693777645, "uuid": "6c8f8e45-10b1-4d03-b975-88e5ff6c09e4", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c1e5a8-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725678, "uuid": "87632346-1a30-424c-a979-839771184648", "comment": "Malware payload", "value": "cd18db1724b079ed3a5728ce02f83396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725678, "uuid": "8d43e5d7-83f7-4385-b559-8c04449ab6ce", "comment": "Malware payload", "value": "c5d6bf421eb175009a46f849dd72aedbd1a2c23315d9de26c8643b2b45bc2ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725678, "uuid": "caa64f01-d34d-402a-9316-c2d2604a4998", "comment": "Malware payload", "value": "886acc6ba9b0e3bc4769c339362f40714cf184fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725678, "uuid": "e81afdc6-cf6a-4d92-bed5-ce087e50e87a", "comment": "Malware payload", "value": "36df92097f926f934017329f41fbae29b2dfde4b6490ebe124df53a9525d37036163d07f9d9ab82911e83ccbe1626eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725678, "uuid": "9d2f5d56-dd1b-4573-ac5d-a5f906dc2f3c", "value": "T1B6E48D4382D17D58FA258B729F1FCAFC770DF6A18E497BA922189E2F04B1076C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725678, "uuid": "73c62b2f-569a-4fff-b055-ac185fbe1ea9", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725678, "uuid": "f1bb71c9-f8fc-4634-b16e-b086bc01ff2f", "value": "12288:Z6EfT7iH5Ixu1JUfhubzLPFC5QJY3pgLUeL/:Z6UT78IeJUfhubzLdr2gLHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725678, "uuid": "167a80e5-e541-42a2-972d-c0b40caf1031", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725678, "uuid": "093e1b4d-6777-4544-b977-1c087a9f446e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725678, "uuid": "f3852827-85d6-44dc-aef1-952a3fb230bf", "value": "cd18db1724b079ed3a5728ce02f83396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f28071-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725860, "uuid": "61d7045b-313d-4968-9689-42ade3b5da27", "comment": "Malware payload (Smoke Loader)", "value": "ec40b922a2c9e5b3f1516fc017c1e9f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725860, "uuid": "36577a2b-17ac-42a9-9044-d9b8a98a704b", "comment": "Malware payload (Smoke Loader)", "value": "c645fa0601d7ddd315dd1ae5a4277c89e7161b619b19efcfe535bd3eec264c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725860, "uuid": "146a634e-e7ec-4b8d-9134-c69d95fc739d", "comment": "Malware payload (Smoke Loader)", "value": "55ce5601ca9bd18bcdcfc8cb8bc521de86b7c63f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725860, "uuid": "b4e35f78-9e14-4e5c-b1d4-3ff5af3a5459", "comment": "Malware payload (Smoke Loader)", "value": "92ea828f83398a5d5c256f60c9139b260e9a18beda766bc69e14c439291b826cb8d29b390d52bc876faaf8e8ed8fe3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725860, "uuid": "f7ad5bb3-ce83-47e5-b0b0-24a480be7aeb", "value": "T1C984D64392E13D58EA268B72DF1FCAFC770DF5A08E497BA922189E1F04B1176C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725860, "uuid": "17ac053d-a589-4a46-872e-c67329186792", "value": "05ee59df2bbc43c078e8ef99811a7d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725860, "uuid": "10061fa8-b1d2-47f4-9cf6-0ad7929f0e41", "value": "3072:78LQQSSX68NpAAFfbPrV7HwA6MQI+mue31p3z9ZZhkL4KNKLPcOJdxH/WlE:jSK8NpAuN7gI48CgLUebH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725860, "uuid": "f0c30a9f-bb4f-4573-82c8-470df3bcb637", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725860, "uuid": "1de9a355-e8b6-4f9f-8cd4-4e7e26512c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725860, "uuid": "3a9b0aa4-1f54-4e7b-96d6-6b64ed7fece1", "value": "ec40b922a2c9e5b3f1516fc017c1e9f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a4cee0-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714929, "uuid": "e595afa5-8038-4a80-8036-78c41c6c3f5f", "comment": "Malware payload (Mirai)", "value": "8905d60e9aae8ca4d40ba1880d784238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714929, "uuid": "c0fa7b0d-6026-4502-995f-a6badc00c55f", "comment": "Malware payload (Mirai)", "value": "c6bfc4b243e6291aa147dcd9881be43623051eba6a298abc566f10d2fb39430f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714929, "uuid": "5f58d512-f3b6-491d-ad95-a2a8fd075f14", "comment": "Malware payload (Mirai)", "value": "5dc57d4166c8706e6cf84d86b40f8e6c02b180da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714929, "uuid": "36bdfc4e-8800-41a5-866f-8a70ae977d86", "comment": "Malware payload (Mirai)", "value": "42fde58e435f852e838e3de2059eb5ea33094d925eeb044f1068a6a7a2e5cb5400396733824196bde03f0087c17cdfb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714929, "uuid": "9e81ae5a-1c52-4964-8fc8-ca31daadf372", "value": "T175338DB7C42FBD80E159927879244B786B63E40296933EF5974AC6974043EECF6093F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714929, "uuid": "4f0aeaab-3f35-45d0-91f1-287b67a7f894", "value": "768:haX/Hm/aAWj65l19KwtAnHErRqBDIerNyT5jdI5/ek74l+CsomrnCIUE:haX/wabuswtAeWI0yNZG/i+8cnCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714929, "uuid": "028ace1c-6f06-4008-a94d-bec95e936614", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714929, "uuid": "fd91fd01-1c4a-4071-b924-5fd188ea5fc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714929, "uuid": "91b6d091-0942-4856-86ac-62a04f63eb3b", "value": "8905d60e9aae8ca4d40ba1880d784238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b74768-4a26-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693724118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724118, "uuid": "1fe5c5e0-60bf-4a1f-9253-24010a6db87b", "comment": "Malware payload (Amadey)", "value": "e1f0253a23125b5bf1a4bac890ac4ddf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724118, "uuid": "be0d5a25-5f66-4391-8157-d954ccfb7425", "comment": "Malware payload (Amadey)", "value": "c82ae04b929c0ce3df439d0b8e258703fccadfeeabd355706f8601104b52eec4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724118, "uuid": "58e957cd-002b-4339-8994-475d86bd4efb", "comment": "Malware payload (Amadey)", "value": "80efca30c866d7c6d55141ea714d73533c92878c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724118, "uuid": "e8751477-7637-4a9c-a9d0-8dcb11eedfbe", "comment": "Malware payload (Amadey)", "value": "01870eabdacd4853591ae3a6fb8fe28cf32fe7de8cc665d70136dcb2831a4120c0a6268f3b83fa6afbc9ed547be542dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724118, "uuid": "8d4d0977-a68d-4fe0-b7ff-90608d452db1", "value": "T15A6622B3061401C8F387CC798136BD74E2FD2F9B06C6A8B59AB875C50A327D6E5127E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724118, "uuid": "54700ac5-8139-4215-adb8-600b7c252c1b", "value": "ecb125da1bbce59b61a3dc18c66efab2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724118, "uuid": "d58b3a24-ed8d-4903-b806-c44f9f9c0bdb", "value": "98304:mC0+v0HZRqvQatWSCG1EodfTRWAD7XPTl9H17aa2/96qtm6E2X2p8jzXPL42:mvIgDlSPC0rXDpaa2/hm6X2pCPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724118, "uuid": "cc762618-e85d-4e9c-90a0-7ada5b726038", "value": 6915224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724118, "uuid": "000cc89d-8116-4554-95aa-8c88e6c2c0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724118, "uuid": "da5993b6-9082-44f0-a21c-71765d9e859a", "value": "e1f0253a23125b5bf1a4bac890ac4ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab29364-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724418, "uuid": "e1766d28-2057-4343-a789-e7d7a587f04c", "comment": "Malware payload (Gafgyt)", "value": "d29db1c82bc3e0f1506e610b011fab58", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724418, "uuid": "bbadce88-0989-42d5-bf04-9f4b2708c91f", "comment": "Malware payload (Gafgyt)", "value": "c83f77888335538dee531a1cbfadb76b3635378d25a2d5ee880b2d35bd70240c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724418, "uuid": "c1a8c5a9-d471-49e9-afa4-f87ff06a355e", "comment": "Malware payload (Gafgyt)", "value": "510d2ee26f7468b3c77df6f6e5a2fb19f83f669c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724418, "uuid": "43b98304-48e4-4b46-b3ed-97b54d72a3f8", "comment": "Malware payload (Gafgyt)", "value": "a85a62bdb70ad7481ac01d8a15051dbd348c123ccfee2822feb2ef71e80ef92fda788d13497fe06ccdc33e592254f6f4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724418, "uuid": "945cfedd-2a6a-447f-81b4-96c17c17385f", "value": "T1EAC33926B9419F12C1C325BAFB9E964933136FF8E3EF7102C9209F60278659B0F76951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724418, "uuid": "a9c0c113-a7a0-47da-ab78-fa225f3e849d", "value": "3072:2UsYGnGGLaBVXZL7vFxpjCm1glIfsfD5hwpusu:2nYGnrLaBRZL7vFPjqlIfsr5hNsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724418, "uuid": "82b14cf1-3a52-4353-9889-9bb02e6bf67e", "value": 128620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724418, "uuid": "ae73d726-0e18-4def-a7c2-3156e2c5033f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724418, "uuid": "a8384799-6781-416d-9be1-aa6cd5ec6feb", "value": "mra7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd27022d-4a59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693746004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746004, "uuid": "84d02380-6e61-4cde-853c-2d76931eeec3", "comment": "Malware payload (Mirai)", "value": "49456fe1f685757cc5fb018abc280158", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746004, "uuid": "32d36ec0-43b1-4195-9362-385913ad9fd8", "comment": "Malware payload (Mirai)", "value": "c86d39e8b7ea543ab97df45f5ed8cdab54c0ed922eaee53b6190dda47f9eaa95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746004, "uuid": "11cde9cf-3f04-4248-be05-83d69937b451", "comment": "Malware payload (Mirai)", "value": "543302b53279f23fbb2b4bd5d85e5b6e8dc59fdd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746004, "uuid": "9a257d15-05fb-4d81-a2c9-f2decc1cba6f", "comment": "Malware payload (Mirai)", "value": "30c01b1e89cadbdbadb5684b5693e2609604da3d64c3a27d7e6cfa6b6432afc80ae7f8e3c339a3e61109eca0f249b954", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746004, "uuid": "89362e92-1755-4024-af2c-91563f52cdf8", "value": "T1A3C2E0E63E77799BDE250039386DCE3281B0F062D75EA713D241920961171B9BB728EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746004, "uuid": "95bdda51-0fd5-46b2-bc54-f045239e3829", "value": "384:Mw1DMwk8JPyG3GDZaEXVZVBb6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QCHwOj8hHNV:pMwoDZLFbBb6HQHRYfeAxdd8XQsUU0N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693746004, "uuid": "7090bdf3-0965-477b-9a75-0d7d776fa7fd", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693746004, "uuid": "4cf08cd2-90ba-4112-8ca6-c6754e8a11b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746004, "uuid": "744d8eed-50f2-4bbb-b5b2-8337cef7eab1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea23c918-4a94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693771393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771393, "uuid": "aa8ab3c3-973b-4626-8065-4519eef97268", "comment": "Malware payload", "value": "145788636ed26bce28ca5d65cd05d138", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771393, "uuid": "6af42f23-ebd4-4f88-b8e4-786a65132944", "comment": "Malware payload", "value": "c9a743c0eea1cc772d4f5c7f4a4d1043f548499d41a3f54278fdc5428481de8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771393, "uuid": "9c22dc00-98c0-404d-bdfc-e225a3d8d0c5", "comment": "Malware payload", "value": "2a3f73411575e37739ea26d14ecefe56cd4023be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693771393, "uuid": "dd6d9f68-29eb-4662-9e43-a8d68f286133", "comment": "Malware payload", "value": "2cd77969a33b73941b8c91bb02d697f9ea4408d1e2bb2a0df2ed9bb601441e438a11b617bfd481d29115141bf3e8f438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771393, "uuid": "88918c32-031f-4d19-ab74-113c7bd0c491", "value": "T15373BF42E5C05425C29232BE27B13AB25971F5BA3651C2A5798CCEF9DFC0DF0A236387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771393, "uuid": "a5aecfe0-ad1d-421d-bfea-2c54f984e83f", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771393, "uuid": "ee3fa2f0-6315-45af-b698-f724e371354a", "value": "1536:IGTT6NerLhbkfltpMD4BQKDPyOMb+KR0Nc8QsJq39:6NC2vQ4NPHe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693771393, "uuid": "a2d36b1f-faa2-482f-9a82-ce9b2d8a5faa", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693771393, "uuid": "a36b787b-2472-4ebb-8d8a-562339e7d6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693771393, "uuid": "4efa571a-a9c9-4eb1-9a4f-7cc535378f9b", "value": "145788636ed26bce28ca5d65cd05d138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0547f5ea-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725912, "uuid": "335047b5-0e5f-40d6-b6ed-c1fd56f2b45d", "comment": "Malware payload (Smoke Loader)", "value": "336381182045398c0dc0b9a346d64a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725912, "uuid": "0668781b-3ef2-4543-bca7-0c5f7830d001", "comment": "Malware payload (Smoke Loader)", "value": "c9bfdf471598a56a2c2f8e7ae923c4f05310c919ef4b808276e4a4d4c771dad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725912, "uuid": "8892bc62-f808-4924-b576-b0879719abb1", "comment": "Malware payload (Smoke Loader)", "value": "2dd63fab878c3ff266f16a6a6b4d91ff462e774a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725912, "uuid": "c830d537-5281-4b86-abc8-3b732522c9ff", "comment": "Malware payload (Smoke Loader)", "value": "c136f180a12249a15212926d2095a11a43f404bcab172fce8a5d39d8217ebaa30a91f342a32110a007758164e2dc556e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725912, "uuid": "66dc5c33-d9eb-44e3-a201-524897bdfbf6", "value": "T16B547B83B1E0BC7BE52607358F1EC6FC772EB8684E256B9E27445E1A1931172D6BB301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725912, "uuid": "f50f9b1e-3ae1-4e6d-9c62-0cdb5a5c4cbb", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725912, "uuid": "e1dbc59c-ea7a-4347-96d8-bd021948acd5", "value": "3072:BaBTTiP7JisbW5kMoI64aoIE8cXQa3Er/x6KtR7tYM54swmr0ax6J0FuMy9f:M67A3nTaLEVXQaaMKvdcm4axvuMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725912, "uuid": "ce7d46cb-3496-415d-a46f-310d4c68bd0b", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725912, "uuid": "e23deedf-383e-41d0-b862-5e578e70632c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725912, "uuid": "1ecd88a6-c9c8-495f-ae08-e8543b87b7df", "value": "336381182045398c0dc0b9a346d64a19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131a463c-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770603, "uuid": "93710500-cce3-408e-9c5f-22bd27018c59", "comment": "Malware payload (Mirai)", "value": "08c6f0b7787d061e38ce5e8a2e17a804", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770603, "uuid": "047fa2c5-6eb7-4f9b-9816-060499d5d4ae", "comment": "Malware payload (Mirai)", "value": "ca069bbf45904ab6926fc9af9285cffe2f581e2cf0ac072a02530a6b268bf47f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770603, "uuid": "af1a0e92-a550-4734-bb53-f40e20081dcd", "comment": "Malware payload (Mirai)", "value": "93066ee914a17582a91699f41e97d1da6deaa7b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770603, "uuid": "892525a0-638f-44e4-b714-499eee667a9c", "comment": "Malware payload (Mirai)", "value": "2f66852778df44642caf6a1065dcc338b04e90ba7ec7613cb1629564bc31c347d8cf3439e407b9496211bb7e9e8601a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770603, "uuid": "7bb66da6-aab9-43e1-8c44-775ed8487c1f", "value": "T198D2E1815DF24A81D29C81B8927E2F2C7061B0A2B496913794947D7E1B9C7F77B04BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770603, "uuid": "750fd1c4-1699-4a3e-88a2-c96db3c46760", "value": "768:hhKL9pmT5zLuKMZ+qhxLzjhLLi5jrNnbcuyD7UHQRjrX:hQL9pmoHZ1H3tLLcnouy8HyHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770603, "uuid": "a7530ad8-ab62-4ecc-8f84-85855ed42d2c", "value": 31060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770603, "uuid": "993ace1f-6511-4af5-bc44-d6b42d9a831a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770603, "uuid": "f41ea2e1-9939-4dee-bd16-5d6c6ac02f81", "value": "dark.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b119288-4a11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693714916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714916, "uuid": "10b5a3ba-3cfb-426c-b38f-480d7081121f", "comment": "Malware payload (Mirai)", "value": "a737778117b9eccecac76391c0f8565c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714916, "uuid": "f5bac5ea-df21-40c5-a645-0065a37aaaa8", "comment": "Malware payload (Mirai)", "value": "cbe0c1cd763dbe213b1ae64ffdb0ff6ae0117d633c39ea491ea37c6094179199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714916, "uuid": "31b851d1-c363-48d0-9362-6801ccec89ec", "comment": "Malware payload (Mirai)", "value": "9fc84dfd78a672d73bc5ceda940b2228dee21810", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714916, "uuid": "0a5549f6-8ad2-4846-b5bf-d34995b5cd0b", "comment": "Malware payload (Mirai)", "value": "2cf99e2dc7a5c52355e436fb20c4f947865ab06f6378f18831aeb63d4fa85823d07fb4e3b64e6a9ec40d9faa0f7ef1fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714916, "uuid": "4234b48d-0cf3-4bbd-aaa4-f74861099067", "value": "T17A630846B8918B11C5D513BAFA2E118D331753B8E3DFB212DE106F24778A92F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714916, "uuid": "cf8acf94-67fc-4333-8e44-44ccb939b086", "value": "1536:ehnorhjw1/YrFf34msBlQYKhZmczK9v3VXbAVJqrxwKLEIFijDsaZW1:Q/SRImgDK+czK5VLAVJiuDsaZW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714916, "uuid": "9242ff12-3e68-4f36-ab9c-a5d45f124f5b", "value": 70912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714916, "uuid": "3a43b539-4ea2-4b89-b418-a58cf74941e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714916, "uuid": "e12674b2-ef20-4dac-b4e7-4805b6e5fa40", "value": "a737778117b9eccecac76391c0f8565c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f30483-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693719949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693719949, "uuid": "d5f8bf42-b7d5-4f1b-b852-08514e27bbe4", "comment": "Malware payload (AgentTesla)", "value": "311659f38280eeeee131b4a2381cfa91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693719949, "uuid": "54970da7-eb49-4905-94f7-046d5eb94103", "comment": "Malware payload (AgentTesla)", "value": "cd4010442c335b79b12db17c9f41bc5c7f78bba720ae3a804bf5e9f638abaa95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693719949, "uuid": "572cb733-9aba-4f70-8fa9-b0bde34567b2", "comment": "Malware payload (AgentTesla)", "value": "79311b6d0e8b8e508033939ffbcf882601616386", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693719949, "uuid": "35def962-00e9-4a3a-bbb3-2c6fedde7ffd", "comment": "Malware payload (AgentTesla)", "value": "2452ed9fca878195e65d06b14dc2389c656b34bee1a02b24fdffa427c9bf1c690ec549d5a81fe60ecf85d8b810f19801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693719949, "uuid": "2ad39d92-f011-44e7-b743-64de9004eb7c", "value": "T131B4F48052A78F9B074F9402BD5CCA3D3DA246AAD0D3B247FA5BF4C92051746C5ECF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693719949, "uuid": "f8ba7dc5-bb70-4268-81ba-252630eb4b22", "value": "24:XTATed2751RCPpqmyjuK1WIGpZkEsYcS20QUNGvepXW0VB:XUB7vRCRyuKAhpZZdcS2sEQdVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693719949, "uuid": "bc9af84f-31fe-4fc4-972d-c0c0d894c138", "value": 502531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693719949, "uuid": "fccef709-72ea-4926-b6c9-5e14633838cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693719949, "uuid": "cba69444-8384-4dd7-a7db-4d0c98267b66", "value": "lnvoice_1882936796.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74865fb4-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725669, "uuid": "f7737418-c588-405a-a1e4-4ee3c8506537", "comment": "Malware payload (Vidar)", "value": "6d23627f776c90f686e5768774aad09f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725669, "uuid": "55593b1c-dcc0-4035-8931-e77f00a57c9e", "comment": "Malware payload (Vidar)", "value": "cddf2ab61b0857d22423a4eef6ab476831209e7dd096776f284125d9b3162e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725669, "uuid": "b04e0772-3c6f-496b-9b0d-80174d90f36a", "comment": "Malware payload (Vidar)", "value": "4fb8f536786ffcfae667af641d29bd3e3ffc0a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725669, "uuid": "6918ffd6-630d-425d-a731-3165d9a68473", "comment": "Malware payload (Vidar)", "value": "9f5686acffa26112d5ff848664baa7b8b38bf6d2f21d1a01c9bcd0af4a1223cf4a2d18880ee66b1d0720b31cd59ef78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725669, "uuid": "7519379f-f9d4-4796-9b10-4fc925dfdaf1", "value": "T123A4F84392E13D58EA258B729F1FC6FC770EF6608E097BA923189E2F04B1176D263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725669, "uuid": "7794048a-2363-4792-8fcf-4e9fe74493ad", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725669, "uuid": "50d0dc39-8aaf-49bf-a03a-024183b2ec00", "value": "6144:a+RNrHv44H2i+SAWU52gqZer/7IhLgLUebH/:a+RNrHNH2is/wJZW7igLUeL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725669, "uuid": "10018fef-1e16-4d62-82c2-2214e7bfec08", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725669, "uuid": "3ac17cb0-3c1c-4a50-a190-c78cc081d6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725669, "uuid": "37c31f78-3333-42ff-871b-1cc34000d918", "value": "6d23627f776c90f686e5768774aad09f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444873be-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693726018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726018, "uuid": "316d2cec-5428-4aaa-b7fd-64718a2ec8a1", "comment": "Malware payload (Smoke Loader)", "value": "72b5cee29a2845d29bbad1060b2f3041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726018, "uuid": "5f1060b8-c387-4745-b35f-838deb0e4938", "comment": "Malware payload (Smoke Loader)", "value": "cfa9f12a8d7f1970d274d25b7f7ef4512d8d9ea7fce7e22532e97802b55ce104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726018, "uuid": "82b3a61c-078e-496c-b8a6-01f126fb1fa0", "comment": "Malware payload (Smoke Loader)", "value": "c646628d18178fa7d74f35290f930d07431535e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726018, "uuid": "4affd4f3-9fa2-4fed-a01c-c7fadcf26af2", "comment": "Malware payload (Smoke Loader)", "value": "5a53a9b6ad883a9103720faeb954a512523671d0064884a63aaa054f64a564d2ccc93dd35c3131301c69dd6f7b7489d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726018, "uuid": "c15c6672-977e-493d-bfd9-707bd59c5a15", "value": "T1CB548C43A2D1BC7AE02607754F1EC6FC772EB8604E297B5627445E1B19B32B2D98BF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726018, "uuid": "89ae736e-9d7f-4a4f-828e-be905d77fba6", "value": "a90bfe185c06be0aa4a37134cfb76f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726018, "uuid": "1a16a9de-b5ec-49e0-ac1f-0c363d70b229", "value": "3072:eEdxCMDhzQeazbscxPqB396H1Q/TEYjDPRYw3Bmfj6qT0pfqhLNqgryzxh:9xueazowy396Hm/PDPRPxmjGYNqUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726018, "uuid": "a9eff165-e693-42c2-83f8-896034357b0b", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726018, "uuid": "05ec1392-c241-4a93-8b75-b08418eb6c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726018, "uuid": "067f8c33-0411-42e0-a040-7e78de0ffa11", "value": "72b5cee29a2845d29bbad1060b2f3041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8958d63-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725837, "uuid": "b36d589c-580e-4070-a205-e022e7da3c9a", "comment": "Malware payload", "value": "36ee89c57ce73704384957ff6675e6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725837, "uuid": "8c63d6f9-b4c3-4997-96b8-c507831980fa", "comment": "Malware payload", "value": "d120531e71e0d9b2ae07e4010c9f822445ea11aeba73d675b318ac67735382cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725837, "uuid": "b291279b-1e21-4838-8874-e0ffd6110476", "comment": "Malware payload", "value": "822389b023570f39edc6223d1277f24213712a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725837, "uuid": "d2130140-7e0a-4f2b-bef3-860ce8d0d728", "comment": "Malware payload", "value": "fae4b44937746320e027dc7489675cc396bacdcd446f7b5ff297083b5e8d9cc8bdad6ea5f43e20a036aa9c6ff5258074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725837, "uuid": "3dcaee82-92ec-4a30-9eb3-e1aa07e4de2e", "value": "T12BE46C43D6E13D58EA258B728F1FC6F8770DF1608E497BA9221ABE1F04B1176C263725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725837, "uuid": "61a0d819-debb-4be1-a9a2-1b4fc078d155", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725837, "uuid": "49db1571-bbe1-4aac-889d-4f55bb47a887", "value": "12288:8PHfJpixLId1IBT4nYGgvQylZGpAd6GQ4QhSmVTk08gLUeL/N/:8P/Jpi5IAcBYjGp66Gsh1VTk08gLHL/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725837, "uuid": "817ae1e5-a534-464c-b3af-87964b7b4f9c", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725837, "uuid": "16d6ff40-e546-4866-aaab-f660208f2f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725837, "uuid": "632e2f7b-03d5-4345-8928-c60de66b4b2f", "value": "36ee89c57ce73704384957ff6675e6df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac8de41-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693725734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725734, "uuid": "07d8a213-d58a-4e02-9ce4-eeff6a429c9e", "comment": "Malware payload", "value": "2dcc077d01271bb3ca1918b80fff190a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725734, "uuid": "9f7e9c13-4f34-4e48-a469-0600f50b8294", "comment": "Malware payload", "value": "d14987e447f7a8ab7aaa6a7c6ed87b2442ded84862d061581defd6ad5a7df97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725734, "uuid": "1e03c8c4-d031-409b-ad52-b4b3a14d4659", "comment": "Malware payload", "value": "fa9721d23b1f018d7ca7c46a09d050cabb307fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725734, "uuid": "4e7edf94-d42f-4701-8656-2cb4b9f62b97", "comment": "Malware payload", "value": "c627f6fc911b20dfb83fb1f0fb02f429a5abdbd8546d965c4fda5fcae7187456e1723f340960a25670c6b799c30d59c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725734, "uuid": "621649f5-1700-466a-ae88-7d1991bc6c7e", "value": "T136517227E715ADB2C0517871069DD2ACD8B10DE03A4F9F5FC69F496CDD808407809F1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725734, "uuid": "e952d655-a00b-4604-8f2a-b9fa7b2e562d", "value": "48:OEPmxJDsAloBJ0jO3hr0fHlh+wLHB1XVX3Kn3UUto:nPmxJ6kIofOwLh1XVK3UUto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725734, "uuid": "655dfb5a-8b03-449d-bf13-4245625ba9a2", "value": 2951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725734, "uuid": "995e3fa3-5d67-42db-8bd8-e86b0a3d993b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725734, "uuid": "de53e76a-0cdd-4586-a843-f86aeb6eaed9", "value": "2dcc077d01271bb3ca1918b80fff190a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662eb748-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693726075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726075, "uuid": "4b4f6bfc-8af2-4df1-a1c2-75b751f3de8b", "comment": "Malware payload (Gafgyt)", "value": "57888688a89dd02c601bbc29196983ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726075, "uuid": "572c350d-9591-4f58-947c-f06b5ae88113", "comment": "Malware payload (Gafgyt)", "value": "d212e6404c404137f34cb43361f0f2127d80f09e23c64183668d828683a64b3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726075, "uuid": "e50de81f-7f44-471b-8ea4-5c9bafae35cb", "comment": "Malware payload (Gafgyt)", "value": "9da20e0b668e54b7e07e272347dcb8a1c30b7c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726075, "uuid": "6b2139ca-7bdd-4b2d-834d-54d2bd34fd9b", "comment": "Malware payload (Gafgyt)", "value": "a2139be0f1fab9538c8433af5bc366832f9e875516678a5fcb303236550ba0f547f3491d861c6b2e382950f699ebbf44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726075, "uuid": "cafe7f34-29cd-4c98-9545-2d2ff07e67ea", "value": "T112A32903770D0B83D1273DF02A7F2BF19B9AFEE215A5A284751ABDC062718B36195ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726075, "uuid": "2629d8fc-7778-40cd-b72c-db4f7c319b8e", "value": "3072:jh0SmOHix4AWiWVqFkp+1pXOEV5hpv5Upir:jaSmu2WVNY1pHV5hTRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726075, "uuid": "26d8be25-24ff-49dc-addd-f30a5f0028af", "value": 103552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726075, "uuid": "c4e6159f-5cf4-41a4-8086-e043db3043e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726075, "uuid": "24db5e67-e303-4150-bb53-0bdb98e220b4", "value": "57888688a89dd02c601bbc29196983ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fcfed9-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725754, "uuid": "75c29069-3daa-4fd3-ab1c-60b045799a03", "comment": "Malware payload (Vidar)", "value": "89b5d1e74e5e9ce09655bf5da4f2f384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725754, "uuid": "a8669763-5d41-44dc-9cf8-c549d860f0af", "comment": "Malware payload (Vidar)", "value": "d2e1a633f253499a966fd4aad76d255c46fa95821192010c3646a705b33f4186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725754, "uuid": "ac326198-6a67-4d04-be96-4515b8ea1f49", "comment": "Malware payload (Vidar)", "value": "762f6d23d23053f3273aee4e8efe69c122045908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725754, "uuid": "71aeab75-1e25-49a7-a225-7bbbb5ed6359", "comment": "Malware payload (Vidar)", "value": "49b421d53f6679907528c786db262bf0ed6d420b0e5dc48b079616d4a2c69b2d0012ec8e43ed18cf6e0c974e2ebe81f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725754, "uuid": "ef059f73-2cf0-4058-9bfa-f87efdea7d5b", "value": "T1A4A4084392E13D58EA258B729F1FEAEC770DF6608F897B7922189E1F04B1172C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725754, "uuid": "e421eaf6-3d2f-4a5b-a947-111d206d630b", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725754, "uuid": "427daa79-d18c-4abf-959f-a2ed0daa47ea", "value": "6144:vOZxr5szOClPnHY+KWammpmZTyKpt89vgLUebH/SX/:vOZxr5TCxHBZTnptAvgLUeL/4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725754, "uuid": "6c733080-151a-4ec8-be20-d1bb5228d416", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725754, "uuid": "b22d4ba7-e78f-472c-bee2-9b9b21dcb54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725754, "uuid": "c2d30107-4100-481b-8292-13f712617dd5", "value": "89b5d1e74e5e9ce09655bf5da4f2f384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e0465e-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LgoogLoader)", "timestamp": 1693725772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725772, "uuid": "c0ae327a-3fe8-4a0e-824c-2f3e1779ef72", "comment": "Malware payload (LgoogLoader)", "value": "254b59f42e31662e8f96e920f41fce17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725772, "uuid": "d4929bf5-69cf-4faf-b87c-152900312ad7", "comment": "Malware payload (LgoogLoader)", "value": "d391ab8cbe5abb12553d2fbbfe2b6b6e7ed324ccb965a7982a5f1a1a2e8db6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725772, "uuid": "3f17438e-5b3e-4925-a5f1-da4f1e7eb6db", "comment": "Malware payload (LgoogLoader)", "value": "6fc8dad426bacbe61e3c45525b99b5e9d131abfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725772, "uuid": "dea4ae88-21e2-4555-be90-21789e0f2302", "comment": "Malware payload (LgoogLoader)", "value": "83ab1d066483efa1fd1d35485821cd082c66b942139466cdd3d54c0b8328e594a1d195b6f72a1d86bb55ffdddf0eb8af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725772, "uuid": "422ce21f-a530-4507-a51f-a3f28a404164", "value": "T1A1C411B0522D6DB6D242673A9F617341B0E5AE30B725B90F78BDC12F89939371A0FB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725772, "uuid": "ec467ef5-e13f-4462-926d-a3b59aabe64f", "value": "12288:U7/Rv/yjqjEZjb0uYZRU04qm77kteMJR4GHdVlksHgwixnYTm7PHh:gXSk4faZRJ277PMJ+GHHlVynYTg/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725772, "uuid": "8f281b04-31cb-4f11-8b19-b9646e14e591", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725772, "uuid": "e731ce42-e230-4fb6-ae65-19deeced7df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725772, "uuid": "37cfd243-8f2e-4b20-b906-f54b69539f42", "value": "254b59f42e31662e8f96e920f41fce17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67c4c76-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770877, "uuid": "df6a9d5b-a8ef-44c8-86da-ee7fc4c45918", "comment": "Malware payload (Mirai)", "value": "97f21ee21456ac2f86d94ebb50c2d4a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770877, "uuid": "ecad7700-39e4-4c7b-ad4f-dd9acf649261", "comment": "Malware payload (Mirai)", "value": "d68b6df6a96b255010b24a50ebd0a53d6eb9ede93bc2578ea5b5a387c0ae6d38", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770877, "uuid": "3e4b525c-5b20-45b4-a0b4-aedbe1c5c792", "comment": "Malware payload (Mirai)", "value": "b99cf666934be296b347655e4fc672bcc05dd9fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770877, "uuid": "7ceaea83-0407-4c51-8a5b-133fbd727f53", "comment": "Malware payload (Mirai)", "value": "931ccedecfc42de716b585599bb0600b0297ab25f25279ef1f9e90bf4734af2bdde85cd1e98e4254eaf007b941e5d9be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770877, "uuid": "ceadf6c7-a1d2-44b3-889c-3023ca7dc6e1", "value": "T1D104E91AAB510FBBCCAFDD3706ED0B0139CCA54722A53B363678D528F54A54B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770877, "uuid": "55e818c1-ca80-4739-97f1-bb69221eb351", "value": "3072:+esjcBs3jCl2UH0aED7D/URJZeIG5C3vp:+esYimlkaEfDsRTxG8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770877, "uuid": "40779816-90e2-4ab7-a857-9a9a60d1fa2c", "value": 177852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770877, "uuid": "abc164e0-c215-4bdc-9af7-02bf786bb5e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770877, "uuid": "623220f1-77ef-4802-8c87-9f733c6a3da2", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0e6cff-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693750858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750858, "uuid": "3ac58c50-4ffd-48f8-a65e-398b7a88c4db", "comment": "Malware payload (Smoke Loader)", "value": "1a4ef975a1cda16630ff7baa3ab58ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750858, "uuid": "9405c4c8-e98f-4b6e-ad4e-218fffb99996", "comment": "Malware payload (Smoke Loader)", "value": "d81dd1c75af31101835ef48b2b4a1bf56a407ee28e7e6527f3e8da09b7369893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750858, "uuid": "25cb60d8-be63-4eeb-9ef7-25d9fedd4e49", "comment": "Malware payload (Smoke Loader)", "value": "4b7f68eee714b5e08819297dbfaa8f891d562911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750858, "uuid": "2266c947-3ecb-4bd6-9e8c-1c3cb0c68d05", "comment": "Malware payload (Smoke Loader)", "value": "511ad0a71402968b8be989079be2b3d420a7e21b6f6e527340f0b6ac566d9b3c55fa8b81be194f7a43dcb4cceabb14a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750858, "uuid": "8a3ad0ab-05cd-4e65-b83e-005fd93d99b7", "value": "T1535448B3A5D0BC6AD5160735CE1EC2F8371EBCA18E196B9727447E2B1931272D69F301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750858, "uuid": "f56f2b00-bb4f-45c9-8d4e-02932785180e", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750858, "uuid": "9226edba-0d67-4ac1-8f93-3393893d01c9", "value": "3072:Eura7LGin7J2sbWZf0IaTVCFcekEXIc5LunR9i5DLzqHwYuH0Fk8ly3TUf:EjL7k3xn6EYc5LuCZIhk8ly3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750858, "uuid": "6f04bd03-2628-47d1-a1a9-5443d36b76d0", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750858, "uuid": "3d5aa6d1-ca8f-4af6-b3d5-a9294fbae3fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750858, "uuid": "603d07c8-24c0-4e1d-b0fe-46aec6ba112e", "value": "1a4ef975a1cda16630ff7baa3ab58ae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee5d0e5-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770891, "uuid": "5a4eda3f-c48d-4e71-a2f9-8c82729dcedd", "comment": "Malware payload (Mirai)", "value": "79c1eb3f49590533fd3a1ab39263f05a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770891, "uuid": "7acab3f6-6085-4acc-9347-d8a3a3343430", "comment": "Malware payload (Mirai)", "value": "d9da63749babcaeb67e62da05e68d66556bdab15b5ba94f7f97ded75e63e24ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770891, "uuid": "184e5cf2-7e31-4052-9cc1-2c3da0851311", "comment": "Malware payload (Mirai)", "value": "bae7fba294983c4d4cb1ba9e91bf57128550f8b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770891, "uuid": "766090cc-bfcd-436f-b93f-6d19e188a579", "comment": "Malware payload (Mirai)", "value": "4fd8670075244b2eb83b21d8274bd1a43dcb13bd1d40b0d0f0f22446429d25d981213273b4bf38ad7c2e88e77f004ded", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770891, "uuid": "793990b5-091b-404b-9e20-36bb248d3dec", "value": "T1AFD3F845FC505F23C6C612B7FB5E428D3B2A17E8D3EE720399256F21378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770891, "uuid": "85e5c8f5-0456-4755-9f1f-bd2b1cf9f8f8", "value": "3072:gHL+mYoexFOV48wlPNbMRfaPuk84GOV9LHni3Q:gHLe1AV48MPNbXt9Tnig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770891, "uuid": "7f537478-3c5e-4f7b-8947-8d0718edd372", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770891, "uuid": "dfdd7f75-8e05-49a9-ad43-6c5d9bfe1e48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770891, "uuid": "341fd3d8-a614-494a-9716-06b71e1a043c", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d994338-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726168, "uuid": "41c78fbe-8b79-48f7-92d9-8913d8197f41", "comment": "Malware payload (Vidar)", "value": "786781ba2520ee82602b9294c38be729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726168, "uuid": "5345bb32-b2b6-42fc-8be3-c372a7d72e29", "comment": "Malware payload (Vidar)", "value": "da2dd44903e52e76087d1293c9614d55e9fa4637b6980465b73d1f5ae5ec419b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726168, "uuid": "99004f53-8e35-4d3d-8f2c-d31771ae08e2", "comment": "Malware payload (Vidar)", "value": "8970e8e5c6dfea506832cd539a69e5ddcf2cd536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726168, "uuid": "7a5ef365-39af-474d-aba9-8b2104d90f83", "comment": "Malware payload (Vidar)", "value": "b30789a610a1f4f49e621082363a63c5da41ab959ee2e5f3607ae702525478022421a62105f3c6554bd4552fa03fd98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726168, "uuid": "abdea25c-a570-4d11-b534-a9675e8ad56a", "value": "T1C1A4E64383E2BD5AE9258B728F1FC6FC770DF6518E497B65A2199E3B00B11B6C1A3704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726168, "uuid": "62bfc21d-f10b-4039-b040-f8cedff9ed54", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726168, "uuid": "e15b1511-235d-42e5-8839-6bc4b26333fc", "value": "6144:8xKirja004kMWThQN3bWJ4Dcj6mV0RIgN+u0wyLV:8Uirjx4GBbWSpmVDVQyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726168, "uuid": "418f8dee-1b8a-454d-8938-a7c9b33c3d48", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726168, "uuid": "d46e1b4a-774c-4967-9f34-97bb6a91da62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726168, "uuid": "0dfa463c-f38e-4e37-ae12-3a6662f168ec", "value": "786781ba2520ee82602b9294c38be729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11957b82-4a42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693735811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735811, "uuid": "aadd9bd0-26ef-458e-a7b6-559489fa9761", "comment": "Malware payload (KnightCrypt)", "value": "7defc0b43aa2ad389575df2419b7909b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735811, "uuid": "01031d40-a265-4c0c-bac2-eb4e3fa69ca5", "comment": "Malware payload (KnightCrypt)", "value": "dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735811, "uuid": "8da7108c-d09a-408f-b751-ccce5929bb90", "comment": "Malware payload (KnightCrypt)", "value": "cf0dd52331ce203c723f7be32bd91d7cfb34a988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693735811, "uuid": "ba2d78c8-650a-40d4-9f08-4ebe503c74c9", "comment": "Malware payload (KnightCrypt)", "value": "1c5542d3be293f8b38ab421cc80e431e811c85b3f3ae08712a93e9f390deaca04d3486bfe0e865f675ffbe17a3875ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735811, "uuid": "702270a0-f5d7-4811-a64b-3ae22e66f9d7", "value": "T16D556B07B69941E8D43AC1B0CA564332EE71BC950F34A9DF0690B3592F7BEE46B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735811, "uuid": "7f5ea4c6-765e-4970-b9cf-844e8c879550", "value": "92ed8fb21c381a073a5e7ca35347f90e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735811, "uuid": "ea9a9133-de41-42eb-80fd-f6be758138da", "value": "12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693735811, "uuid": "4604453d-7921-4ecb-95da-bf7e90f33c8e", "value": 1392760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693735811, "uuid": "1ec54bef-b9ce-4695-a0d7-6250cf02c521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693735811, "uuid": "a1d5546e-b8c3-4914-946d-92a90a5578d0", "value": "92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d85e79f-4a80-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693762568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693762568, "uuid": "435abf3c-1e69-4eb4-bb1e-6bbe53b1a9ed", "comment": "Malware payload", "value": "c4ea96864ded7e08d8831387362ba614", "object_relation": "md5", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693762568, "uuid": "0d668d55-b93a-496f-a3de-1c44ef2acad3", "comment": "Malware payload", "value": "dce10cbe9a1a377f126f00a29965c0a6750b0e4702de791dd3ab51e4c743b675", "object_relation": "sha256", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693762568, "uuid": "a448186b-243a-4d9d-a8eb-2c65eb06b29b", "comment": "Malware payload", "value": "df71a3b0a89ddc3deb089ae413ff93e51df8b00e", "object_relation": "sha1", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693762568, "uuid": "033df04f-cfcf-4448-a9b7-0ffe5a93bd0c", "comment": "Malware payload", "value": "593689b06b4ea1a7001efd45ebd7180e86fa1cb2157779750f10e29a3d607774cabbc55075cfef7a54b4758895687855", "object_relation": "sha3-384", "Tag": [ { "name": "booking-com-details-blogspot-com", "colour": "#2DE3FC", "exportable": true, "hide_tag": false }, { "name": "MEMEMAN", "colour": "#A3A327", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693762568, "uuid": "f95eb02e-ec75-4f9c-905a-d71066bad77b", "value": "T1CE3600F6B60526F2F28FC1750054BF6D83783C938DD2836CD72D65A00E2ABED5D19886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693762568, "uuid": "d6edb6b9-1570-4fe3-ac68-78dff0167116", "value": "384:pOOOOOWCOOraJOOOOOVL5OeOIyj5OOqOO0OOyOOhOOW+jOOZaOOBKOOqSOOCOOR3:zV+pU75n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693762568, "uuid": "180331eb-c6f0-4ab5-a45c-48dbd4bda419", "value": 4908860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693762568, "uuid": "0caad678-0ef9-4f00-8fe3-f4e8add5f836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693762568, "uuid": "0a9d590a-1054-48b9-8358-0eb6afbe68d0", "value": "atom.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8102a4f9-4a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693724402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724402, "uuid": "fea6c474-dcf0-48ef-a470-997d409c5423", "comment": "Malware payload (Gafgyt)", "value": "f7033cbc100f5f5590ce3f5a7c547de3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724402, "uuid": "538f878b-347b-4d8b-b55c-76d97a93cc19", "comment": "Malware payload (Gafgyt)", "value": "dd1d9eab1718ad4e168ea5ce69f57e9598824f7cee9c5d6e7abbef83ef717220", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724402, "uuid": "153a0a61-40b3-4b31-b6f3-eb8f2c62d669", "comment": "Malware payload (Gafgyt)", "value": "1fc0357afe042a3c74358a01667546419a2193e1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693724402, "uuid": "5c3d23a9-1601-47fe-af53-8c3510d973fe", "comment": "Malware payload (Gafgyt)", "value": "737445d257f021f0d312a4554bb2c2b5b7816fdeaf6e73396008d916d672cd1f2106acaf3cd648446c833aea70a96fc5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724402, "uuid": "b9dfaf19-edbe-4c65-a593-18b5ded1441a", "value": "T1C5931ADAEA42CD73C05310F102AAAF21AE71F9FB4822C542F364ADB4DD155D29615FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724402, "uuid": "d62f9651-81d2-4613-b1e8-94aeac5e73ae", "value": "1536:xXIa2qDwqDQIX40W7SW9ICCpaBTouudbpv3nmJ33kZvZiUg:xXx2qcqDyGu+pcMuudbpvWJ3UZvZi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693724402, "uuid": "a2df44e7-f2ad-4492-9641-c7eebdcda6f3", "value": 91016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693724402, "uuid": "3042bc88-bfc7-4f8a-865d-024b65a7ac3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693724402, "uuid": "9c41944f-4e05-4618-b748-7ae65d060630", "value": "686i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9949db-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726002, "uuid": "f5ad2fef-65e0-4fc5-ae38-a28fa7edbc24", "comment": "Malware payload (Mirai)", "value": "49ad2c4944396bf39e70fcdc1486e02c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726002, "uuid": "2024b4b8-9196-42f6-86a4-7de01d464b1f", "comment": "Malware payload (Mirai)", "value": "e0ea0945e396b6107598488078b20b5a605f6865281478ee75c47ac94f1c04ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726002, "uuid": "4740a717-077e-469d-a0fb-a088e655fa31", "comment": "Malware payload (Mirai)", "value": "d17b16d1c9f6b5102cd3b917e674a49bbbc92f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726002, "uuid": "06eb05f6-3920-4fe1-a125-78cbfff4f3cc", "comment": "Malware payload (Mirai)", "value": "79b2c2b1dad8cb0fd3868314c6227f4a623160787e77390cecb08dbd9e990d211b1a5601e2a8e67bb2aded63220a5005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726002, "uuid": "a2e0746c-8fde-4718-90cf-7fae7aba6179", "value": "T1DDC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726002, "uuid": "f1eebadd-0061-4171-890a-76e556d079ca", "value": "3072:4jDy/+mh1vtbPIKawbpcUPium7/L7QsvmGfIiNb:mOJ1vxfawbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726002, "uuid": "87e30f54-d431-4901-b2ec-78f14440d397", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726002, "uuid": "48534a10-6104-40e4-8dba-134fdfa72c0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726002, "uuid": "db70acb1-8104-445e-b81f-dacf8c450085", "value": "49ad2c4944396bf39e70fcdc1486e02c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f4cab8-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725986, "uuid": "6d52898b-dd6a-4d7f-a78d-4a98674665d0", "comment": "Malware payload (Smoke Loader)", "value": "1ec88799dfa8b8af096548159bf2edf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725986, "uuid": "a0c5dcb7-f630-4e81-a00b-e9b917848b99", "comment": "Malware payload (Smoke Loader)", "value": "e1fb8f0d455779ea3c3b03f0aa6b0e9377ae17cf421d0d4f8f762db09b8a37ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725986, "uuid": "682fc094-c8a0-4e9c-8cfd-6790c9960e20", "comment": "Malware payload (Smoke Loader)", "value": "2b4e58c9f4cf4ab256b084bfaf202afc8ee06842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725986, "uuid": "654fe668-9f43-4122-82cb-ddcd19a514cc", "comment": "Malware payload (Smoke Loader)", "value": "b17ea1e4b940931855da108fffd46c2faec88d5f940bb7687d9e96801dbf170a09b1f819e7129b90bf6fe85d157f7d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725986, "uuid": "5e5cd1bf-466a-4714-aaf3-2638cc8a0c23", "value": "T12B547B4361D0BC7AE51607318F1EC6FE771EB8608E196B9627177E2E3931172CA9BB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725986, "uuid": "9f99a0ba-4435-466a-beca-bb7f1130a220", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725986, "uuid": "826009b8-ff51-424e-b9fb-029154db8a21", "value": "3072:xavRKipA7/UsbWXEd6AykZfBl9Jsdm+gNediKDnu2dAkqbmrer02p0FTkymx:8I7M3U9PfBlrsg+coZDumyOTky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725986, "uuid": "be4dbf62-0f57-4580-9fbd-e803dee38b9f", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725986, "uuid": "f556f7bf-c95f-4f7f-93cf-7c271069f824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725986, "uuid": "0c39a4c1-c467-4078-b43a-fb469731bdec", "value": "1ec88799dfa8b8af096548159bf2edf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3953ffb-4a29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (KnightCrypt)", "timestamp": 1693725453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725453, "uuid": "e8399acc-d5e7-4d65-b494-e21cdeaeaf80", "comment": "Malware payload (KnightCrypt)", "value": "3e33c22e45252b6c1f414f47119a2481", "object_relation": "md5", "Tag": [ { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725453, "uuid": "8f4f4121-813a-41dc-b681-dc5b1168a71d", "comment": "Malware payload (KnightCrypt)", "value": "e38a1648fc6494f881e3b793688ef4d69e925137c4c7494f4dd6c6604142a2bc", "object_relation": "sha256", "Tag": [ { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725453, "uuid": "b0232062-9042-4ba4-bc83-1a69a523c39f", "comment": "Malware payload (KnightCrypt)", "value": "9167d20a9081939ee53c2be84c21ba9af9a2c510", "object_relation": "sha1", "Tag": [ { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725453, "uuid": "7453158c-79d4-49b8-a7da-8d18d6216948", "comment": "Malware payload (KnightCrypt)", "value": "1ddf978c2c9a563860182b4c908e856aa29b828132c3baf4f68fa7dcc30a91e28b146c1328ac55473bb61c7b9606818d", "object_relation": "sha3-384", "Tag": [ { "name": "KnightCrypt", "colour": "#81A14D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725453, "uuid": "ffe67627-0bfb-47bb-aacc-8a977a4d14d0", "value": "T13641DF200FF20318E3B7DE3555B653B547B6B811F9228F9E11C45E861871614EC68F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725453, "uuid": "cf4d7c30-a35b-40fc-a2c6-97f05e0d0d3b", "value": "24:8W2tGmYNa89KuPgIWJAAzW5+/CWJAM/9iUoIakWbxHdw6nfTdkF6nfT7ywyfm:8Ws4ydJXuMFiBIaTxHdJxk8ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725453, "uuid": "a1cc62fc-bef5-437d-94d7-265d07fb198f", "value": 2257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725453, "uuid": "4e7ef60f-a8c5-4a6d-9df3-fd51b048e03e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725453, "uuid": "ebf3436d-5ef6-47b6-81e7-c5fe3c77acef", "value": "NOT-paid-Invoice-26-August.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adb397d-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693725975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725975, "uuid": "8ada4e6f-8ba2-4c16-b08e-826456267628", "comment": "Malware payload (Mirai)", "value": "de5e7538800e484fdd4a5ef02f59e947", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725975, "uuid": "7297cae2-7402-481a-9301-42b6f5ee7bdc", "comment": "Malware payload (Mirai)", "value": "e3b669a90441777af193bc0a0814212787ea6b01469f5a118bc9b9e9016b6f2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725975, "uuid": "ee4726bd-dfae-4313-aa3f-e8efe22f9904", "comment": "Malware payload (Mirai)", "value": "0f61c9fbc7021a0b9bb684dfe934d21232bdc0da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725975, "uuid": "285d0117-2c9c-425c-a26e-0b51e196efeb", "comment": "Malware payload (Mirai)", "value": "fd9f27b41a31840ee778dcc7ed0c7810db28c21ca2f0dad29af8f22425f667721df9f9cd267f04681012039a47331ee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725975, "uuid": "5ddcf046-e131-4fbc-a21e-24ad9b3c0a61", "value": "T14AB31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725975, "uuid": "7af20287-6176-40f6-a1a1-6d77152eead8", "value": "3072:pC/4rdZHsXsZwwR9uNk5mm/QcuLmHniPNb:pCwrvHwsZwY9uOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725975, "uuid": "0632c06a-6416-4cb0-a285-f82cfa98a8dc", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725975, "uuid": "a3f98764-05b2-41f4-bbb0-c8038191ea2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725975, "uuid": "ecff05f5-1680-45cb-abe2-f8de4d5ce2ea", "value": "de5e7538800e484fdd4a5ef02f59e947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a227c3ba-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693725746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725746, "uuid": "8914cc30-3a4c-4ae3-b50e-4643170bd70f", "comment": "Malware payload (Smoke Loader)", "value": "ac81fa8d733abdca8234c44772e71014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725746, "uuid": "2d31d01a-9db2-4a00-acf2-7d977445a3e9", "comment": "Malware payload (Smoke Loader)", "value": "e440eac7cb52cdaad64e9e46f641e291569789f59aeb2bfa4c6bbc607c2c64e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725746, "uuid": "6d698c6c-0ead-4074-965a-72865203f350", "comment": "Malware payload (Smoke Loader)", "value": "9b62e91e41ddacaf9e4694cf2381a07355d6b60f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725746, "uuid": "1f82ceab-a844-4cff-abbd-b13c31e5e87b", "comment": "Malware payload (Smoke Loader)", "value": "ec40560f9a3c431ff2459381dbd57312db0aa91598ec50b134df750f69183c95a2b181c1a1dd5b0caf83f387b5304ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725746, "uuid": "94074505-4293-4ec0-915e-c1d1e3272b43", "value": "T14584C64392E17E58EB258B729F1FCAF8778DF5708E097BA922189E1F04B1076C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725746, "uuid": "35ba9a2a-6bb5-40ab-8188-26ea15cda0d2", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725746, "uuid": "2f5f084a-89c0-449c-8acd-7ff0fffcb7d0", "value": "6144:IFytiut5tG67xEVZmzLBDEVwHgLUebH/SX/:6ytiuB5uczpEVAgLUeL/4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725746, "uuid": "b45b8808-a80d-43a1-b2de-dfd326394fc7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725746, "uuid": "321653d2-2876-48e3-995f-4b74a4db7a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725746, "uuid": "eb651cc0-94f0-43df-b185-f6b06ace2b43", "value": "ac81fa8d733abdca8234c44772e71014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49f2c9d-4a43-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693736595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736595, "uuid": "7a5002ee-f71f-40f8-aac0-200288c329e5", "comment": "Malware payload (Smoke Loader)", "value": "deadccc3b28073603f174acbf378bd2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736595, "uuid": "fb4696c9-ab08-4678-bc25-360f0be36e5d", "comment": "Malware payload (Smoke Loader)", "value": "e46d27217c2f60a3deff490c6e70af2bdfbbc2c88389f4ecd2343cf12e36d9a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736595, "uuid": "313842eb-6fb7-4d66-8a2f-0596a4c40f08", "comment": "Malware payload (Smoke Loader)", "value": "efe2fe81563a4330c2599446080f92bfba232862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736595, "uuid": "2920575a-4574-4084-b9b3-30d12a07c453", "comment": "Malware payload (Smoke Loader)", "value": "391af916e106620d5bd31832310c87cbab6e4624d67bb9c9ef834bf9d603c0f85bb23753a8b03b27de442dccdb85863e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736595, "uuid": "e171507c-cd50-431d-b513-c75960d56008", "value": "T18C546A83A1D4FC7AD12603718E1EC7F83F2EB8618E196BD72B546E5B1932172D69B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736595, "uuid": "3a5caf18-4002-4b52-9871-ea067dc77264", "value": "ad153f8df4d5e34f536fce54f7340368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736595, "uuid": "810384b3-72e3-4fca-8385-330d0c8ec361", "value": "3072:G6a2vnOd3Som487QGHPUZXzoMU5G8KIm+xgE9SV+c3VTXzctH3y3TI7:G133r18QSMi5GC919SMCTXzctH3y3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693736595, "uuid": "0a61f38f-2aba-46e4-b9a1-e4823d762e5b", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693736595, "uuid": "5c25863b-291d-4e73-9c0c-ae6518e6a857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736595, "uuid": "34bf0f9e-3d01-4e99-bfa0-da8bd3f7f559", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5dc2d1-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1693750838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750838, "uuid": "68c1c1f5-f9dc-4c46-b23e-a99f4458f318", "comment": "Malware payload (DarkTortilla)", "value": "81ce294185bc0254db097f06dbc72f2b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750838, "uuid": "135b9ff0-1c8a-404f-a1ce-9dcb10b1659a", "comment": "Malware payload (DarkTortilla)", "value": "e4754822ea080299aa8db5ca8d29c7a68a669c3c041a76466495c6809a98bb9a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750838, "uuid": "494087ad-c5de-4d0f-8f5a-1ea0b0ddc8a7", "comment": "Malware payload (DarkTortilla)", "value": "a095afee612c86b6b8e9f47b8b3ea14c7fd8edd4", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750838, "uuid": "48e2cdf5-6f3b-48c6-9c66-7627c5dc920a", "comment": "Malware payload (DarkTortilla)", "value": "daccf9abd1e36ce40d0bfb08448b5ad5724216324b4c9ddfe32f977436245e97f9064ce904bf24cd924522455165343e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750838, "uuid": "b9ea3fba-f609-4a28-b48f-d1baeb05f39c", "value": "T1AF65E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750838, "uuid": "730a0c84-5143-4633-9b8d-dd4305ff465c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750838, "uuid": "01c6e355-9f68-49d0-8b70-6c3b8e098031", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750838, "uuid": "f0382a4d-5975-4fd1-99a8-bf2884f161f8", "value": 1454927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750838, "uuid": "e1c7f1e8-b779-48e1-9d25-edd90d4ae3d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750838, "uuid": "c1b1c0c9-571c-4030-b090-ced9d0a0cf90", "value": "81ce294185bc0254db097f06dbc72f2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e4087f-4a06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693710015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693710015, "uuid": "fb29a332-6971-4699-bc49-c26d08e0a403", "comment": "Malware payload (RedLineStealer)", "value": "a5d2a7d53aeeac4f0812340e159d8c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693710015, "uuid": "22da36a4-b16f-4e81-83c6-75eae8214ea5", "comment": "Malware payload (RedLineStealer)", "value": "e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693710015, "uuid": "e1b9b7b0-a6c7-498f-9de2-a83272a26e57", "comment": "Malware payload (RedLineStealer)", "value": "5f1f46a6a557656ca04f562c07f2cb7084c6b094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693710015, "uuid": "c16c5355-dde2-414f-b6d0-04a829673aca", "comment": "Malware payload (RedLineStealer)", "value": "f13cd3f9affa41a66d950a2c5427537e371b58ab7e38b791376b6af79d5cab7f3e118f5053b1a5f19772f656a8cc5690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693710015, "uuid": "a09ef7a0-7461-48c2-84d7-7051fa73da06", "value": "T1E5F41212B5C580B1E4B31A341EF6B7715B3DBD600B298E5FAB841AAD0B305C16B35F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693710015, "uuid": "fa0c84ca-d319-463b-8047-cd18d823bdde", "value": "c127345c03c7eb109783c6cc61e16834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693710015, "uuid": "cae44b4e-0c55-48df-8032-70f07d9c1e62", "value": "12288:U9UPHFtND4ZIrsHWihcF4JJTnJQZgplDliDDmNGkMAJIJ6zcRSdiuVHJ/R/++Bm0:U9qFtp6xWFkJ2ZSDYDc9MAJdPV7+ymFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693710015, "uuid": "b5bb2965-379e-48e8-b252-a84d07b26abd", "value": 773459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693710015, "uuid": "b20a7742-81aa-4eb3-acb2-177dfe7c61ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693710015, "uuid": "b8dff9f8-39f0-480f-97e7-8365961c376c", "value": "a5d2a7d53aeeac4f0812340e159d8c66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140890ac-4a86-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693765021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693765021, "uuid": "3cdb44d3-ceb2-463a-81bf-5de33f16994d", "comment": "Malware payload", "value": "7032f1ccb9d53dc72f1c723f83ac17c4", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693765021, "uuid": "d9b25dad-e030-4c7f-a728-cd5cea11472b", "comment": "Malware payload", "value": "e86f401bdb3980a33370488d3df7546ee6098a7a95350e01594d7bc888e7e795", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693765021, "uuid": "5e52e7b3-5e4f-442e-b302-92a03dcf2826", "comment": "Malware payload", "value": "a4ebd884ef65457d2e1636e1be3ce7ffdb420db7", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693765021, "uuid": "17155cbf-3f49-4567-93c9-5fd1db9b55ab", "comment": "Malware payload", "value": "8e9372a7ebf1ff997f8b6cb69c636b307a4456582bdee3f383904d1b1a7b3b332ce8dc9bc7639e1125bec5ff6602f46a", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693765021, "uuid": "5fe733d9-c8f1-4cbe-9438-9808d15f486e", "value": "T1F533C4AC74C4E89E68F460E1A894578B0070156E753E8E15D2BDCC761FE8ABADD9CCCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693765021, "uuid": "e5646156-c970-4684-91cf-2d689fefd63e", "value": "1536:FrvUMiLOLoxJqhlldeRRrsTFUqgWa+EsM7fI5EYRE6TMgb:FrvUMiLOLoxJqhlldeRRrsTFUqgWa+E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693765021, "uuid": "8184dca8-052b-4be1-bc38-7a7196e03415", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693765021, "uuid": "fb6e284b-c2b8-4a5f-9dbf-c673e151ae0c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693765021, "uuid": "afd8ac16-db46-46db-98b9-15100d1a8fe4", "value": "oky.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff2c949-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726091, "uuid": "d4344850-0f27-4185-80bb-218a8075bb16", "comment": "Malware payload (Mirai)", "value": "36c31d4ea8879149964e7e5e595d10c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726091, "uuid": "bb5146a3-0d10-441c-9c39-546669ffcb13", "comment": "Malware payload (Mirai)", "value": "e8f13083583b4addc367d319f4b1ce424b2decba641b206499581beca10f6533", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726091, "uuid": "73c83f82-c3d5-4c4b-a465-3b022e6cef2c", "comment": "Malware payload (Mirai)", "value": "855f6e075c88033f670839d4e1acf84846ecc718", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726091, "uuid": "d10e80bc-385b-428e-9045-590e8c183707", "comment": "Malware payload (Mirai)", "value": "e7814ccb9ae62c20bca4edf01cb8bf4df63c9b45ca062c2834bf60f7dc09da1ca1750d7aa39077c4f2cea5ad529c9137", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726091, "uuid": "f31e9a5e-c2e7-465d-a985-783ac58901af", "value": "T18BD31956A7408B13C4D6177ABAEF424533239B54D3DB73069928BFB43F827AE4E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726091, "uuid": "0251d1f2-3565-46c3-816c-96db5b45e709", "value": "3072:izfhwraBiu8u9CMOZC7u2A1657ae/VM/902q:izferaBiu8u9nObfY7aetM/9zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726091, "uuid": "3a145c46-ffff-4e3a-bb1f-8a4b8e816636", "value": 137251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726091, "uuid": "bca4a0d6-6a7d-4f2d-970e-52b96c0a2eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726091, "uuid": "573f294c-4aa4-4946-8ed6-c4ed6f6e5460", "value": "36c31d4ea8879149964e7e5e595d10c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4728329-4a36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693730931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730931, "uuid": "fdedeb88-e528-47c5-a237-7554874d50e3", "comment": "Malware payload (RedLineStealer)", "value": "41fd17043e8e90252b9af94b861f1237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730931, "uuid": "b72303d2-4683-4530-bfed-ed7b46c9323c", "comment": "Malware payload (RedLineStealer)", "value": "ea25469922008ff29e05613f5e9971580e2f285ebb5a26b2d67578594cbe57be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730931, "uuid": "2c3535fc-60db-4089-b811-297d9cbdf73e", "comment": "Malware payload (RedLineStealer)", "value": "4c80d9778bc25f012a8524e95fc4add74f549eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693730931, "uuid": "50954256-6d4d-41e5-bf0a-e23be46c2fe4", "comment": "Malware payload (RedLineStealer)", "value": "84849108d148eeb36efbc5cc3c578e902755221a7f2e080e516b985485dd1c926ebb4852bc12c26f4618fd6e429134e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730931, "uuid": "87ad1f0a-1bb2-4a5c-82f3-c4b72519dfcc", "value": "T15CA4CE83A1D0FFE9E1140775BE1EC2EC770EB8AD4D992B9727406E1A253D172E69B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730931, "uuid": "2ec2be95-3589-454a-b827-4ee7ccdbb917", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730931, "uuid": "68c352f6-e5fb-4da9-94b6-23c671ca2ddf", "value": "6144:Z8fJBXfo30xY5mm76Fj3VNuIGLWH98fgCtaaNDFZV7QXc4fy3T:Z8RBQkaNGFVNhGG9TYaMFLHoyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693730931, "uuid": "ee2630c1-a155-4d63-afb6-d6916f6450c0", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693730931, "uuid": "bdf1b102-bede-4e21-8f83-c9c6b7155206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693730931, "uuid": "9f1097ad-bb21-4fe6-876a-ad5bbce66f10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb98e60-4a02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693708616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708616, "uuid": "e52e9c28-b4d0-44b7-994b-db02b9f54290", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "dddf5ae24f4fc2b0705b0d23355e9d9c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708616, "uuid": "61bcc9d6-1a8f-4c18-aea1-87ad8efab96d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ea53fa048fd00bb4b981d9556a824c39e405ec127ae052beadd688fdd66c5c0e", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708616, "uuid": "d1320c8a-98ed-45c0-99b0-0dc7c69ca159", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bf5fa6d756c4d07b380adbce847501d6c4d2d527", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693708616, "uuid": "a9f7d39c-2926-48ac-ba07-2650c47c9cd5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "713ec89b62018aae0d5e158c4a36d8e75ae8ad9da738daf3ca92c921c5994908085ff44315bdb9f095f5ead1ecc2e15d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708616, "uuid": "87aefdb3-2559-4a3a-b71b-be158d5dfa3c", "value": "T129252343F6A1D5B9F571E8F00C99E600543679A20878A29937FD5F8C5F33EE8EA50728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708616, "uuid": "297eaecf-ec03-4c6a-8de8-42102844d241", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708616, "uuid": "5822df02-ff38-4eb8-aa54-0cd31a36c31d", "value": "24576:0I39dAcA1YObmDSgpYP9+D9a9b8DjdVPQHzGkyFV/uN4vxt:06dAf1F6DNO9+D89b8DjLPezKuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693708616, "uuid": "f7ebc94f-af3e-436f-8d84-15c09575593b", "value": 986101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693708616, "uuid": "a3f0276e-3088-40bd-a2b1-9feffb16a29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693708616, "uuid": "d0a05d64-203d-44ad-868d-1de2bb7627a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0506332-4a30-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1693728400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728400, "uuid": "1f8f9e06-37e3-4816-8f3a-d3a5cc471be5", "comment": "Malware payload (ConnectWise)", "value": "4515daf7dbc809057544a88bc04dec1d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728400, "uuid": "c369c822-5a12-43fe-b31c-bde4be8ca721", "comment": "Malware payload (ConnectWise)", "value": "ea7d9798c925b0ec1d02108eada571ca7267c172f9bc338faaa0ff8586068fb6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728400, "uuid": "551debbf-db61-4d6c-86b8-17d0306dd4f5", "comment": "Malware payload (ConnectWise)", "value": "e9c5240da0dd89daf47a14363abcdbe422da8d0a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693728400, "uuid": "d51bb743-8e0f-420f-b196-f6f9a09eb87d", "comment": "Malware payload (ConnectWise)", "value": "f2a3be688db1ee8f6b40219dd6d55b0d76f8a89393ad550ffbb5ad7b86dc6d57c04b4443cb37b5e8f1c30fa62af37b5d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728400, "uuid": "ae1b2fc2-be3c-4a27-b22f-2b0ffabb5832", "value": "T12346F111F3D591B6D07F0638D8794666AB74BC088322CB5F5794BE696D33BC09E223B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728400, "uuid": "f4c80c5d-b6e6-468c-9e6d-32e2aca529b5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728400, "uuid": "a3c1ac2a-e2dd-444b-b28d-ce0891222db9", "value": "98304:aaeNO66+6efPPw2Ks9fM8dYdstG1l40MprZ:aa9efPu8nk40IF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693728400, "uuid": "d0074ced-ebd6-4f4a-a581-de678ef86533", "value": 5356808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693728400, "uuid": "de6387be-dce0-4262-a052-4a185b268804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693728400, "uuid": "7c1cb11e-de75-4e29-973e-ad2c9bfc9e2e", "value": "Level 3 security update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b73bae7-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693725681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725681, "uuid": "e83f3bf4-9188-4d52-8048-f775b3fb627c", "comment": "Malware payload (Vidar)", "value": "c1d65a59f6681362384ba996794cfb32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725681, "uuid": "7f294c67-3a08-4386-8818-0b8edc845739", "comment": "Malware payload (Vidar)", "value": "eabaa62f8d278372288c480bda8eed290abefb3e8e90a3af0690756dc7577cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725681, "uuid": "d46df8f5-a140-4dd7-83fa-7e7235e35efe", "comment": "Malware payload (Vidar)", "value": "2a04d8837a89c83fd77e33e94769f4a83c5e3d89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725681, "uuid": "d1a82338-66b5-46b5-bfa8-ff7c2775ba3c", "comment": "Malware payload (Vidar)", "value": "2669034004b8fec238205fd36138aac63906f6a3df869ef5e80801721cc18ef567caf37587cc64c46c1fc92b71d1facd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725681, "uuid": "323d218d-5a9f-4fbc-9b24-61ce5e502ebb", "value": "T10015AE0392E17D59EB258B73AF1FC6EC770DF6608E097BB922189E1B00B1576C663712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725681, "uuid": "5007a765-ff8a-4024-915d-af452bbe8b9b", "value": "77330eefb2fa8730bad1029411677376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725681, "uuid": "248c8171-5609-4a5d-b7e1-881d20fa3cca", "value": "24576:bhM/HMEWZFNKUho9miSbcIJhMkDpgLHL/:bhM/HMJzUUho9mlbceakgLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725681, "uuid": "605dfc2d-dca2-431a-9309-b1c4c1458ced", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725681, "uuid": "69d59552-b8d7-4f97-85c2-072091c02602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725681, "uuid": "8e0f27aa-3d11-459a-b423-c9c8a76cd8ad", "value": "c1d65a59f6681362384ba996794cfb32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75c606e-4a0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693714212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714212, "uuid": "fa8e755f-1b96-4680-bfae-8f825678af1e", "comment": "Malware payload (Stealc)", "value": "a96116d720e4ba7d5f9e42184d8e7b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714212, "uuid": "84dc3dc6-4126-4d71-a455-6f64fbd17442", "comment": "Malware payload (Stealc)", "value": "eb944ac584f71f289e2d28adbc08815b0c419bbaef309c31044b732455c83fc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714212, "uuid": "e953e2c9-d72d-4e3d-9cb8-20651b493b0f", "comment": "Malware payload (Stealc)", "value": "f8edb66bb32c611392a1e8a496b339928650ff6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693714212, "uuid": "a747e206-6b86-4de6-a53a-5ec59a000206", "comment": "Malware payload (Stealc)", "value": "a8f00948f0c2663ea4220a8395074de9dd7c5b9de99f1869d08ce32927b7330b20590542f3e28c20837bc7f790c5a006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714212, "uuid": "179ee065-17dd-4125-b419-3b81ecd3ebb4", "value": "T112F6331290988C53CBB04D74B53151259E255CE708ECF4EDB66FEE6D1FB2CF9082B29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714212, "uuid": "ee61f3b5-007d-408e-861e-ec409b3268d8", "value": "377a97652fdf5740d8cc11d5ce124fed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714212, "uuid": "257741aa-c750-47bb-9214-f9152681bd8b", "value": "393216:0AtIXF1jKGEbLnRh2aQXgWYpiIXF1jKGEbm:0AtIXFsRkfepiIXFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693714212, "uuid": "15c1e600-c830-40e8-a9b8-000dd417764b", "value": 15346080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693714212, "uuid": "14b3303a-aa97-4a2e-9e1c-8c5370e8781e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693714212, "uuid": "29d2e764-81bc-4c1b-80d0-cc172d45867f", "value": "a96116d720e4ba7d5f9e42184d8e7b7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01657467-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1693750817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750817, "uuid": "f9ee3037-312f-4ec0-b36b-aba1476e5a96", "comment": "Malware payload (PovertyStealer)", "value": "0daecdebcceee34bc19cfc209e9e3f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750817, "uuid": "c8851b68-13ac-4b23-b046-80e60706f4b0", "comment": "Malware payload (PovertyStealer)", "value": "ec6d5a468da150d5210a8df2ffcec8163939a6f8a2c98ec5041aa3bf36c92452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750817, "uuid": "420b9641-08c1-43ac-ba2d-7451097c8ebb", "comment": "Malware payload (PovertyStealer)", "value": "c4239c9af4501c4c9eda98cd5151b62c7b5963da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750817, "uuid": "0c5d006e-ff89-4262-ad94-a7fad6396ca5", "comment": "Malware payload (PovertyStealer)", "value": "ee424cc122f4dcfb13e2bc81331e669611d15dabc179a1a2545ce41485dab0ec8551823583326fa395b62bceffd99331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750817, "uuid": "2620fb5f-3aba-46ef-8dbc-92d46c6c6f71", "value": "T1D044F10E52D820BBD4BA437985E742C7AB7234B00B6957FF02D5C9B86E432E57538F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750817, "uuid": "094cb64d-b649-4e0e-a8c7-b9d97cbd7e89", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750817, "uuid": "8d44631f-44c6-4a1b-895e-1436b15fd361", "value": "6144:gahO/p9I32h6xXTsGjSVOtQxhVKNCgobS+EEzlK:giYpGpmVZVFzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750817, "uuid": "502c00d0-8706-4694-a6f7-7474f810f3ea", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750817, "uuid": "de3ecbd3-b6ca-4917-b265-777937b8787d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750817, "uuid": "98c62e89-2568-4671-aca9-b1498cebc724", "value": "0daecdebcceee34bc19cfc209e9e3f36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5162474f-49fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693706713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693706713, "uuid": "22f23b98-6180-4415-b861-69959bafb89b", "comment": "Malware payload (RedLineStealer)", "value": "6143ccecd29cd0fd0653939a355387bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693706713, "uuid": "c0b79f69-009b-4fce-bd4c-36aa757f0c32", "comment": "Malware payload (RedLineStealer)", "value": "ec770b8a8cebbc77f7098c12ff387a0670399c432a943ee3aa9bcdc123f011b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693706713, "uuid": "53c07fcb-aa7a-4e58-ad2c-113d5a855da3", "comment": "Malware payload (RedLineStealer)", "value": "9d0817ca5801501c820a215a470155cd7bd931a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693706713, "uuid": "ce2a3824-91b0-4454-9acf-5107171275d9", "comment": "Malware payload (RedLineStealer)", "value": "2ec477f2559e05a210e49156155b2fa67a79d65ebf897da39c4a9530b4a5519113928f33fab2a25f4627526b2959f341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693706713, "uuid": "82367a42-f0f7-4fd8-acc9-54d23dac3f9d", "value": "T15C152312A6E94032DCB15BF059F64AD30B76BCA09878623B1785DD0F1EB3AC4743676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693706713, "uuid": "ece1848b-9a46-4844-8f79-539351361bc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693706713, "uuid": "fe2bf0bf-a736-40a4-a3b6-9ccf7725d252", "value": "12288:0MrWy90FNbdW16pX6313GLyafb1mUW7CSGwggThquMszJwvmuAN8vG4UrhPTzln:CyqNbdTX8rafhnWmSlltkZvpGXPTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693706713, "uuid": "b6d10cd5-8a66-4687-80d6-c2f2e9f7d006", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693706713, "uuid": "1e4d7035-9bd2-4e8e-a86b-7243d649cc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693706713, "uuid": "8ff55dbb-6132-4091-b949-e881dfb86bb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acb45fc-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693725680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725680, "uuid": "ca2ec154-59d1-433c-ab0b-b77c930db5e1", "comment": "Malware payload (Mirai)", "value": "bed1836b5f8ed1af2233ded0c76c237c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725680, "uuid": "7f902c4e-8d64-49aa-ac02-cd6d7231d2d3", "comment": "Malware payload (Mirai)", "value": "ed2aaa7ce26e71ad16912564c44cba99ff31c5d97cbe1f8c9609e0e83e98a2f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725680, "uuid": "b3f34ab6-05b6-4803-a469-e54ba9a57dbd", "comment": "Malware payload (Mirai)", "value": "30e4ab6de825a0fced7ad4abc6e4e5205cfff8bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725680, "uuid": "a64484e3-f879-41d4-a908-d3fdc58d4e01", "comment": "Malware payload (Mirai)", "value": "bb8addae8f33c1a3609ed14d28709627feffe3aa47a4da6476f21c8da2c1e6b0500e357ef364323baa921485713125c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725680, "uuid": "cfa3b538-d854-42ca-8d1f-18da00dcd147", "value": "T193538DBD866ECD65E00449B8A8659D308B12BC0892332DF6DA468E71944FDBCFC197F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725680, "uuid": "5a162e12-2390-4507-835f-d682cb828501", "value": "1536:haYs8eNYlOJ9dsOVFl4LHig+fs3l74y/qDm3MuCneQ:hONYlOJ9d1Vr4Tef+lU5m3MuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725680, "uuid": "481c2670-6efc-45b0-a5f3-a87cecd4377a", "value": 66632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725680, "uuid": "d296467c-a76f-43e7-9c73-eb20f323dd7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725680, "uuid": "b4cd868e-fc16-488a-b596-f6dadcd9a7f8", "value": "bed1836b5f8ed1af2233ded0c76c237c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc51ee90-4a04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693709496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709496, "uuid": "55a27061-c09a-4a68-9634-f4b2ee6eb366", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5d3cbe023c3e1e57bca5650e733da011", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709496, "uuid": "3594798e-deb3-40c0-9761-1c0787acfed4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ed586b013461f61285fafe5bc25912416167eb51d78b3a181c9e81e3d5c17436", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709496, "uuid": "e95f2a57-04f6-4066-8034-131a99f109ce", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3eb757325420e98790bd4308879735059f40897c", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693709496, "uuid": "3193e70b-14b0-403f-957f-10465c7ceee0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e3d681599370a66cfc9f656f9b0d5f89903313c8fc59bdba1b7aeeaa3007641f10f2d6ae27650eb09d6e3fb962143dea", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709496, "uuid": "39248bbe-e080-45b1-aef9-033ada0ab6e1", "value": "T15E252343F6A1D5B9F571E8F00C99E600543679A20878A29937FD5F8C5F33EE8EA50728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709496, "uuid": "d16c0172-2b3e-4399-9110-a9373ef00816", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709496, "uuid": "1c7abb14-532e-4d55-ba94-13bcfd07df83", "value": "24576:hI39dAcA1YObmDSgpYP9+D9a9b8DjdVPQHzGkyFV/uN4vxt:h6dAf1F6DNO9+D89b8DjLPezKuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693709496, "uuid": "5008baf0-b917-4f03-a930-30804b5a61b7", "value": 986101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693709496, "uuid": "d4fa51b7-a974-498e-88b8-0889340207bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693709496, "uuid": "ef55a4ca-d9f2-43af-88c5-69d246042efd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba86151-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726004, "uuid": "fdbe9fd2-6173-45d4-ab06-3115102081e1", "comment": "Malware payload (Vidar)", "value": "c5178d2bde804370464beb0a867439df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726004, "uuid": "6a63c763-289a-464a-9031-234470224bac", "comment": "Malware payload (Vidar)", "value": "ed91448d62d44af828d9f560c1f7648280f256eb388c20157607d948bd3cc4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726004, "uuid": "389f3708-e2f3-4c18-8c00-0e7b2e0b15bf", "comment": "Malware payload (Vidar)", "value": "062ef2edac8963b90bae0bbd66472eb69e246d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726004, "uuid": "458f2e73-eb21-44a7-97fe-5432c607dd6a", "comment": "Malware payload (Vidar)", "value": "ac0139b509f56279cf3eeb5ef60cf9094ad5a8b54ce1628f0ee75f931e9f25be2dde926c4b1a900bb1ca2b866c50f4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726004, "uuid": "f93404fa-9bf2-48dc-9153-8f4b1938b7aa", "value": "T19805F19365E3ACBADD150B758F1EFAFC7B1DB8514D25EB4623459E2E0931232C98B380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726004, "uuid": "526f6d0c-700a-45b6-b8ad-df0d75f590df", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726004, "uuid": "368abdf1-3588-4629-a219-a29ffc6ccd2f", "value": "12288:U2EsQPwChQgjqnkBnrH0HmKhnYedkClvXtD7/ypyBXyQT9qbKwdt5gy:U2YPAg2nkx0bF/XVupydyw9qWw7Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726004, "uuid": "60538fa3-d20c-4493-b65d-45999be17e54", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726004, "uuid": "1ece4e13-828c-4d4c-a1b9-7dd5b985113f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726004, "uuid": "eaf213fb-c553-4100-88de-f32ea723fa77", "value": "c5178d2bde804370464beb0a867439df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcc77c3-4a44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693736929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736929, "uuid": "4e2444ec-e340-42d6-bccb-344e62397a9c", "comment": "Malware payload (RedLineStealer)", "value": "74d00d97c125a4b2c7b6affedcb0d5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736929, "uuid": "a648b253-7730-458f-81ab-91c5af7e515e", "comment": "Malware payload (RedLineStealer)", "value": "f028eb7c28f4ad3126755a211a47f206812b182adb4ddb45c225802af1a27eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736929, "uuid": "c378553d-f2ea-4f5c-ae36-10206479af75", "comment": "Malware payload (RedLineStealer)", "value": "264768bbce5f67283a8d8dde0edddda345cc2136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693736929, "uuid": "f7b643ce-4745-41d7-a37c-009a1cd0386b", "comment": "Malware payload (RedLineStealer)", "value": "f871b9bf6bd0b3e59f12e9e38753be5a39de4bec6d70f04a4dd6ddbc72a1fe36a4af4be0ce0fd65dafb5945b4ad7380d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736929, "uuid": "fe690a0d-8e2c-4759-b1fd-8f56c87873e0", "value": "T1C2955A2138915122EFE710FA86FD7429815C90A007D54BDBEFFB06EFA6906D2FA3154B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736929, "uuid": "ca97fdd9-263e-4ba1-84f0-08e32e341def", "value": "58d286054e67e82e980e73e5f69f8740", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736929, "uuid": "01866744-2bb6-42d3-9306-35abe606ec57", "value": "24576:rmiZG6vS2CIP7tZJWDBtXGTabfdjSsAG2:zvS2CIP7DJU2ORS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693736929, "uuid": "90720ffd-394d-430f-b949-09cda063d288", "value": 2037248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693736929, "uuid": "3aea8843-a3dd-4ec3-b20d-1efa0985243b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693736929, "uuid": "a20046fb-6275-451f-ae68-c00672e61527", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1636de5d-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693750851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750851, "uuid": "674aa4b1-6494-4e42-bf86-e09505a1ab77", "comment": "Malware payload (Smoke Loader)", "value": "a89177b8a50cd9b218da79d66fb30d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750851, "uuid": "1e29e93e-89dd-44d4-a4c3-b3b67c138696", "comment": "Malware payload (Smoke Loader)", "value": "f0808f9145505d15318b254701b45482f31fba67e0d0c0fb675122aeadd229ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750851, "uuid": "c17f174f-1371-41d2-9150-9348e2939f00", "comment": "Malware payload (Smoke Loader)", "value": "da359a8628e9036cf729097efcc7a2daab1665e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750851, "uuid": "55f9f578-6829-4a41-8e53-977a981b9e8c", "comment": "Malware payload (Smoke Loader)", "value": "86dd8e01618093789757b35a009bcaca0a24c194e498d05597fd5c1702bd7066cc665a952e8ac3bf705c265bf26156e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750851, "uuid": "882f45ed-8cf8-49a7-9a0b-671f7b810235", "value": "T152546A83A1D0BC79D53E83718F1EC6FC373EB8918E29AB5727646E6A1931172D58B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750851, "uuid": "645b070d-165b-4ccf-84c5-cd56df5147f4", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750851, "uuid": "b8fd7f7d-6057-46a8-8d3c-6b889d175b40", "value": "3072:2acWUGZil7gisbWhSJ6xD3/boNwp9mmySA7DP1Q1NT1kQP0F8ey3TUf:ZDN07X3cQpboNwpQm67DP2n5kBLy3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750851, "uuid": "adb19eff-67e5-4b8b-84c2-5650df576bea", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750851, "uuid": "025aa144-4e37-40ae-a510-6646f48100a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750851, "uuid": "8b9c6d21-4c37-4302-85a2-26b91515fa9e", "value": "a89177b8a50cd9b218da79d66fb30d90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c53ada-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693725480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725480, "uuid": "a8e057bc-666c-4e57-847e-d4bcbacc6520", "comment": "Malware payload (RemcosRAT)", "value": "6957b0fe032a1738b97a2ee7f5fa564f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725480, "uuid": "c7e4a441-dd07-4010-bafd-cd84e9c43f80", "comment": "Malware payload (RemcosRAT)", "value": "f13f9cdc98da2e7267ca62e1af7f4448d9f798d2609c76c535aacd7dbd27e506", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725480, "uuid": "cf0f39fd-77f3-45d9-a650-48f6aed740a0", "comment": "Malware payload (RemcosRAT)", "value": "95938c47c50be83ab5a1de82c8af636a1fe76312", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725480, "uuid": "759499aa-c251-4603-bc23-637cc32a14ec", "comment": "Malware payload (RemcosRAT)", "value": "b24ec5031ce08b4ed92ae9b20e22877ce80985ef5c64cbc8f511274cd0a2f43529b4f7318d6ed60c3af2a0a84b2422fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725480, "uuid": "9c2ef715-24ff-42aa-9a76-27ddd36dc6ed", "value": "T102F1C80744720BB2667E5E2FD71983580F69C6B55B2A325FD4AFF324260AE70029EF17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725480, "uuid": "f5d3750a-cdc4-4238-9b52-573e8cfce0f7", "value": "96:BxIeyaEEb8yH9mtQ+VUVQVPvVNVdVLmhHoi:/Fw/u+myBHzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725480, "uuid": "cb31d4bb-b8b1-40f2-9b2d-6a572d6b5eae", "value": 7921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725480, "uuid": "87fa0876-c5f0-43cc-b647-bf566ce084ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725480, "uuid": "7ce9c0ef-456c-415a-9c92-0064415f4717", "value": "ORDER-230902.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9d8e62-4a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693726034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726034, "uuid": "48224cc4-b8bb-49c3-b3a4-ee8640fe5370", "comment": "Malware payload (Mirai)", "value": "d002f17f5d5ded4e3ace4f8024ff63e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726034, "uuid": "10ab88a5-b0d2-48bb-b5f8-6b34d0cff53f", "comment": "Malware payload (Mirai)", "value": "f2c492402fc17410e4043be40940aae611e9844e382d875736983480265ad62e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726034, "uuid": "781512cb-e5e0-4771-8abe-5a696cb56e7b", "comment": "Malware payload (Mirai)", "value": "dd84fbf11584d7e0d63d03aeac30a9e3a8f68c33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726034, "uuid": "392bcf52-ba9a-4bcd-b013-5ce618596c71", "comment": "Malware payload (Mirai)", "value": "c114c6508caa69605ed076f63feea4565595ac652cbb664f1cdb8c59971871ad2b626592f8aebe771b0cd661afedec35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726034, "uuid": "25cc59cf-0b47-4d8a-820e-1419f3534ede", "value": "T1C9C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726034, "uuid": "f4521add-c521-4770-b1ea-48822ac36bdb", "value": "3072:6jVlyaL5JCrIpv04s2bttiEiTmP46aQyfPlfKsNb:yoCJCN4s2bHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726034, "uuid": "5f6e6923-ec0e-42e9-aaef-b617de06e93d", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726034, "uuid": "f11ef30a-06d2-45ad-b1b6-4748eb66f1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726034, "uuid": "d127614d-244a-4e44-a515-7d56a829ec72", "value": "d002f17f5d5ded4e3ace4f8024ff63e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7ce44f-4a59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693746008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746008, "uuid": "4edcad20-00ba-4a10-b656-a6792260d311", "comment": "Malware payload (Mirai)", "value": "9100f172127680d67bdafb6a73e843e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746008, "uuid": "e04ba476-965d-41fd-b4fe-33de3cf6970f", "comment": "Malware payload (Mirai)", "value": "f3262e5d05c4c38b075bb1e99140030481f25675f33c98353a68278005db9910", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746008, "uuid": "d8401639-72f8-447a-b1db-1ae6ae65e91c", "comment": "Malware payload (Mirai)", "value": "91f2af6e478271ea69c20df02da4d4290787c0ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693746008, "uuid": "622d8a54-9bb0-4064-a5c0-13e7b87a9ad0", "comment": "Malware payload (Mirai)", "value": "eb56df1e72ec149446ad5a9985ba5ec6357e7a9f1e4109ada72541fbad0404c28c0d4df24d87c541f14fdeab6fddc0ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746008, "uuid": "dee50d7a-b498-4a9b-a7f8-12eb4909907b", "value": "T1BCC2D03465DE68A1CA3004BADB3C4A86779B5F3CF4FEB9A0458187F8A40500B7BE49CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746008, "uuid": "469eb581-1553-48da-a90f-5531de899f75", "value": "384:Ejt/koxisa34beDtZwoY5/d1WnTRJCUBKm3/TgX4/7XromjgMnOsJXahymdGUop6:ERsoTAZ5mdgndYUI+cXWN5nxXas3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693746008, "uuid": "6d2e45d4-5e6d-4673-b2e6-d27dcd434f66", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693746008, "uuid": "d8e20079-5e0e-4147-bc27-9fbd02ba456f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693746008, "uuid": "7f4ca63a-abec-4826-adb6-9772e9d2ec84", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01247cda-49fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693705719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705719, "uuid": "c709761d-cab0-499c-bb52-7a64e24ca6c5", "comment": "Malware payload (Mirai)", "value": "e393d8158447c84d2643d1c4a733f723", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705719, "uuid": "6bf4a39a-44c7-402a-81dd-2cd44bd358e0", "comment": "Malware payload (Mirai)", "value": "f3cd97475c377e7427f62251256e2c85ef05eff08e4feec03ea1270cb2ad952e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705719, "uuid": "e8d4033e-5740-4ded-be9a-de68b896786e", "comment": "Malware payload (Mirai)", "value": "24a3be9977f32760e8402630ee392c0a7f13378c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693705719, "uuid": "a1b295d6-30a9-475d-8b31-5e88e3ea89ac", "comment": "Malware payload (Mirai)", "value": "5b701bfbb3bc1c1507f1478eb494f6459310c0e9d748ae042f440dfc477a5c3cd674096d5e91e3625fe43445fd77aa7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705719, "uuid": "92083407-2ba7-4f25-b5a3-17a721c54513", "value": "T115B34973CC296E58D564D1B4B0B08FB82B53A990818B5FBE15A7C2759083DCDF6893BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705719, "uuid": "4efee2d9-f4b3-45ca-9091-90464b696a42", "value": "1536:ACFO2AMJ1Wxbnq3xVxE5DEkCQKowlm6X/8CgoAQWHHF7ED1ZC:AEW9pDEkGoe8CCQWnF7mZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693705719, "uuid": "018fc435-5bc7-4068-b3ad-adb9dacb0c6c", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693705719, "uuid": "42760d3e-d465-4c30-8e83-7f33a177c37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693705719, "uuid": "f268d250-9cd7-4be4-b0d0-abeca14a4baa", "value": "e393d8158447c84d2643d1c4a733f723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f88c3d7-4a2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693726359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726359, "uuid": "b37a60ce-840f-4f5d-ad5b-eb50a40e99de", "comment": "Malware payload (Vidar)", "value": "7ce8af713b1e614c714d34013d6c7ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726359, "uuid": "235b4832-5a02-4868-b674-e233debef903", "comment": "Malware payload (Vidar)", "value": "f56b1efcebfe6e51a54bc6910a5bf580ab2efc28db69828713c27ebd1a8a99e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726359, "uuid": "87921ba3-2bae-49bb-bd22-ca729830da1f", "comment": "Malware payload (Vidar)", "value": "982a3dc105005bdce767414c922b8e4322e58b8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693726359, "uuid": "fe34446d-d0be-4e6e-80f9-69fadbfb113a", "comment": "Malware payload (Vidar)", "value": "d64d46164d6e15a18c7d0d535db9d77d50ad249ec7e08fabf8bfcdd0477edb266e0e61d136e26e22e56caa769d507b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726359, "uuid": "879ee253-c034-463a-b687-d1c4c383bb49", "value": "T1B6A4E64382E23D59E9258B73AF1FC6EC770DF6618E097B656218DE2F04B11B6D1A3702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726359, "uuid": "acda75a9-f0d1-4a1a-ac85-1766c9842fc5", "value": "c70ef6d53be2f295ff40d493693c8e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726359, "uuid": "6ff221ff-f9b9-424e-ac79-5ac8a0096fa8", "value": "6144:gwf0dKRr1GcP5iGcCoA74YC8Vg+GB8Rk/IKnRXyL:gwf0dKR75iGcCoA728WpuyAKRXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693726359, "uuid": "8bae8d80-0930-4b4c-9856-1d2d887c339d", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693726359, "uuid": "c35e2b4d-d936-4e33-8cb4-52e9e4b5cb06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693726359, "uuid": "9ffe800d-5a78-4d65-b62e-bf4574ad214c", "value": "7ce8af713b1e614c714d34013d6c7ff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba757db6-4a93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693770884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770884, "uuid": "30686e88-5af1-4044-b266-10539f2e12b0", "comment": "Malware payload (Mirai)", "value": "b2d06b60c152191266e84a276aba5820", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770884, "uuid": "a65bbb37-7742-4f07-9e09-a968a312b0af", "comment": "Malware payload (Mirai)", "value": "f6a1d74bd25128439495b42ee34120c469527ce6ea9f1730b9d2e1556b20ec91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770884, "uuid": "b0b70862-65e6-4bd3-af75-cc786c1c9912", "comment": "Malware payload (Mirai)", "value": "02b164b45b83526a1c373173a400e7ae88adee00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693770884, "uuid": "42b1feb8-9286-4a53-a252-07233f746398", "comment": "Malware payload (Mirai)", "value": "a15e1c7e872bcfa2f8673b96fd5b5b43db7c2d512c80f93f03cfd2b9327ea362045f4a6c9b569e1592e867d4a5d6a28e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770884, "uuid": "fe6f73d6-ea87-4d12-b3a8-3b3c3b35663e", "value": "T171E30A56F8819B12D5C111BAFE1E124E37131B78E2DE73029D246F747B8A8BB0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770884, "uuid": "33fc8035-eeaf-47cb-8a62-43e6e50ab117", "value": "3072:EOcKiUobiTVX1s+ngAal8TaXrsC23CGiRVI:EOniHSVXi+n5aAnv3CGiRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693770884, "uuid": "086c6523-28a0-48d6-afa0-b1e393b81ed5", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693770884, "uuid": "496bd141-3359-410b-87c6-04e282fa57dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693770884, "uuid": "95912c21-816c-4275-b778-8267b11cf757", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14286488-4a0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693713052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693713052, "uuid": "a0b92090-1823-4bf5-aec2-f9e44ec56d90", "comment": "Malware payload (CoinMiner)", "value": "d62bca8ebcc022080e830b1d43ec5a54", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693713052, "uuid": "b80a9aeb-cec1-416b-b8d8-a71a549be946", "comment": "Malware payload (CoinMiner)", "value": "f7480141db0a38a8f9e44ecf304637c93ece31b915e40d0bed63e1ce7a424ed3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693713052, "uuid": "2ed8b9b1-6ace-4567-affe-775d44f51484", "comment": "Malware payload (CoinMiner)", "value": "2f8a674018d994f88261f6fab9a6312d9a52b27f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693713052, "uuid": "8a40e326-e9c6-4046-943b-8a7478a5e118", "comment": "Malware payload (CoinMiner)", "value": "bc11f7a24ff50a01d6946c00f0b5b0c05af30be3322e1f3c709fcda62f42509d05ca8ab8f1b26862a1d7f6886529ba01", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693713052, "uuid": "46a41672-7a4a-4a69-baf5-b3ebc4d26a35", "value": "T15A56DF0C6EC719BDE0FFC3FC2A6933BC65E57E8C767221196D86A59219943690B0C0B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693713052, "uuid": "b393f267-6f51-4a59-92c9-92de6a270167", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693713052, "uuid": "9c80edd4-a29e-45a7-a8e0-68bb1125bce9", "value": "98304:mM2qHjL8DDXStJMWttn5X3IjLTyy4GvCEpeT0lPVvqgYJvsPvl:m7qHSjgJ63HpeuVigYJovl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693713052, "uuid": "c49f1aea-a4b0-4687-b620-984415852dce", "value": 6029624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693713052, "uuid": "87c9636a-64aa-4e83-9ffb-14932893fab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693713052, "uuid": "c66c2f8b-5d35-431c-9178-50439d2e461e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fbbc4a-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693750896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750896, "uuid": "a0049e30-2b3e-4fa7-b274-6443a9e86537", "comment": "Malware payload (Vidar)", "value": "fff85d798c9668ab7a69bf2e236ca19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750896, "uuid": "74f3bf68-a487-4123-ac01-d47e8a54f034", "comment": "Malware payload (Vidar)", "value": "f8147fc0d613f1a59f440c72da1c76273f34a1a00f1bbca9168ee82efd54589e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750896, "uuid": "5966d187-8465-4646-ac93-12e90b430ddb", "comment": "Malware payload (Vidar)", "value": "4418058b8b6b4714845f3c5652c6f6c04bcdd5ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750896, "uuid": "ae5b013f-3952-43f6-b398-3bd1e8700f77", "comment": "Malware payload (Vidar)", "value": "51715ff352ac74e153ef83bdf3a38327822e6f7ad2b2f3e125587212a7c4014466ec9896924c213bd31e11f77982789b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750896, "uuid": "bafa6514-d295-4e5a-a849-9ea88ab6085f", "value": "T10505F08369D1BCBAD52507748E1EC6FC372DB865BE15EF932704AE6A1631172C58B303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750896, "uuid": "32441776-970f-48ac-9449-74b429aa3a61", "value": "86ad0e3d91ec35fd419d3de1888ddee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750896, "uuid": "3c46dbb9-2571-4b03-bf7d-e5423246cae0", "value": "12288:IkIe3Nll5jV1FJUQBdMO6AowTN6j/CnZvyWv6+KryD:IkXz5puQBmOJ9WCnZKWuyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750896, "uuid": "ef0b0e74-5556-4b4b-b04d-ca296405801b", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750896, "uuid": "1b0eb7ac-3ea2-4f71-a08f-3714c3357369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750896, "uuid": "00b50e97-c904-42a6-9e00-ee594f67eb45", "value": "fff85d798c9668ab7a69bf2e236ca19a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cb59be-4a9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1693774527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774527, "uuid": "0a23fd35-979e-4864-84b1-156bdf60cdf3", "comment": "Malware payload (LaplasClipper)", "value": "197bebce417f5ba6c178ee34037fbdea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774527, "uuid": "f7acd54f-b444-4679-8b4c-f03f2805a33e", "comment": "Malware payload (LaplasClipper)", "value": "f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774527, "uuid": "7204dd7a-7a08-4a64-85aa-92cac6713680", "comment": "Malware payload (LaplasClipper)", "value": "d9dc871f8e61e590115bae9b0d842fae0f8f52b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693774527, "uuid": "f767f6bf-6d5f-425c-bf26-cadf8d6f6901", "comment": "Malware payload (LaplasClipper)", "value": "edef771a906f40df404a6d73ee86b25bacb4c288d71ba7d39f20ffe1afbfa426f5c46a492277b9bea40e6e394ea69f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774527, "uuid": "957258e5-57b9-4614-b987-4dff31c4702c", "value": "T156B6CF43F84186F5C0AED130C9659253BA717C881B3027D33BA1B7B92B77BE46A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774527, "uuid": "a9dc9188-9478-4ae2-9341-a9fb018bc97e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774527, "uuid": "ae5edb52-0756-4fcc-be12-6050a39bc405", "value": "49152:4EjwvlIKv05z+UERnIcYmWjc3Cdhu5E9UFiqeb0/B1Y4kIZxdez6LK+/BV6Cbfoq:OlhWzZ6hnEciqem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693774527, "uuid": "f056770f-8842-45ef-ae4f-c04925c589da", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693774527, "uuid": "578d10d2-7bbc-479e-9b13-13bcbd5e94a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693774527, "uuid": "e7667e34-bc63-4e33-9aa9-cd9116af03e4", "value": "197bebce417f5ba6c178ee34037fbdea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda4f42c-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720289, "uuid": "d53d77fe-45e3-44bb-b43f-28b852d0c799", "comment": "Malware payload (Mirai)", "value": "7bcadd76501e24a776e081cbd5edaa5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720289, "uuid": "a9457f43-443b-42e0-a944-16a8b429b4bd", "comment": "Malware payload (Mirai)", "value": "f9431909d08f4ff2088bafcd84d46c3d5e3bb9399a093bcc98de0fee70579459", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720289, "uuid": "f406aa36-5c2e-4cde-9319-636093170340", "comment": "Malware payload (Mirai)", "value": "4201dee417580a34bc2a16f8d5629da092a22cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720289, "uuid": "8afc0251-90d4-4e87-959d-b7441cd51a2e", "comment": "Malware payload (Mirai)", "value": "9a1641e60533d30355ad81317521067159617c3b5d3251eac92330b8c61738686358bda9135b664df97a104a121c2afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720289, "uuid": "f58656da-4af2-40db-823d-93395577455e", "value": "T197635C85A802DE7DF98AE67D50510E0BB520631165D30F2BA7AFFC93BE731689D31D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720289, "uuid": "966e06b6-5c01-40f7-9782-3be86becb8f6", "value": "1536:cntG+PXRozyNPiFQ+xMav88JvkkkwvpWs3PIIt:ctG+V+x/NRvpt3PIIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720289, "uuid": "94307190-99e8-4d46-8b51-afddca202c79", "value": 67384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720289, "uuid": "a325891f-d14c-4059-bd06-8304852c0fcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720289, "uuid": "6dc86119-33fe-482c-afa4-92545812eb8d", "value": "7bcadd76501e24a776e081cbd5edaa5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5fd83f-49f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693700802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693700802, "uuid": "cad37d3b-a875-4f4d-ad65-f47b69b979bc", "comment": "Malware payload (RedLineStealer)", "value": "55f845c433e637594aaf872e41fda207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693700802, "uuid": "a50f762b-cc1d-4afa-89c5-6cc65b0b7307", "comment": "Malware payload (RedLineStealer)", "value": "f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693700802, "uuid": "3007d7fa-618d-4c3b-a627-a5c942131d70", "comment": "Malware payload (RedLineStealer)", "value": "1188348ca7e52f075e7d1d0031918c2cea93362e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693700802, "uuid": "1f78a42c-650e-41a4-86ad-657653768e28", "comment": "Malware payload (RedLineStealer)", "value": "abd258c2f365e5d3700b2b7abe0ce1bce06bd50e01060df7239b70e5b2dc7fbe3faf949fe3864e5b7face42027fe91d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693700802, "uuid": "e5f0a853-6925-463f-99e8-9311925f2b89", "value": "T19D644A517912C032DA6151721AB5BFF2C5AC6C249BB049DB7BC00E76DE212E6BE70F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693700802, "uuid": "78ab2b6a-6e8c-4005-b658-a4fa0a623966", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693700802, "uuid": "abf41d48-5b9f-486b-a68d-e134ae16634f", "value": "6144:GUG2bcUH6Z0+ReEjhVsJgAmkMAIeuudb8MT8AOacOZS:GU9bIeEdVsJqeuudbFT8SZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693700802, "uuid": "aca1c1e9-243e-4034-8577-7b22bbec217d", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693700802, "uuid": "a3d7e877-ee60-4b18-9c62-027fe39fca94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693700802, "uuid": "ed89cfd7-c45c-4219-aef0-a8a5d8810ffd", "value": "SecuriteInfo.com.Trojan.DownLoader45.64798.14568.10081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cd34b7-4a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1693725749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725749, "uuid": "8e093653-11b1-4f8e-a7e3-9bebc9ce9816", "comment": "Malware payload (Tofsee)", "value": "d4847c9d1bbe830f5a683d2c7aa306f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725749, "uuid": "b3052a93-b5f0-43e1-8612-2d627dc8c8a0", "comment": "Malware payload (Tofsee)", "value": "fb28c37262eee77bb914cd94b179336b1f458702280e4b611a49edf7599dae74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725749, "uuid": "32004ee6-9ea6-45fe-b371-86deebed190c", "comment": "Malware payload (Tofsee)", "value": "8ab9f267c0b7e3ff4a22abddcf0931c9e73b2dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693725749, "uuid": "fa93c4a0-91e3-42e8-b776-5822a8eaaf04", "comment": "Malware payload (Tofsee)", "value": "8f3f7add3957afcfda9fba19622a9431863c24954e096b36b584f996a4384238705e3b4dcb47de599bf458dd9f580afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725749, "uuid": "95654c56-d79c-4633-a244-27a5a212b136", "value": "T1B784B643A2E17D58EA258B73DF1FCAE8770DF5608E497BAD22189E1B04B10B6C273715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725749, "uuid": "06732fe4-c249-46d1-964f-cc4974c45523", "value": "1ebf24c5f43f6b7b8df6a68ef563ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725749, "uuid": "1ea9fa7d-be96-4631-8289-78111e4b46f4", "value": "6144:3KE9iiJnPV3RTDisrksP/YvgLUebH/SX/:aE9iitPV3RSsrksPUgLUeL/4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693725749, "uuid": "9ec7e002-a8fb-4f7f-b41e-e40576ddb856", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693725749, "uuid": "5866be7f-20e6-427e-9ef6-6d9d30ea9152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693725749, "uuid": "27d2075d-494d-4059-9b9a-4022fc76e37d", "value": "d4847c9d1bbe830f5a683d2c7aa306f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe9c4b8-4a1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693720206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720206, "uuid": "a05094dd-594c-440b-8c8c-191f1bf11d7a", "comment": "Malware payload (Mirai)", "value": "22a93d8d9e748bfba071c6b2322a9ce2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720206, "uuid": "2bb64a59-572b-479b-b6eb-329b97578484", "comment": "Malware payload (Mirai)", "value": "fbc71c904fb5eed1759d1376c62eceef5b93e4f53c098acb416330ff9d4f681d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720206, "uuid": "e5817f4f-dd88-4fcb-b2d6-3ffbdcee70b7", "comment": "Malware payload (Mirai)", "value": "bfac778a55cb3ff037bf235ba507fdcf583314c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693720206, "uuid": "ec14bef6-b7d5-4363-9f6f-7fccfa8ee552", "comment": "Malware payload (Mirai)", "value": "13a1072b0b557542ade3b5871083544f282a9f32f01c62ed39898e8670b240bf54e554b022e52cb8d4f00c7dee64257e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720206, "uuid": "a2352739-5bae-4025-8051-d6af69a1d885", "value": "T1C0C2E071446BEC5187610932FA2DC005AFBA367841E772FD193C933858CB499ADBA9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720206, "uuid": "2960c8ab-b444-4c44-9635-f429a2e328b4", "value": "768:RRkLQtsN1OpBlKZuMWpXgPfZ8LZV8wVSs3Uoz/C:/kEtuuJgPfqZWwdza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693720206, "uuid": "37e05179-55d9-4c76-b1d3-85ec38c2ce98", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693720206, "uuid": "c8c6b389-f9df-408a-bb78-8b9f674da507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693720206, "uuid": "8e67865a-bc71-439c-a200-899b0726da79", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f381ca3-4a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1693750920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750920, "uuid": "1effac43-992a-4a50-98d4-f3713306a675", "comment": "Malware payload (Vidar)", "value": "d932fd367c2d603dc3b11aabd8a62546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750920, "uuid": "408ec0ca-9071-485c-9ba5-d5d959eb1320", "comment": "Malware payload (Vidar)", "value": "fda8cd3cfc7e0067e5f5323399038f3304ade670b2e1b327c1430dc615ec2062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750920, "uuid": "3b7039e2-51a3-4622-a43c-88976d070cec", "comment": "Malware payload (Vidar)", "value": "42960fe85a9c6be9819d43984582e0e13f684506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693750920, "uuid": "b6aa2369-83ac-4fa2-9937-16059ea8a0ca", "comment": "Malware payload (Vidar)", "value": "ed46d4d43d4363c91e66e73ce352d964fc0192de283ade3cc71eebbbcbe9f9f1ff09affeec5dfe59f940e4874815a1d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750920, "uuid": "e56e00b9-981d-4b5a-9c87-4b92c962dce0", "value": "T172749B8322D1BC7DD41843758F1ED6EC772EB8618D25AB8737542E5A6A322B2D603FC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750920, "uuid": "9d9f5743-a1de-4a8e-b188-8c652d6e5acc", "value": "2a123acc27b236e216ae4898638c3f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750920, "uuid": "5252560e-ac11-4897-a9ec-5c46dafff07b", "value": "3072:AZ7Il8gafR3KsOhtQs4+M/SKx2TA9PFCWpZM/eWrsNLs+OQsa37KNFn/6731ryPP:M7cgRasOjA+bebbrL3OYeFy7qC0shTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693750920, "uuid": "f078d9b9-9c5c-4a7c-83a2-e4fc35f9b3b2", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693750920, "uuid": "1fe972e0-7242-4246-99ed-5bf15053cc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693750920, "uuid": "5cc9f0ec-df9f-4f90-8046-9d7a93a57b00", "value": "d932fd367c2d603dc3b11aabd8a62546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }