{ "Event": { "published": true, "date": "2026-03-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-14", "timestamp": 1773532982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "557d6337-6f8b-437e-b55a-b4c5d17771e0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e4fc7d-1fcc-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773509956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509956, "uuid": "e39b71c9-5c0c-47be-b778-071349ae9bf6", "comment": "Malware payload (ACRStealer)", "value": "02697bb903c14e86e1daa6dddf2c34ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509956, "uuid": "c7a40374-6bc7-4581-9c47-a0e330317c98", "comment": "Malware payload (ACRStealer)", "value": "01342e9b54961e49b7ea484fa1980d9bc5080ef07081d2e518b74b2140254961", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509956, "uuid": "1ce7b727-70d6-4630-ab6a-b8345abfadf2", "comment": "Malware payload (ACRStealer)", "value": "b2d60fecbd759d5d91276bb636b6a750c62d8a04", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509956, "uuid": "d8485ced-2df6-4158-a809-31e88aa87a86", "comment": "Malware payload (ACRStealer)", "value": "b9ac99c57fdfa08f38243b0357cb15991de730436c5a3fa81e97f41592345a83e62446fd0a8ea4db0b4975bc188821bf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509956, "uuid": "4ee09aef-8308-4c35-9385-396628b1cc11", "value": "T11595C4CB11E356F2FB0F8E3A9832A35F5717D1496B20CDFB86B56D13A9627E60070642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509956, "uuid": "683aa2bf-c7a0-49ae-b39e-c02b982236e2", "value": "f70768ebc67573ba5bb0b8f86cfefefa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509956, "uuid": "37ad567d-bbac-4add-b047-5a828673434d", "value": "24576:QwawqvscnjTAnfVs5Xz1V42PkE+sJPrp2WF/1FnICmLUc+zNQprU8kIKRbHjIiAE:KsAEmf8tdZcSrZ37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773509956, "uuid": "a86bcdd1-63d3-47e3-91c5-e25870cb6a3f", "value": 2030592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773509956, "uuid": "b0d7520c-531f-4887-b737-3e4b338b8e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509956, "uuid": "81b54315-3790-40b3-bb6d-52b4cc268645", "value": "SecuriteInfo.com.MalwareX-gen.22683492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a058406b-1f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773469971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469971, "uuid": "3ad72f48-bbba-4645-b9aa-9b1c135a84db", "comment": "Malware payload", "value": "5c2857913efc6007b3ee7028a132baa4", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469971, "uuid": "0c98828c-107c-44fc-a64a-b1d87f514524", "comment": "Malware payload", "value": "016cc33b8ff5dd4c7ef1f585ca782db994a620ed73fa127597723512b68744cd", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469971, "uuid": "2fdba735-de0d-4088-8697-88b7fec7bcb6", "comment": "Malware payload", "value": "fb4a5849fe2a1bae3fc974fe9bb2f4d87948a885", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469971, "uuid": "17c9a678-47fa-4ce7-a43c-0530447fd7ab", "comment": "Malware payload", "value": "3704885cc993cf7044ad7eac6395c652bbb1387cc3532535b05859e68ebbb0b2c10dacbed6e78308f8304465f98f6301", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469971, "uuid": "7bf82e6c-ee42-454f-b7a6-bb2f3ceeab2d", "value": "T1C7D1095506C7A04CE5FA61BA7D51BC78C56A091E7DED8EBD2BD2A04C7C821C22A2EE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469971, "uuid": "48420b18-fc08-4829-b297-f6d047226468", "value": "96:xNcXfJjfRkoD/fqzbppWiYj8vKyCJSH+PE2LzvFM:xEJjpkTfUzJSEEMzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773469971, "uuid": "6c77e6b0-13d7-42af-bdc0-09d7d78f1262", "value": 6464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773469971, "uuid": "89d2d4da-2220-4dfe-9502-285933ae9f0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469971, "uuid": "c162c0af-3104-421b-b8e9-fd9d521d71d8", "value": "PumpGuard-Pumpfun-AI-Attack-Defence-Requirements.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810bc21d-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504278, "uuid": "ff3e8ed5-ea04-484c-93c7-da40dc37e15c", "comment": "Malware payload (Mirai)", "value": "c941e62ca91f8ba3c3d3cfce72d031f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504278, "uuid": "8cef40f7-0113-4aee-98b7-59dbcbd2efb6", "comment": "Malware payload (Mirai)", "value": "019670738b1676dfd487140a49d27781f90fbf9a67575ebc5f18c86ddfa8eb00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504278, "uuid": "7f9900e5-712b-4146-8a46-f8c8fff0a94e", "comment": "Malware payload (Mirai)", "value": "eb29bfa2a424b211226741fb9b6e16b29a5afe62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504278, "uuid": "0f3909ca-b2d6-4b37-9511-6c1eaa4b699d", "comment": "Malware payload (Mirai)", "value": "1f6e02e314f9908f9cfe8a5a088f4e8f3d43952724be813faf4555c4cd61f2467685e52bd47c6087ebe452dce28d0548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504278, "uuid": "a8feda5f-8be7-4b74-88f2-9ebe539b3f84", "value": "T19463195AF8815F11D4C621BAFE4E164A33635BECE3ED72129E205B2037CAA5B0F76C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504278, "uuid": "12bb8c21-ae22-4da5-93ed-0fbdf8432b21", "value": "1536:3Kn3liNnECQ1qe4+aJkrtUnihyCla4iqppE1/NHY7M3+U:TECQ1qe4+aJkhUn7AppE1/l73+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504278, "uuid": "63d481ca-051a-44a1-b6f7-69eafdfbad7a", "value": 73060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504278, "uuid": "0e057ca7-f45a-4c1d-962a-0a55e2cbe7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504278, "uuid": "d088407f-15d7-40f2-869d-0a74185fb24b", "value": "wlan.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50877349-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516223, "uuid": "3beb3abb-fa31-4254-9539-daef3a6398ca", "comment": "Malware payload (XWorm)", "value": "76ce955808db9cbae7cb6b4d24cd9fdb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516223, "uuid": "5c34ffae-6d69-499f-bae0-3974ecff6baf", "comment": "Malware payload (XWorm)", "value": "01ad4ebf895082621ab065c9db739699c6f35b1174e343e49082a90feb492ad6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516223, "uuid": "5c5d91fe-8562-42e8-816e-bdb37815d707", "comment": "Malware payload (XWorm)", "value": "1920cb432c4a7e8a25715b876800792ff87af5a2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516223, "uuid": "10b74cf7-52ef-42be-b166-8446e212322f", "comment": "Malware payload (XWorm)", "value": "83640301a84f191999d2fd42ddc506ad59c326baa7639f6f86e00498b0587a89dd14208fc66b178d668e6b3fe76120c0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516223, "uuid": "e696d68a-a91c-4e4c-b574-7f236708f6ba", "value": "T14C55017BB419658FC981661DE0CB8DCBDAD2E9B43B25750270A278C78FD1D6730ADC28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516223, "uuid": "94375ccd-81c5-47e9-a589-a865aa198b0a", "value": "96:l++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++E:omrM5aIAmyuu90tXgz35ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516223, "uuid": "1c03c3dc-a217-4be0-adac-fa04fcd47fc1", "value": 1292790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516223, "uuid": "6a80706a-b29b-4161-b040-5e8317c89f00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516223, "uuid": "d506ed23-bff2-4621-8ead-8fab367288d3", "value": "76ce955808db9cbae7cb6b4d24cd9fdb.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807122f2-2000-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773532195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532195, "uuid": "a23101b3-6081-43f2-83cb-9bfaf50438ec", "comment": "Malware payload", "value": "4509beb739446a5b6236bc30aff774d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532195, "uuid": "826c908a-fb7d-45d7-9752-768df09e1882", "comment": "Malware payload", "value": "01d397bf60b8abc00a81abf7b07aad3081d21edfbd5d3094201737ff4c4a7287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532195, "uuid": "3385d5e7-cbfa-47c8-9f48-26e6c9e0cd02", "comment": "Malware payload", "value": "091ab00b6a7b12f3630fa9cbd321ec94f87254ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532195, "uuid": "ed9c7acf-142a-4ca6-b6a4-afee47df4f97", "comment": "Malware payload", "value": "5ec9b61dc62dff9461b4d98fa64835be6999c96617535a57c103c4a9ae1520a966884db41208a36ee55dd5c0b4488fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532195, "uuid": "2ffc43c9-0dbb-4190-8b81-f7d6f2bcb099", "value": "T137A58D0B6CD154BAD06AE33288B692B1BB35F8084B3233D72F6267782F767D05A35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532195, "uuid": "08f968a6-1e2b-4ab6-891a-df4b017449dc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532195, "uuid": "65be3c33-9365-4b39-af0f-13d37802dfef", "value": "24576:CTaKR3iq6BOjc0upFLWWux35jF42NjfnaTQhUjLlW6fdCq/jKNuRGB3OGiWfK1Y3:CT3R3izpFgJfnEfLlW613RI5VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773532195, "uuid": "83a2c5a6-5621-45b1-b772-2311976ccc58", "value": 2263040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773532195, "uuid": "2824053d-7ac6-4b40-b522-b84164cdcaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532195, "uuid": "839a4953-05f9-4b4f-a788-74cb8e29463f", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83797c38-1fb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773500847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500847, "uuid": "9ba70ccc-0170-4d86-a757-8d296b5a1a9c", "comment": "Malware payload (Mirai)", "value": "bc466cf2852d7bda85d96bf258618441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500847, "uuid": "b86d053f-ac92-4622-86c6-9e3858673c5d", "comment": "Malware payload (Mirai)", "value": "022079ee159c5b8dd3997a722d50c0a7f51843bc68e77f0782ff1b0e9e5a786c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500847, "uuid": "10e93d58-eddf-47c7-8b4a-26c9a2c468d2", "comment": "Malware payload (Mirai)", "value": "ee291e8984d32577c1bdac2b31812a132e0151d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500847, "uuid": "1ea086d9-5e69-4c5d-8045-4e7d8eba5d40", "comment": "Malware payload (Mirai)", "value": "d97d46a1b58fc17662a10c417bd738681348bc5af5c1d94bb9c5f570a88031215f901d0b940d5040a5627ebacaf40377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500847, "uuid": "33ff1eb8-f44c-428b-8778-d9e09cf8cac0", "value": "T1CF53F136870052A4E1AD58F556C942942D744EE396CED99A3DC1D701DE083ABE8C3FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500847, "uuid": "30da16ed-14e8-44cc-9b95-3c649e36baf6", "value": "1536:YmBYqJ0rAqbk7NApNzgkKiwxFIMIIaQ+FxzW50VSU:Ypo0E+mKskKPxFXwi50Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773500847, "uuid": "d4acc1e0-2ea7-4d58-9be8-a788a762cea1", "value": 65732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773500847, "uuid": "4aa7a29a-c65d-4f87-8d9f-32b78f4ca6de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500847, "uuid": "c57497a0-f62b-4508-bb6c-76635b1c5403", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0d03fe-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773514873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514873, "uuid": "c01e9f8b-1d9c-4fa7-b41d-8c2e3bda8c53", "comment": "Malware payload (AgentTesla)", "value": "8ea2b81df598f75ffd6f702f53dc6e1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514873, "uuid": "94e0deb0-d59e-4664-9496-98e4989407cb", "comment": "Malware payload (AgentTesla)", "value": "0295cdcd773395a045c54f3f928a0556b6615861cf1bc92f1e16bd72e083ec11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514873, "uuid": "066f562e-b0fe-4af9-8936-0121f2274ef5", "comment": "Malware payload (AgentTesla)", "value": "20572cc603ee9ac24606fdc903455509c70dd68b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514873, "uuid": "151ba240-42da-4ed6-9ed7-976da5807acc", "comment": "Malware payload (AgentTesla)", "value": "e024a000c6a03b14738b6b32d83939e52268ab3de682dd9d83709bb0b68cfecbae9dc5883a60de4d636c1cc3e5a1732d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514873, "uuid": "d87a1486-d5d5-43c6-b583-f67d68053b13", "value": "T17B55AE54EFD42834C2E8FB1470FA74111EDADA1298F3EF476EB964342EB64C22653E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514873, "uuid": "7ff4a2a4-7308-4cd1-8b38-ecdc4d619b5a", "value": "24576:vYDZM96GEf9WLAf1n4AT9ajpvzBczHZjpi4QpG3N2pAqG:02/k1kpLAe44jvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514873, "uuid": "138c23fa-5a52-43b8-8d1b-af8a89b3d2c3", "value": 1322837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514873, "uuid": "48819a7c-0866-46b0-9506-57172326455d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514873, "uuid": "72a68e0e-4593-4075-9e5e-8ae191fb301a", "value": "8ea2b81df598f75ffd6f702f53dc6e1f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753da8c1-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495239, "uuid": "16418377-a361-449c-8ac2-05b8e217f2b0", "comment": "Malware payload (Mirai)", "value": "00e2924a7e3bccc87a604faa3695eab1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495239, "uuid": "1fd15ffc-d591-4767-a991-307e9ecdaf59", "comment": "Malware payload (Mirai)", "value": "02cdca24eaafdc0b75eaac9de56e92b32334ff5cf2cad82a383d831adb0594de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495239, "uuid": "237a7cee-b1e5-4df5-87ac-030301f6646d", "comment": "Malware payload (Mirai)", "value": "87bbe444fcd84675442ee645a3fe84e468a238cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495239, "uuid": "e6b4f1a4-db11-401e-9438-845f10543ed3", "comment": "Malware payload (Mirai)", "value": "f043f88b084b0f0b76377bbe76278be10e0bf3576940685e75882f8618f4ed96e6951443de509db76a941dd35614fcdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495239, "uuid": "52d67e7b-0597-481d-8f31-efe0f12a8a75", "value": "T1F4F2F19CC5A1718ECFADA67E416F13914E89F4D0326F1BD86342CC41A66B926F58D0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495239, "uuid": "6ea9c822-5aa3-48f5-af4f-a736789554aa", "value": "768:zcic7wjLhoSV9/h/xSB6emZdTul/d0FR1lwLp+P1We:Iqe+9pkEZdqzM3lwLpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495239, "uuid": "84977344-152b-485b-aec0-8dec59200441", "value": 37152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495239, "uuid": "82a7fcd9-590e-42c6-9861-8bf261b573bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495239, "uuid": "d2698a67-d500-4243-97d5-ca332414987a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb480ff-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491494, "uuid": "8e532129-215b-49f8-8258-38315fdf5735", "comment": "Malware payload (Mirai)", "value": "f75d8f03ab09f8223357dc030a1473f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491494, "uuid": "81815f4a-57bd-4ec1-9c55-3d3c852ca302", "comment": "Malware payload (Mirai)", "value": "0306acca3dae335a4cdb7f9ce31e5c570efb11f322c314f9a4f2d152c38d5972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491494, "uuid": "6ab309c4-5834-4955-b837-8238f6c1e387", "comment": "Malware payload (Mirai)", "value": "c0b901206fb747614163a27edb7704553a9d92fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491494, "uuid": "576d1caa-6931-4168-a646-488b4a3d9319", "comment": "Malware payload (Mirai)", "value": "2798dce371e3873c50155cc392ad95426f0a0db4d5d72eff53c0be71729bcc2d75de23ccb012f518034ddf3c892ed63b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc", "colour": "#812D4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491494, "uuid": "c0af80a4-ff58-4d29-8190-4e7127ed7450", "value": "T125054946FB1C4963C9531DF0193F47D9F3253A4340F5922A270F6B572622E3AAAD738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491494, "uuid": "9dae7004-8f50-44a7-a108-44e15d31826c", "value": "24576:wdVw5Ng1vTVxNBY+93uVGjGIoP3y08j2lc:wdVQNg1vTVxNBXuoGt3V8j2lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491494, "uuid": "ba9af395-b09d-45d3-a46d-5a6c18e8a24d", "value": 858480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491494, "uuid": "0ea4ee9d-d4d4-4edb-ab97-9490e1689d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491494, "uuid": "0f0cdd26-6a77-4789-b95c-e457eec69339", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0826d1ca-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773493768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493768, "uuid": "f5ddd388-a52b-45a0-8548-5962042fb157", "comment": "Malware payload (ConnectWise)", "value": "6e2760e49fdc0583611879a81f6a6716", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493768, "uuid": "fb5e63da-b68c-43ca-9e0a-707e74cfdf27", "comment": "Malware payload (ConnectWise)", "value": "03ee3e6eb7772877eff5c7d26629a6c79a5b03647ac77d5ade067cbbc27932d4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493768, "uuid": "2935dfbb-fba4-42c7-8382-d20fa662dff5", "comment": "Malware payload (ConnectWise)", "value": "8570c5073832a7edf0f96f6c7351991e9a3da8d7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493768, "uuid": "b59cbbaa-3061-4512-829e-052d6afa9287", "comment": "Malware payload (ConnectWise)", "value": "69a5ed860fe2032364fff769448a242820cec83c2f9b62193d61f3b6870f366c825d5279981cf5a92ad8dc8fda7eee87", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493768, "uuid": "92b31634-bb16-4249-84bd-e5aa485c4019", "value": "T165D623226AFD8599F8F39F34F97A99A5853AFC248D62C01F1319780E1972B418673373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493768, "uuid": "ff34ee5c-f9b1-44c4-bb75-d4513d17256e", "value": "393216:FcVPOsdNcVPOZcVPONcVPOocVPO/cVPOUcVPOc:FcVmsdNcVmZcVmNcVmocVm/cVmUcVmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493768, "uuid": "32dd5f2e-01a7-4aae-a4d0-6ce52c1b49f2", "value": 13488128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493768, "uuid": "b3dbf53e-2be0-4f0b-b387-70cad246d827", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493768, "uuid": "5f374b95-f62a-40c6-9fa0-b2a6b48a0c78", "value": "bill.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ce66cb-1fc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773508400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508400, "uuid": "b55379e2-d81a-47da-9c53-95efee4f5f2d", "comment": "Malware payload (ACRStealer)", "value": "0422bdef5bb1510f935219ad80f38ec3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508400, "uuid": "22ac2a2b-c547-44fb-824a-8a751225afa7", "comment": "Malware payload (ACRStealer)", "value": "04c1b31dd4a4597d6059cba41618a126e0f1c9ea8691bc811d70bafb61326155", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508400, "uuid": "260884ab-21ce-4d20-bdec-a4636a91b2d7", "comment": "Malware payload (ACRStealer)", "value": "1009a6e0645f5ed5bd5b9eac5d3142b027031416", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508400, "uuid": "92ac4e85-16a1-4a2a-9531-ce36c42e085a", "comment": "Malware payload (ACRStealer)", "value": "92ca56c046091cb83e5cf6ab9cb8ade84e250478dd9a497ab7bec65a5e6f481d6d5b357c2c04faebd6c8570a8a148b2f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508400, "uuid": "d1d9f2d8-520c-4daf-a855-0ca5ad8bc8a5", "value": "T1E8B529C65A930DF6FF1F4B368117A71FA739906D2F22C9E742A07D66A9336D20039C49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508400, "uuid": "6f765bca-f9cc-49a2-98d2-0997b4dddf83", "value": "ba8c5c001c5ae739570e104395c9f68b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508400, "uuid": "4735d636-d232-4d11-8e1c-37aa9c08260f", "value": "24576:86hUYTu66ZD9kwYd6hWKX0mR2o1yV3NSqCt37GWpSL24H7B9JxsNnxYjvKA2rSYn:o1siBFLyiXLESDQrGVkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508400, "uuid": "bc7678a5-ff5a-4c72-ba75-14370003ddca", "value": 2399232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508400, "uuid": "7ed3d5ff-7d79-4442-b988-c0ef2f067e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508400, "uuid": "3af18402-f42f-440b-9a6a-b8348c0ecb2a", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a74cc38-1f56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773459197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459197, "uuid": "262640f7-6e3e-4385-92c2-a45f8384be0d", "comment": "Malware payload", "value": "34deee0d6adb320910d583325e844342", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459197, "uuid": "7bac9e62-8cf7-4108-accb-cfd125f27c10", "comment": "Malware payload", "value": "07adbfa4138c9afc8a974c815eeb17f3d6ef9479881bdbbcba4439d26d96bfd0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459197, "uuid": "543ae86f-f593-4c1e-9808-3b028df97cb5", "comment": "Malware payload", "value": "1ed2247acba73befb7d124a6df88d73be0593345", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459197, "uuid": "25742eb9-594a-4bc2-b449-f720ba72dd50", "comment": "Malware payload", "value": "bb5cc362b4964d195abe1de0d8a97e13131f56cdeb0de91bf95d798eda580c1580931d7e5660ac35182e413fc5ffb73d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459197, "uuid": "214c6ab8-d759-4570-9c9a-04376b68a820", "value": "T117925CB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459197, "uuid": "67b1ba23-e8a8-4bac-b934-4e17dcaa1542", "value": "384:sFcuQpWx+BL0SWL0g4zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:sF8i+BL0SI0/zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773459197, "uuid": "37398f2e-8fa1-4a69-a946-34196583fe1e", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773459197, "uuid": "9dacffd9-a11c-43b0-9024-b60720b6d539", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459197, "uuid": "3451e5b7-c65a-4a19-a3ce-6476dbd79e58", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de4fd8e-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493965, "uuid": "49ab46d2-b50e-433d-9370-d022d11ae995", "comment": "Malware payload (Mirai)", "value": "9eee0828887c1d7c4600cff41543c4cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493965, "uuid": "2293af72-0a20-4a3e-8415-70babec89e0e", "comment": "Malware payload (Mirai)", "value": "0a74a5e87e3af518101a52c88eab5ab362afaa74bc3020e3969bdcab81ae8a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493965, "uuid": "0e89b35c-be49-4e7b-8913-236473b70294", "comment": "Malware payload (Mirai)", "value": "258b190a52d4504522f5fc3b51de778a6a2e1925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493965, "uuid": "599ddbc9-7609-4e2d-8b44-443dd9ba4a10", "comment": "Malware payload (Mirai)", "value": "d500448cdb68fba4c5b3c2d7899ad9a8212025f4b490d30af8648641ad29ac9f9a067ccd2aafb2fef4288e4ead4accbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493965, "uuid": "985af3e1-7a98-4abd-997c-6d4c16855f85", "value": "T17EF33B46F6408A13C0D6177AB6EF42453323AB6493DB73059928AFF43F8779E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493965, "uuid": "aec04021-d68c-48eb-bb0c-740b1874fe43", "value": "3072:SbzuIA9vKpSaKJS4BHqmUoq1+7pTyVINSLZJiM/9b5J:SbzuOSaKJS4BHqbob7ZyCSLZQM/9lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493965, "uuid": "e16f5cec-75f9-42da-9c62-6e34cad491b3", "value": 160442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493965, "uuid": "e2d67860-8879-437b-bc8e-f71134f6eca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493965, "uuid": "5cce22bd-c79c-4a83-8eb8-ce158d041e5d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b8abd7-1f78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773473686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473686, "uuid": "f06a6a5c-1545-4560-a02a-a579a4182766", "comment": "Malware payload (Mirai)", "value": "f7a5c4491bdafb2c7f23a7dcadaba33e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473686, "uuid": "a854f197-9e53-47b5-b554-5e3e8c3f8220", "comment": "Malware payload (Mirai)", "value": "0ab70183d671b0a054def272c335ee93306e11573e346c59419656f54726aaa1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473686, "uuid": "7ca8b81d-7b46-4b53-8c6e-08b7f3594add", "comment": "Malware payload (Mirai)", "value": "f618a6e7710d06b0f483a2ce5c17ef358686520e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473686, "uuid": "1fa5e111-a96a-4308-a8f9-6f3f2a360e76", "comment": "Malware payload (Mirai)", "value": "c086d08eabf33ccc043ce6ba00b11beef53e6a4055b5b8c68aa2485df33909c9f9324bbfa95164fff34542fe593562d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473686, "uuid": "4c829a1a-862e-46de-968c-ab1917c7f7f5", "value": "T1951133D4C930A4374C86C60BB561E29659DCD3E599F4C2285BA4CD371192F3E7C9E943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473686, "uuid": "b726bf1c-285a-4466-967e-6253c8ea2a69", "value": "24:mo3h8Lzpxsqpqfe3Q43L2K3b2y3XDj34JU3NIsrt00/BaNYK20:mGeLzXb17xnPI+75sYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773473686, "uuid": "cc4f4e25-028a-429d-855a-4348f723e7ef", "value": 1106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773473686, "uuid": "4fcb9ded-b5f8-4077-9eb5-680bee672e30", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473686, "uuid": "5fd4938d-f83d-4d7c-a0eb-aa9faf226921", "value": "sshbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689007d5-1f7f-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773476750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476750, "uuid": "e6dde166-1086-42a5-8852-4392ba98ce9b", "comment": "Malware payload (CountLoader)", "value": "ad519f17b6fbe77d24193b1705014ae6", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476750, "uuid": "591d251e-028c-469a-b9ee-7e3e5b93efda", "comment": "Malware payload (CountLoader)", "value": "0ad8b2ced46d903fa2de3fc8378aca3c332455cf2db0d9f2178a31d94f7292e5", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476750, "uuid": "7baf477e-f253-40a4-bd63-54983db6e5c2", "comment": "Malware payload (CountLoader)", "value": "e973200261def9f27757b6a7b5931f3b811ca599", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476750, "uuid": "26f64488-2b69-4a2a-bc5b-7389f03e13f0", "comment": "Malware payload (CountLoader)", "value": "717badb2a5842d26f0f7a7c3e002b1520f039372728239ed2f25c9d680b66fef7ac3bfebb83e1c555613f1bf7c921bfa", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476750, "uuid": "86e55c9d-745d-42c9-b2ed-0f0a876a0773", "value": "T105C3EE2C40BF34B11D821A7496FB12AFEF7864524AA88180777DEA703F26BD1E1F52D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476750, "uuid": "9d817300-e584-4096-b2b4-774fdbeb2389", "value": "1536:Simx8klphaWDxELToqYJzYpTT6vD16N6zX5/kcZCz0VFS8P9mirCYw4RgkR0h+6U:7zGbPVCYw4Rgkt6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773476750, "uuid": "2f591f73-85f5-4ec5-916d-2fc384b1e3b8", "value": 121801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773476750, "uuid": "f9a4e81d-f018-4888-a332-cb134496954e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476750, "uuid": "0565fd81-6c3f-4853-896f-144f59d6ee7f", "value": "Core_Data_Europe_6231.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7e6bcd-1fba-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1773502100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502100, "uuid": "271714d4-ee6e-4255-9d25-53e0fa1806ff", "comment": "Malware payload (Smoke Loader)", "value": "26146d16a344dae3921bad3c9a2b496f", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502100, "uuid": "44e15615-4da9-4e24-8214-faf325137f1a", "comment": "Malware payload (Smoke Loader)", "value": "0b4e6676ffd58bd45aa24c3e5bf3a10e2cdb8fccfc24f53f0ed7ee35f8412be9", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502100, "uuid": "8b7fe4f6-d450-407d-bf55-829fb05d2d3e", "comment": "Malware payload (Smoke Loader)", "value": "339c5efbcb52e4f5c69691acd816a06e8c772e6d", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502100, "uuid": "0f0cdc4d-8de5-40c3-b175-5db9157ee62b", "comment": "Malware payload (Smoke Loader)", "value": "ecd0f35c1b58d9bfe8361aca0ee665f84334db2f11ec3b351776a139ae4529571e66dc769b9ee352d52e4ee0e5eb1570", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "coox-live", "colour": "#1A79DD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502100, "uuid": "7fde6cd0-6395-404e-997d-fdf66a390da7", "value": "T15D96AE07BAD840B5D0BB9235897B5266EA75BC100B3193CF2650BB7D2F73BD05A39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502100, "uuid": "124dbbab-b91d-4d0e-8135-6f233dc9b4cb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502100, "uuid": "5b72d69e-23cd-447a-b001-97a00120647d", "value": "98304:fS3TuJDdLSJRGryZEoxvtTrJEqdyrR3f3Ac4du8kK8ZnAa:f7DpGFZEAt+qdyr9/LWu1Kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502100, "uuid": "36abd926-b3df-4a8e-af5f-2600e9d47277", "value": 9121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502100, "uuid": "2a4c470e-0ff1-42ff-86c0-40a11e57bd13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502100, "uuid": "f90a8545-c067-4385-b68b-92fa3123f612", "value": "downloadlink_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecad6851-1fbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503600, "uuid": "2d4b49b9-6da3-42a1-8796-1ceff0b4449e", "comment": "Malware payload", "value": "40168a81cfbb1f962288abeaffbc09a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503600, "uuid": "619739fa-e6af-4084-909f-2d261abca051", "comment": "Malware payload", "value": "0b58768188905ac18c6bc348ac0467d254cf64ef2370c00e8b9914ab1dabda90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503600, "uuid": "910f1c43-faf7-49bb-89e5-0610198b4925", "comment": "Malware payload", "value": "82fad79febf46fb9aeebe3b07280453f9558884d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503600, "uuid": "6d160396-e1f6-4b20-830a-0c521d9f24fc", "comment": "Malware payload", "value": "dc8cae3b2643db6107e03b66f3d94eaaca12fb8908da00d85d819bed1884cfa8611d29e4ede34590ee5f0d90ff638ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503600, "uuid": "e186fe42-5465-4221-acf7-72065bcee774", "value": "T192F633FD05888703C131A4F2746752AA4A7ED7196F4611EAB9CE8F5E3E0E474907F0BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503600, "uuid": "2bbb7c28-81a6-43e0-9a79-fae42b561bb6", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503600, "uuid": "435556c5-968b-4107-9fd2-3ea79fb1666f", "value": "393216:A1C3ao81X4CdKZNxhs2ZS20bGy/atN3SylxVte8FyuragitGBw:A1CKo8ndKZ5fVCrEN3Ssjt9yuWg4Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503600, "uuid": "ed4a5e3f-5474-41f5-8a7a-d2c44f665ccb", "value": 16009736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503600, "uuid": "4b946eb4-76c5-4547-a7c9-e4efea4333a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503600, "uuid": "053f5b06-e7fb-4bdf-80ee-fc58c445c28d", "value": "40168a81cfbb1f962288abeaffbc09a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1eec553-1f85-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1773479503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479503, "uuid": "58a770ae-6e02-4296-ab52-c282d73143ce", "comment": "Malware payload (DonutLoader)", "value": "3956eb4b92fa21e3b84b6b550b37e617", "object_relation": "md5", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479503, "uuid": "eaae8d61-2a35-4442-9e09-819741603047", "comment": "Malware payload (DonutLoader)", "value": "0b5bd30ea29b406e28f752fab6a6053be185c4451eda28b143e57aaf7efb82af", "object_relation": "sha256", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479503, "uuid": "58c21692-92b3-4673-86e3-805c800b52ee", "comment": "Malware payload (DonutLoader)", "value": "2bfb8ef5ca448736cb81e074a930171e9827cafd", "object_relation": "sha1", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479503, "uuid": "de0dfb35-1c2b-4c41-8b04-07073d5c60ff", "comment": "Malware payload (DonutLoader)", "value": "514ad933acdeb08557c1b02136984096b15ba15ffea308097d08a80dee4aefc98db2e8494b6847ba7d0486185f8f8a6a", "object_relation": "sha3-384", "Tag": [ { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479503, "uuid": "6d3b5ab0-b094-4bcf-a914-bcafb52a8aed", "value": "T191730190D79200E6ED942571747A8B1E6F9DCB9BC0829FD3B3882EA06712CF5F6542DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479503, "uuid": "48c2b1f3-56aa-4fc1-8cbf-e7ed7ad20f75", "value": "1536:ORdbcYH31I+aReN7vAHwuR3ZqRTOwuBANeE6ZcU4J2fuy9ejY6yFOB:Oj7lI+aRePuR3ZAOwGm6qtJez6yFOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479503, "uuid": "04066e97-f278-4bed-a808-141c632db54e", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479503, "uuid": "35a85206-2f85-429b-98f8-8930e572b875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479503, "uuid": "42530247-b925-4068-b641-4ba31c5bb642", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef994738-1f64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773465380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465380, "uuid": "8097dc63-f795-4229-a5f0-068f0bb888b5", "comment": "Malware payload", "value": "057a4d214929df3aad6b5ce79f3e4cd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465380, "uuid": "15814fbe-9a5e-4ffd-a007-9af51c7c95b5", "comment": "Malware payload", "value": "0b6568e67e4545d2ed31b91a09fd8768d8241321c13f9acc06f38ff1a3f91f53", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465380, "uuid": "ff45f07c-31a1-4814-9848-335de97c3ae7", "comment": "Malware payload", "value": "f7bf11df5958568d813d00ff56817672e6c190ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465380, "uuid": "c1a0834e-92f7-4b8b-ae5a-6eed00e324fe", "comment": "Malware payload", "value": "fd7fddee87770a12c265e9b5338625605dfd20ae11fecd77c248b9c30d8f2e4cb0176bc0b59a2ebaa310fbfc39775406", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773465380, "uuid": "694cefaf-b15e-4967-aec5-2a5d22ba5fcf", "value": "T1FB925CB916496C79BBC0DE7D9F3C7F0CADE481C02219A39CBA4F39714A2069DDA0635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773465380, "uuid": "76dd6a29-5667-442b-b025-f84819f61f58", "value": "384:6GO0M3vgRjGlsaq73zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:6GMmjfjzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773465380, "uuid": "c543f072-2d80-44ef-a208-041d51b2046c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773465380, "uuid": "89f6462d-a989-4c90-8e4a-fd74d6de15c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773465380, "uuid": "010d8564-8c30-4b6f-a9cc-7873ec2ef57a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b775865b-1f55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773458843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773458843, "uuid": "bce03bf2-4841-4f36-bf5d-1ad833d30bff", "comment": "Malware payload (Mirai)", "value": "771b1161823e11f6caaabf41f7b56b2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773458843, "uuid": "729b586a-5f62-4d4e-b8f6-99bf2c1b5247", "comment": "Malware payload (Mirai)", "value": "0b9bbcbec8752387ef430c1543a45b788c1bd924977ecef0086b213f6dbce30d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773458843, "uuid": "cbcfc2d1-3635-472d-b7a8-e5f03dc97ec9", "comment": "Malware payload (Mirai)", "value": "9b7c8b3d7acaa6f0d5afc47e7db6c923f802a49d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773458843, "uuid": "d4e81e3e-7514-49e5-9987-f2b2a43b627b", "comment": "Malware payload (Mirai)", "value": "05aa936d1359f8d79cb058cd964ccc28d9e47f0888b232e9f7bfba8f20af2f6ba9ea8ed34673bb51fc5c5c3b116cc41c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773458843, "uuid": "c92a8635-4958-46b7-bea7-07d9088ab905", "value": "T19AB3B409BF651EF7EC6FDD370AE91706248C651A22A83B797934D818F24B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773458843, "uuid": "979940f0-bd47-4097-81e9-44d87e8af055", "value": "1536:VIOVf0UoDCKCkR2s+E9KeQhIkjIQ8luZ5a62SQWc0dSv/AB85kqi7ypxZq:pVf0UoDHjR2s7vEIkt1QWa/p5i7yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773458843, "uuid": "4012e343-cbce-4dc1-adfd-01998e1aa3cf", "value": 117664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773458843, "uuid": "2f622a66-6a39-410e-bbe5-6472126956f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773458843, "uuid": "64690b01-21c0-42a4-befa-38ad62561ff3", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa4304b-1f41-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1773450347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773450347, "uuid": "d6340e7e-ae90-4f17-be9c-a07770be4bf2", "comment": "Malware payload (DeerStealer)", "value": "ec7641e10208558fc17ba4d6d990f94e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773450347, "uuid": "dc2274f4-f990-4151-9741-dcc72638544f", "comment": "Malware payload (DeerStealer)", "value": "0bc2a9d8c2aa8639da0aa5389c773f368dcf1cefbc66996c2736532afec08c04", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773450347, "uuid": "c5f500b2-7685-4cd4-b57f-6071ce51c3d2", "comment": "Malware payload (DeerStealer)", "value": "2038c537e9c5045844ea5ae4c7e9513937f882e6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773450347, "uuid": "664fd07c-e122-4818-8b2d-1e7224f47e60", "comment": "Malware payload (DeerStealer)", "value": "a13a7e9d8c085fa82fcff8858fb9f6050856c707426cbb9640f7073203f2664dbd75a87507fa2a3ef8d6f49a19f1a534", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773450347, "uuid": "df5f1fda-e3b7-4c22-a531-748001369c73", "value": "T1E3B56B2B55A9609AE3E7C07CE5165762FC3176480E39A3B725B683923730A1C9B7C373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773450347, "uuid": "a8ef67bf-c319-4589-a777-ccd5b106e83e", "value": "bfd0d23c7fca92db5c97355ca9870e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773450347, "uuid": "b72ab627-34c8-49cb-8fc8-ceec7d4f991d", "value": "49152:4oQMUP1MoL00rGnhsiG7qXxUdYCLLrKJSTaMmRaO2yuNiOniOjzUO4P3q5STI9HG:WkhsVK4HmRmmkSTUKmaUJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773450347, "uuid": "1052b6c9-0ede-403c-9f9b-350af1cbaf42", "value": 2494092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773450347, "uuid": "df7c8049-473b-4548-8bc2-23039a8c76cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773450347, "uuid": "4f5c19e8-eea1-46d5-87dc-6691dda7a372", "value": "stage5_final_payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0977394b-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773514815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514815, "uuid": "9a9dab8e-5f14-4380-9709-93c17dc3e726", "comment": "Malware payload (Formbook)", "value": "c1b0ab5e324a4cc26c27a71052518f4d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514815, "uuid": "8fba929a-4c71-41a9-9f0f-b1efef64245f", "comment": "Malware payload (Formbook)", "value": "0c7d1ea42048170f7deeb59ccc1da5f8165c4a5594d2592e193c29d08ec527a1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514815, "uuid": "31497704-1b10-42e1-906e-610f72b372b0", "comment": "Malware payload (Formbook)", "value": "5a7ac3e67dc85c167180704917995fabfeb22fc0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514815, "uuid": "84da035e-ced3-46d5-a1e1-eb7a41ca4e97", "comment": "Malware payload (Formbook)", "value": "9ecf2f8164e8980169a710a31173af226575b4b6b0ac6a2f5b20f7589e181962b76de057c9c4a5ffaf27294f5b4da120", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514815, "uuid": "b878214a-b21c-4f95-b68a-4005521ed614", "value": "T185530C5D1D2DE30606C97953B8D7A58E4C3ACD9682002FA9127964AFF0BC72BB0165FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514815, "uuid": "21e9434d-40d0-48b5-b2d2-564eac05fe8a", "value": "384:ZDKTQvZqXR1ge9xSB2HsbhN/0eNebQ/QipNnnRgSJKLrICfkcxcwdzXA5UbkUtZn:ad9QHmXqMoz/D+U98GIRthI2MVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514815, "uuid": "4a9e00fc-9e46-4e2c-8e54-e7c3229a693b", "value": 61678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514815, "uuid": "4e531a5b-82bf-4e53-8e8c-5dfb184fa68f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514815, "uuid": "ccd2e98d-5125-4f5d-bb9d-2a3d9d897453", "value": "c1b0ab5e324a4cc26c27a71052518f4d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af9fe34-1f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773473693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473693, "uuid": "e1d4b6f4-3c8b-4ef8-b70d-c613e198f8a4", "comment": "Malware payload", "value": "53a00708025b192567c4ac2a28851686", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473693, "uuid": "be653ad8-bd52-4ec3-9444-fb2258f99841", "comment": "Malware payload", "value": "0c889251c703623c3397893515aae9624f45c609fcf5881ace4b2e0a1857a88f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473693, "uuid": "f3190ffb-bfb3-40d9-897a-ac2b910b6e8c", "comment": "Malware payload", "value": "f36954f155d91423022d940701f59d948d0df2cb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473693, "uuid": "0731bcc3-8726-45a3-ba0f-7f7ddbcd4e76", "comment": "Malware payload", "value": "c1f939cdafa8b22fa3515db354b8c3563b66ba5ed82bba2c95d7d72a5c4da1c5ef29809513024b9ed5b1526271a02143", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473693, "uuid": "21864f1a-52c9-4c84-9b22-a2d34ce59c7c", "value": "T1C5A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473693, "uuid": "1aab968c-0c43-402f-92b8-b81881ea9e0b", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773473693, "uuid": "16455d91-dd50-4f5c-9ab6-7071b46f3001", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773473693, "uuid": "a5c7c4cc-4734-430a-93b8-ec2f56383133", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473693, "uuid": "c70bf685-97df-4183-bbaa-038cb403ed88", "value": "0c889251c703623c3397893515aae9624f45c609fcf5881ace4b2e0a1857a88f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bbbbf3-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504286, "uuid": "25581eb1-d975-4f38-ae8b-4423af064f09", "comment": "Malware payload (Mirai)", "value": "5ed3eea6220786f9b1d31addb5d8ee02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504286, "uuid": "699ac563-55f5-4183-8fa7-72f1bf0e2d64", "comment": "Malware payload (Mirai)", "value": "0ca5267f3d12b849c41c230b04b244d20f1002995aaa625ce1ada5dcbb12a227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504286, "uuid": "883ba045-1bc1-49cd-85db-46a07e623a43", "comment": "Malware payload (Mirai)", "value": "5a5eba616d53d44d130e80d80c37f08f8856ba94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504286, "uuid": "033b31fb-3068-4132-bda4-32977180656d", "comment": "Malware payload (Mirai)", "value": "3ac0e3e5b933ab89bed6998e960368a0bea60a736c6a75871e3b7af4e09bf115faebbf745d395386538137d16dae4200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504286, "uuid": "1adba7a5-e6db-4054-8e79-8da84bcd3b2d", "value": "T1A5233AAAF801E97DF80FE73B4497490AB530E3D5068216363367B977BC722950923F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504286, "uuid": "85cc2ce7-12ab-459a-9c1a-176b4cbde893", "value": "768:+zoMUO9YMPdmX+gKHF5m/CpaH8kBOfdnB2jHaZghbL3jExhnKRwGESIq:+bxJvbre8SsnB2zaZg1L3jExhKbESt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504286, "uuid": "6b8dd0e8-383a-4163-9ec6-5359801f8a57", "value": 48060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504286, "uuid": "b7ee7675-e519-4e03-87f8-1288bdd7159f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504286, "uuid": "d74cccd4-b459-4e31-b9d7-1cc65b3a2059", "value": "wlan.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ed16c8-1ff7-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1773528307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773528307, "uuid": "4c3a04f3-7a23-4c3f-9d5e-20513552f5a8", "comment": "Malware payload (NanoCore)", "value": "03d284b954a876fda61c64a176f1e8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773528307, "uuid": "955a0aa9-791a-472c-b061-91817de4a7f4", "comment": "Malware payload (NanoCore)", "value": "0caacc324e93026344068c2d7ea168c5b87b58640e98cb1f657230a8436d9765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773528307, "uuid": "86a6f2b0-9cd2-40c5-b5c5-c80248f8534b", "comment": "Malware payload (NanoCore)", "value": "0b9a3cb4736c9f10e240fd8927d55ef353bd0cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773528307, "uuid": "91429b5e-071d-42cd-b730-8dfd95fa18a3", "comment": "Malware payload (NanoCore)", "value": "d2d995672d8e20b7ff40bc51b55892aaeeb6cf4bc90696798c5c0b73542090c2c118555db365adbc7486ce7698e9aa6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773528307, "uuid": "3d7ff23d-e219-40ea-9b18-9ffd5f4d1f9a", "value": "T18814CF167BA8892FE2CE86B9712211068779C2E399C3F3EE28D855B75F163E046071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773528307, "uuid": "5af7874e-884c-4564-9fa4-66f4c6976347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773528307, "uuid": "382449c7-571e-4a3b-a634-e3c45e5421de", "value": "6144:MLV6Bta6dtJmakIM5chPXJM+YjP3V659eb:MLV6BtpmkphFKFm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773528307, "uuid": "25277b2d-cbc2-46a2-9282-5c5f3aef37ce", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773528307, "uuid": "3bbb82f8-1b00-46a6-8554-4a9201dacd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773528307, "uuid": "e64fc720-71a5-4a4d-9c64-4a7f69ec2a25", "value": "03d284b954a876fda61c64a176f1e8b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea39092-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773515576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515576, "uuid": "ad5efca7-4f7a-4467-b3aa-aae3069abb4d", "comment": "Malware payload (Formbook)", "value": "7f179a0a2109d2caf77fb9e8a7fbae85", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515576, "uuid": "0f13043f-647a-4f2a-8872-71b9fcab2842", "comment": "Malware payload (Formbook)", "value": "0dae895daddf392b9e1998048fb4454f944b4d2fe557e1a05b30b643cad91240", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515576, "uuid": "a455166a-3fd5-4a31-8329-65b0dcd214bf", "comment": "Malware payload (Formbook)", "value": "399f008d762a6ee66c6918c54ebfca70513ed5a7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515576, "uuid": "7ec89057-1d51-4896-babb-362d321d5dcd", "comment": "Malware payload (Formbook)", "value": "cda6bcf40de237061c48932e0abac8197f6f235b050fe61defb25c0f1a7bbf954e23fcee741e8eb4742d4228ba6afc28", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515576, "uuid": "ea642127-82b8-41ed-9875-52359f4999a1", "value": "T182958E045EE12B260A45DE2EB5FD13DE58829F93DC86ADEDF6203D41DB9D081633B0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515576, "uuid": "0c17f58e-0d6b-437b-ae6d-5972684c90b6", "value": "49152:syX8ZdFVzy/y+x4tE0cbNYRk8J3UXukoIccpfEA:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515576, "uuid": "0d5221cd-edd4-4f53-bfe3-47f4461443dd", "value": 1991230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515576, "uuid": "fe474193-87b4-47a1-95b6-2a6e3b2bc44f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515576, "uuid": "3f2d0dfb-4f00-406a-a80f-147075306937", "value": "7f179a0a2109d2caf77fb9e8a7fbae85.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0877a53d-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486467, "uuid": "a67ee181-be62-450a-a02e-0f093f41377d", "comment": "Malware payload", "value": "4ee54553fc3c8c33c67f87b22b21361d", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486467, "uuid": "36c996d9-47c3-4a61-ab36-f2f2d46a6c3c", "comment": "Malware payload", "value": "0e6435796b08bc39da544326055f6123036ef5bd3b5ffde914ec7f54e86facc9", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486467, "uuid": "100e2711-dad0-484c-a55d-1dd8b0152851", "comment": "Malware payload", "value": "98eb0fd50742137053f857567bd6a5383c5f142f", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486467, "uuid": "392c5a66-f299-4b43-897a-f522c3c65d39", "comment": "Malware payload", "value": "60ff961518e10168beba12f2c6a0771d58fe466b2843e43413ded9077a0d127bc2db53a2e603282954d40268475702e8", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486467, "uuid": "21543146-6f6c-4fce-9fae-277654477638", "value": "T154F0A339DE74FCC4433EF15084313D1920D5CE13F37ADEE8A2310CA66D29650AF09658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486467, "uuid": "54ebbe55-db23-4b7d-aae5-76009198fb67", "value": "6:s8bloOVsukO6hWpUV97nOtdzMkqCchckk5t0h++XPHZkTkM7hTalYWs6qa+sXkS8:s8hZGrO6hVV97nWcPmP0RihqYvLAk1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486467, "uuid": "2ebfa7aa-bc6e-4bc9-af36-1ddc7925b632", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486467, "uuid": "117e0703-c14c-48eb-ab4a-9fa49537d351", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486467, "uuid": "938d9cab-81a1-4b90-9c1c-a5dd51c83664", "value": "14ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df16bcd4-1fbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773502718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502718, "uuid": "b17f400a-66e1-490f-adf2-f5607a8b453c", "comment": "Malware payload (Vidar)", "value": "ad14d6c79b4f7bc9acbf98a37c3ffa31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502718, "uuid": "7d9d5100-f245-46ae-bb40-083778059e0b", "comment": "Malware payload (Vidar)", "value": "0e73b91689884625d8742b3e77b40c4ff7ae796c9c75966ba7d5c1180145ea72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502718, "uuid": "3ec2d9d4-8591-4b56-86ca-ee268928c75f", "comment": "Malware payload (Vidar)", "value": "3555926f3c00ccf6e085dc59119269f3decc37cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502718, "uuid": "d7cfc799-3cb9-4810-89ee-29c2e65abff5", "comment": "Malware payload (Vidar)", "value": "187ccb0549a7ecdd9c3e58487d9ac780c7c6eb80ae9c58286fb8106ca6fd024e78178795ef41ab3e509fb7ad368a67d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502718, "uuid": "b77cad1c-52a2-407f-b468-6f90e6800677", "value": "T1F1B57C0BBCA558F6C46E977289B366923B31BC590B3223D31E907A7C2E72BD06D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502718, "uuid": "5e717619-264a-4a3f-83af-9d042a102369", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502718, "uuid": "15cf5934-77bb-4bc4-9cc3-59997026a8fc", "value": "49152:t2HeV1sVgI85Ksdfm22yqBbWV5yY7Lxa:t2+/W1Qf1qBaC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502718, "uuid": "09b12978-9725-4265-aab1-53a959b590b3", "value": 2358272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502718, "uuid": "dfafe38f-fba9-4abf-8310-afcd5063e7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502718, "uuid": "0c933f2a-1999-4fbb-86e2-a20c7f3c0f22", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24667eb2-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486514, "uuid": "82fcdf37-8593-4806-93b6-d9c905a9e2fb", "comment": "Malware payload", "value": "e757997526972cf7225f01d61fc47e48", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486514, "uuid": "f6dbaf02-9c3c-404f-b03c-8ab9dcdaae10", "comment": "Malware payload", "value": "0ea90289d4e2cb966134a76770026fc319416f9b9653f8e383727ca7e3b62a23", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486514, "uuid": "ecc15210-dced-4340-82e0-bd643d50843d", "comment": "Malware payload", "value": "d26966fe41f35ebfe2c1627970c0749f6cc67e73", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486514, "uuid": "10632ac4-ee1a-4221-a45c-79a32bccdb28", "comment": "Malware payload", "value": "b808401b23b8c19f28edfe8bcc8af5e6cbaa751eb5e83580951e82d7ed4391fdd86a5f35460db5ba808f12b187a38d4b", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486514, "uuid": "2a4b6a76-c120-4072-ae39-29a47dad1f81", "value": "T1EAE05C35EE74E8C0433EB11084253D6920909E63F77D5FD9D3610C656D25A61DF0556C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486514, "uuid": "2236dc2e-bb10-4954-91a9-9cbf3baa66d3", "value": "6:s8bloOVsukO6hpYYnjUMunMkqCc4k6ckk5t0h++XPHZkTkM7hTalYWs6qa+sXkS8:s8hZGrO6hp3ojncPjP0RihqYvLAk1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486514, "uuid": "a62a1e52-4981-4145-ad7e-596ea53d5e31", "value": 433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486514, "uuid": "041345c4-499c-4c63-8e6c-a4cc62ab26ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486514, "uuid": "e2cfd90f-b4f6-4446-a5da-afc854041823", "value": "8ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c9850b-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477450, "uuid": "226f7437-31b9-49e0-be95-0e53b6586366", "comment": "Malware payload", "value": "3466c3eaeb0c426de5afbc8176bc7f3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477450, "uuid": "93864450-3491-4995-9351-19ffed3da13f", "comment": "Malware payload", "value": "0ed1b127a19c6ddf304bdb75707ae45c06cb4c994456c6c665ceb360d80bf1d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477450, "uuid": "3f8237b0-e95f-4cc5-ad22-189466a71dd8", "comment": "Malware payload", "value": "d24d0c543f5c3e1d7630ec40642a1f146873118b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477450, "uuid": "c89e3565-ef7e-4823-a3f6-a5224a3ea975", "comment": "Malware payload", "value": "3d36d64a35081453d16e1d3e4111a0442aa72bb84cdb8ef276db66811d445a4ec8b5bcdf00b38606e27ead5372c8c142", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477450, "uuid": "28d9b258-5808-466e-a19c-90c6bd326ad2", "value": "T16D365B98BC1DB522EAC97AB42B6541D47335FC48AF4183237514FBADAAF2354CF22760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477450, "uuid": "def184ca-1600-44d1-a6cc-cde89a97b2f9", "value": "49152:AfcIWIvVnjtfVzlJwxg6uaiWt2J05ExxaUTqk:2cIVVjtfVzlJRWt2EExf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477450, "uuid": "8eca756b-ede2-4a80-b45f-6e8dcecad1cf", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477450, "uuid": "7ba391df-1e48-4419-9ff8-81b0c898d345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477450, "uuid": "54ced684-dd03-4376-8ceb-2563700cde2f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2179d34-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773491476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491476, "uuid": "7361976c-0b10-47be-856b-74d97cadd938", "comment": "Malware payload (DattoRMM)", "value": "39653d75a9f6f618558d6169cf0c4713", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491476, "uuid": "b576287e-0068-4e01-8ad9-583d23015901", "comment": "Malware payload (DattoRMM)", "value": "102f5610ec49ec1ef47510dd9b0fc6fa3e5f90bcdf3328db8f0398727e869ff4", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491476, "uuid": "427ba60f-e1ef-491f-a15f-91733b31f057", "comment": "Malware payload (DattoRMM)", "value": "9698d1ce388b9439c521f29d9afc145e7af2a35d", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491476, "uuid": "04110ced-fb1f-4328-b4a1-7011fbb80dd4", "comment": "Malware payload (DattoRMM)", "value": "eecd6bce0af0dd6df6253f68cde1217c528d0bfb2d1c96dbbc73954064c80e8ecfbcb894cdb2fd33aed2d74cf828b18b", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491476, "uuid": "08beb779-38c7-4bd1-9f9e-b00280305449", "value": "T16BB63347D9778DF0CA330B3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491476, "uuid": "d4cd9bbd-15ea-439a-b3ad-c4a2aa68d5fe", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491476, "uuid": "d2f5bb0e-3184-4cf0-bff3-d5a5f519e980", "value": "196608:3aZk+wbP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2V:vnqmzZFw5S9pE7Asjp29qIT0jarlZr8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491476, "uuid": "805e0112-40f6-4d3d-b5de-1050818e0715", "value": 11056056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491476, "uuid": "7f5a9565-31dd-4528-bb0c-e70ed04ccac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491476, "uuid": "28ebc4b4-5f67-4fc3-8487-dbef6a993f1a", "value": "SECURITY_DOCUMENT_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99e62ab-1fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501367, "uuid": "cef7b4fe-39ee-4e6b-b8e6-889f1d519757", "comment": "Malware payload", "value": "fb279c27eaabcd134a11401686aa7471", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501367, "uuid": "b482dc21-8319-4761-8a15-fe60eeca28c7", "comment": "Malware payload", "value": "1064eb53c9e61e83936685edea3084d59c57c112fba483dba8e52e17682960a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501367, "uuid": "b958ff4f-5236-47d0-a242-6742d75da48a", "comment": "Malware payload", "value": "3ca1eb4dc4af5d6076f9a0a24422efe42e122f40", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501367, "uuid": "d6e8b531-a44d-432b-ac71-493949c77a7d", "comment": "Malware payload", "value": "3aacb067346f4d5ed88c3e88099f84cf7b940c06cd131bc2c907f28f27919d5c6e901d173eb45ae4c71e4d585d5fb6e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501367, "uuid": "dd32043f-5b6a-4ccc-ac80-d121bcf735b1", "value": "T1B8925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA0F39205A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501367, "uuid": "aa180116-b1a7-4666-93ae-69454702584f", "value": "384:4FcuQpWx+BL0SWL0g8zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:4F8i+BL0SI0bzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501367, "uuid": "1beac57e-fe9d-4964-ae9e-c6d7eedfa140", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501367, "uuid": "32b2ebb4-b4b2-4bc3-b862-b7eb404d5b04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501367, "uuid": "6354f3fd-5e03-4b7d-9f19-6a537fd67274", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0093ba88-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773494184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494184, "uuid": "1dd4c011-4c26-455e-be9c-8dcfa547c177", "comment": "Malware payload", "value": "0f935c1205ac456eccc4aa3dfeefbaaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494184, "uuid": "bade3329-66e5-4ed8-97ed-410fb07d5c55", "comment": "Malware payload", "value": "1096d2e220ecce73a4e7f0cdc673c2ff4f5b399693b2db5fc5dd098813633f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494184, "uuid": "3564bdb0-df1e-4fe7-a025-88d1ff391afb", "comment": "Malware payload", "value": "55e9a66bcbf87ee44e0bde755020169712b919d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494184, "uuid": "1ca9ddc9-2d48-421f-983b-5d1264c7e3a9", "comment": "Malware payload", "value": "d8ad5516c336cc6e3cd477feb7b9c660b28574f77fa6a95ea41b13f4d7cf712d9b5a463d41170d5b06f406628137211c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494184, "uuid": "3757510d-d111-4bc2-9541-e89182ca95e0", "value": "T11AD3E0AA5C6844C8E997A5B0B4D1CF0279B36596CF24C4CF48C1A5C90F77382FB6E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494184, "uuid": "5300759b-455e-4093-a747-98bad30e3637", "value": "3ff7f3b391f8291257c83518cafe1759", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494184, "uuid": "27d776bb-3d4c-4ff2-a4f3-2521ab0dd362", "value": "3072:sMNE4Q/BJO/7H/AS9tQmcGRILwhIBC48tljr0rMBbqzJgETnU:71rHJImRI0hIBC9jxBbqznU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494184, "uuid": "aefe32c7-b057-4738-86a9-3ab765ab52fa", "value": 134104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494184, "uuid": "80696f7b-f534-4e23-97bd-adbcec985bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494184, "uuid": "d0d8947f-60e7-41ff-9e5d-2c3d08bcdd35", "value": "NDAvia_Nabidka_Linzer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bd3daa-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773503743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503743, "uuid": "7f0b3cd2-a25c-4c48-9cef-767417a918b5", "comment": "Malware payload (NetSupport)", "value": "7fe56ee0ab1be48dd475e34ea992bb37", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "github-abuse", "colour": "#2CA100", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503743, "uuid": "86b76d76-aa59-4df0-8bc8-cbaaec7e669f", "comment": "Malware payload (NetSupport)", "value": "1126bfa22faadc9f8cffc027d2694f45cbfe0527b1940f8684932bf7d99eaecd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "github-abuse", "colour": "#2CA100", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503743, "uuid": "6a8f009e-5062-4a2e-b4b5-cbfa78e7545d", "comment": "Malware payload (NetSupport)", "value": "4d1f99764f974b9820e7e57313581f71180a79d4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "github-abuse", "colour": "#2CA100", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503743, "uuid": "3b70ea14-0445-4436-967e-4f5a20cd3577", "comment": "Malware payload (NetSupport)", "value": "c7a18f42d07008959953a7435d756fe94e41c4b3595cba3543f1c45a231e557e4780f2fd2456d39dbfbd710eb1fdab14", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "github-abuse", "colour": "#2CA100", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503743, "uuid": "85340a38-1ee4-4d16-9a14-471787272c0d", "value": "T15AA5333430C3DD60F11EEC372C41A922BEE2998565A781F3AFB53D36660293BE19D497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503743, "uuid": "a26ed957-cb4b-4c71-a0ae-e102cdba4e3e", "value": "49152:5t0ZYnir6iOCtOEWb67u9lApvv2HpMDUoh8wyIFn/C4y+:5qrGREokeHpMDUM8RIJCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503743, "uuid": "58e33858-3a96-4945-b9e1-206a10e2742b", "value": 2240063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503743, "uuid": "755399c3-606a-4f39-b919-1b89eea5c1ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503743, "uuid": "3664137c-e2b0-4b21-9f29-2bae12d4a9ca", "value": "github_helper_update_malware.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdae2cb8-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773506528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506528, "uuid": "c9136f1e-9fcb-48b8-bc20-8ffd8f2d47b1", "comment": "Malware payload", "value": "113071d92b49f0bb24baa874ae9640f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506528, "uuid": "72cb2368-c2ad-4ffe-8202-ea4fab9531a3", "comment": "Malware payload", "value": "124b625edae64f9b1ce9145c7456d161e3892ff4f0a7611d1033c9e1f93b2195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506528, "uuid": "1aed64c0-6f61-46f1-a94c-ccf668c81101", "comment": "Malware payload", "value": "99eb79f9830ca199633b0fcbae34d303e322d5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506528, "uuid": "1352e3f4-a027-4f5d-9e7e-a98fa5dfcbf7", "comment": "Malware payload", "value": "069caa0147bad3afd5d02934b6c1be7aecc4b392ffad9cbbca9b65b9b41ffc792a25abc88ff4297f271cd62b2579a8e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506528, "uuid": "724bd8f4-fcb3-45a1-a2cd-5ae504b4ba79", "value": "T10F95490ABCA508E6D4AA93318CB321867B75FC590B3363D31E60BA782F727E45D79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506528, "uuid": "e535ae0a-0bb7-4fd1-a0e2-6a10e37dee53", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506528, "uuid": "84cd2048-2d34-47c3-b932-e472082a55e0", "value": "24576:0QKeIzqD5Dme/eAbpHxHexzrYzYvN3uNYA9fkavN5WaWtP5IZqzJTP:0QKzzqD5DmeVHXPqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506528, "uuid": "1eaff3b0-df9a-488a-a530-edbaa7a7ac4d", "value": 1918464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506528, "uuid": "5e28e514-4bc1-4add-a2be-4b23f6cc54ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506528, "uuid": "83b9f18c-dc25-45d7-9149-b88ba0035002", "value": "113071d92b49f0bb24baa874ae9640f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d00e58a-1fed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773523921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773523921, "uuid": "e88f0112-5def-4305-b547-362a0dda1646", "comment": "Malware payload", "value": "36d6cec4a9a67ce433154b5e30ec1cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773523921, "uuid": "d4f72985-9173-4e01-9496-fcd029538e94", "comment": "Malware payload", "value": "1253014a77e61610fa777d2b9e4735ca11352274fe38b65191aebcd5b6b5d147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773523921, "uuid": "c2e7b1fe-cc4e-44cf-8419-ab76476f8ace", "comment": "Malware payload", "value": "e61e824efedc17ee97b970a0890bc615bac42599", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773523921, "uuid": "9f8166be-62dc-449e-8d4d-67da6dcab2ee", "comment": "Malware payload", "value": "912bef35323aad7970c8ebde31e522f125bd98bb61c58dd50cf132821236b8eb83ce268a35309b03f8799d075bc7ae7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773523921, "uuid": "06a88be0-8218-4ed5-abda-821bad9c1fea", "value": "T16418331A5EAF645EC4A2EEFC512C73B213456C07C097349476AEBA1A3A3B70E11E4F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773523921, "uuid": "650bbe92-c76e-4b43-87cc-445a8d95149f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773523921, "uuid": "8e52ec80-2cdc-433f-9d87-4bec9249c28a", "value": "1572864:teBAV6xfjZwUd9hJXB3p6tjogVG/SXqurWK5iDjtbEkPTM+:teBAoxf9wUxBB3ItMOuSXqhAWjtLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773523921, "uuid": "e173e038-ded0-400d-b0ef-fede52bd19b1", "value": 91272701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773523921, "uuid": "82385c80-ce90-4a20-b676-9cd693fdbbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773523921, "uuid": "691b438b-a16c-4f53-90b1-061753741584", "value": "Windows Host Service Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d8359e-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503748, "uuid": "5376e165-5dfa-4354-beae-a4e5279ba5b2", "comment": "Malware payload", "value": "8b2ff37e8b2e912f171a79de303fe8a5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503748, "uuid": "56edf737-dd95-4811-9b21-d20562e994d8", "comment": "Malware payload", "value": "13c0deb071eff1ecf59de56f74078ea8671e5f386d2708a04dda71415353a28d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503748, "uuid": "504eba5e-6320-4b47-9b58-c2936ba9f5b6", "comment": "Malware payload", "value": "b07470b0f368506c153a8ff64ce712d7e983ae47", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503748, "uuid": "4db92422-4bc4-419a-911c-be40a861dbca", "comment": "Malware payload", "value": "87d50db69140bedea8b9fc1c482ac425fa247ed941b4285b16784254180989f515ac971bcb32fbb11aba31b8b0a215b7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503748, "uuid": "8aa41e3b-183e-4174-9704-f02d446c96bb", "value": "T175E3C8613E5A243A221F61CF8053770CA7C7DF86D644E6F0B3FB414887B5E9236A36A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503748, "uuid": "a844d5a6-06de-429f-9a59-d65b908b1f2d", "value": "3072:6YjlDsd1K/fcfuYskqrAUkEMSW1xieUrHjH7QspjKZUEM:64PSFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503748, "uuid": "3ff2a980-8c1f-44cf-8603-896c5975f4b3", "value": 144022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503748, "uuid": "9e69e2ff-8a5d-4626-877a-353d9a7fd518", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503748, "uuid": "7f277ae1-b770-4416-9b58-2448c937dd78", "value": "emmenhtal_nfclf.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a59e0a-1fbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1773502620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502620, "uuid": "d48d8cc7-3535-46f7-9318-4dc06e932330", "comment": "Malware payload (Efimer)", "value": "98176a81a78e9ad8f8113e94ef6c5443", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502620, "uuid": "034bfc0e-45a6-4503-b016-4dde2a44f9cd", "comment": "Malware payload (Efimer)", "value": "1447eb60b8f939e9d2a70d02009c52ae359d1908d4544bb115db2f72c029428b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502620, "uuid": "dbac2db5-5e26-4c81-8fc1-80ef55c3135e", "comment": "Malware payload (Efimer)", "value": "5c049fe70fc59dfb5a81089379b25b0e0c54203d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502620, "uuid": "7313835a-289e-4b32-b4f6-a02f5b006663", "comment": "Malware payload (Efimer)", "value": "937ee42945638bdb8b329fa5c0a051b9e4ab1c74f5b6f3ee78ad88113b1ad7f87ad9b23ae06ff76207ef2cc09cf4cb25", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502620, "uuid": "c0f1da39-0735-4e69-8159-c395af2ed2f3", "value": "T12DD6334E8DE331ACCE93E27CAEE22AB4B4B478B413754C2B674CC3758C53471E91956A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502620, "uuid": "4c975671-8d42-4d21-9f9e-35d999d8590b", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502620, "uuid": "d2a12ae4-199b-46a1-8db4-9777c0bfee62", "value": "393216:3k3iKEWaj0cjEskvNgF4Ade0XMCHWUjXZcuI3/PGTAI:3k3igcjYNg7XMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502620, "uuid": "f8b44b01-a24f-426f-8fc6-0b97e078ab05", "value": 12612696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502620, "uuid": "dcb00c47-0643-46ae-8dbe-19b3935ec712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502620, "uuid": "f9a18005-3d88-458f-8338-b13627393f4b", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d1d606-1fd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773513193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513193, "uuid": "c19f14be-052a-4fd1-9f94-b1be6fb151be", "comment": "Malware payload", "value": "2ed304a524ca34f4837ead365b68130f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513193, "uuid": "14afe068-3909-4111-83f6-65b1db7a2f9a", "comment": "Malware payload", "value": "1472a6442573728a74f378d1307e657adf5f59439ce627536c5ef061e9a0d334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513193, "uuid": "79162034-0bef-4a41-999b-8ca068e8a2a7", "comment": "Malware payload", "value": "d5bb58551b6b5b0a2c771064c4943eb713a4c654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513193, "uuid": "08c4975d-bb20-45b6-9990-56735626940e", "comment": "Malware payload", "value": "7c9bd46a95ce3256e8a247ded5bde4f83f6e118285f66444627befaad1fd195e5fa285189017f1882cffe6909a264737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513193, "uuid": "3f1b183e-877c-4a87-b04c-9f194d7fdd76", "value": "T1D56533965707B846FFD6D799FB3870BA66530C60AF0392B99B4DF50848910F4B4E8BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513193, "uuid": "54113802-57ee-4035-874b-f19ffa8aaedb", "value": "24576:FTF03h2xBK7DEDC39Ygq0tgnJjEeSoYhxssq/rIkgfaj6uxy4eW8:FTS2xBKE+qgq0tpeShxr6rxgg6uxy4e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513193, "uuid": "1afc8f1c-f6f2-4216-ba9e-61f9b750790c", "value": 1443052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513193, "uuid": "1c97e4c4-97d9-4a99-8658-b530034d5207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513193, "uuid": "6fc1b2a0-9305-44a3-a031-bc1336c4ef18", "value": "2ed304a524ca34f4837ead365b68130f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4352b2ac-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503745, "uuid": "b4fae18b-d63a-4bee-9e3b-6d12aa1636f3", "comment": "Malware payload", "value": "1000a22911458a3fa9d49a006d830620", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503745, "uuid": "336e65bc-6aeb-42d0-b25c-41349483befa", "comment": "Malware payload", "value": "158c91b7ca11a6805161452842c72e120e6bd999d0cf4b5332683a7c527df516", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503745, "uuid": "451d5c27-7d1a-45d0-937a-8567a449dcc9", "comment": "Malware payload", "value": "6f8bd4688121b757be21cf94e9c4e026a4a589fb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503745, "uuid": "4a64e508-4061-4201-ba28-92284e7dabd4", "comment": "Malware payload", "value": "3178315867ea4de22d858f16c6ddb8b592d4773cc34ae18217711586650fbbd23667f48b03c319b0b7c416411d6883a5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503745, "uuid": "defe51c0-9817-46b5-b796-4cb4ec3f4a5f", "value": "T14CF3D71117391CB5787BA78EE48C77166308FC03FE49B4E5E9A9C20974E9CE65272B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503745, "uuid": "01e1ca16-9e51-410e-adbc-e8159f2b6cce", "value": "3072:pzd5SfkLtkHkG4kCy7ZMI44wvSHIeTKXBXCg3EYm+gpgJjPqG3edBDXripinjS1i:1dsCak+ZMI44wvSHIeTKXBXCg3EYm+gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503745, "uuid": "2063501d-5c58-4dc3-b79c-5210e565d9b4", "value": 159645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503745, "uuid": "54db9e6d-3f0c-4487-90fa-a846f51bf870", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503745, "uuid": "5b483e11-c3b7-41a3-9e7c-56de1f7f24da", "value": "emmenhtal_niceonefashion.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c151c3-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495243, "uuid": "405cbcb9-3c39-44e8-bef2-4833f43a30f1", "comment": "Malware payload (Mirai)", "value": "662a53347b3b8041599dcde566c9c1b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495243, "uuid": "a3692e78-945b-4de3-baa0-daa383d06cb4", "comment": "Malware payload (Mirai)", "value": "15e06f87fcb8cedbcfe34f4bbc14d38652e1efb95553acd112045a1de0a3b764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495243, "uuid": "67bf808e-a2aa-46f1-859f-2649d5642f34", "comment": "Malware payload (Mirai)", "value": "7eb8ba080730a5cfbf57d60f7acf700d75940f7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495243, "uuid": "4d203eda-5109-4fe5-be94-32076010e467", "comment": "Malware payload (Mirai)", "value": "09c6d9b3939bbd29bb39c166c8245ca56a4035e4bce61a1921f4b8d8b3e1cdfb06daa359acee535e724c052e9b3db118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495243, "uuid": "7f386147-1e6f-4f0c-989f-18ed85300f06", "value": "T14F934C52B9829E12D5C221BAFA6E408D33137B7CD3EE7212CD246F9037865DB0E77616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495243, "uuid": "65ba4f09-bad4-4095-8370-0f4c476cf0c9", "value": "1536:nHnZA9TKmm4JBGyIzv/RB+7K14uNJ+B/2aQddTqGjMMEiZUk0BT27lG5QMYol61X:qZ6432vrSE4MQB/2aQvHUk0BT2xGTX4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495243, "uuid": "31c684b4-240e-4a91-9242-e80970621792", "value": 94220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495243, "uuid": "33df5e0b-a24a-4223-adf6-4896958dba02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495243, "uuid": "0703ed6c-1dc4-4aaa-bb9d-b3bd1abfbca0", "value": "xfr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3933334c-1f86-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773479677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479677, "uuid": "e5c62e99-ae9f-419f-ac30-dccbb2304f02", "comment": "Malware payload (CountLoader)", "value": "24d696cfb903dade961372ce9ddd3c4b", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479677, "uuid": "f59407c9-de0a-49fd-be95-8b5364089e66", "comment": "Malware payload (CountLoader)", "value": "15f2a00247495c4b54c66550768f358389afc92b46d0833e39ac558f48ef76a6", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479677, "uuid": "5850b17d-e035-4ba3-bb1b-7c7330c4c09b", "comment": "Malware payload (CountLoader)", "value": "93a72182ffe1f825e6fc9f6721b52cc5ba737e72", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479677, "uuid": "01e86b28-9f76-4dae-ba6d-807a9f8c16f7", "comment": "Malware payload (CountLoader)", "value": "f089d7cf4a761e34399c614806a61654ab35aad8ee88506722b0e2dac22504e52fee6918bc2eb09020da716469994730", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479677, "uuid": "d40a7990-8d9a-4ec4-95f3-f2146a1b357d", "value": "T1C3C3720D084B809997633C11EAAA5557DF74034B260EC2F0BF5F9B507F12ABAE4FD296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479677, "uuid": "299792fe-e5db-4461-9a2d-7159ca6a42aa", "value": "768:KPLHk9CCaK0mpM5Jdfv3W3U+dKm9je0IQ+PhZGc/6Eiz118Q09ez2SxNwGzLIglA:TSADdKPnGcu8QLDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479677, "uuid": "9988adfe-579d-42d1-acd0-4f697068efa9", "value": 123518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479677, "uuid": "8ea4a4af-b1d6-45e1-9803-963bf07e0e16", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479677, "uuid": "820b1c93-3616-4220-a0d3-78f015acc291", "value": "Summer_Notes_New_195.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc8cce4-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495250, "uuid": "bfe236c9-89a8-464f-ab44-2dbd30b1297d", "comment": "Malware payload (Mirai)", "value": "324f2f121e0c9f8cdb09841f45b93179", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495250, "uuid": "405c3279-ea82-45c7-9114-4266a9929b63", "comment": "Malware payload (Mirai)", "value": "1606afba94a2281e2785f341ce10da71c862bd2a926c6c5ea31ac82745aa9f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495250, "uuid": "3561a283-eb0a-477f-9a73-f6406dd25e32", "comment": "Malware payload (Mirai)", "value": "5c76962dec47a0ffdc81dbdfa3b3c90e1137c1e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495250, "uuid": "997d8714-ccdc-4b27-9549-4be9ea2ec703", "comment": "Malware payload (Mirai)", "value": "6b5dc1264b59c907ce458f083ad26de14a7110b22eee4bec8b9705ae14fe84da7fcdbd83bda5d1102bc87dadcc6e391b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495250, "uuid": "681be8fd-193e-424f-b1ed-d4415ea5e6be", "value": "T13CA3E706BF210FB7D86FDC7746E90B01298CAA1B15B53B767934D858B24B2CB19E3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495250, "uuid": "2f534ecc-ae76-4a24-b563-df64d207ac3c", "value": "1536:peEs5swQtf+5VRyz+ykt0nCcSlCqodvzIQeOyfL4l61d6c:peV1Q+F6nRSlCJsT441", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495250, "uuid": "8d4f9902-f152-4117-90e0-66d80cc61744", "value": 107400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495250, "uuid": "ab25e053-8448-4fb4-8d1b-fbc107a28fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495250, "uuid": "3b373b3f-99dc-4311-bd07-6def85f3dd99", "value": "xfr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade303b4-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515521, "uuid": "174d0d0c-fb08-4eab-a63c-9ae60bb11594", "comment": "Malware payload", "value": "224d1ad607e58bfa7605f3314471f62a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515521, "uuid": "c94b060c-4064-4f36-beb0-169a38da9306", "comment": "Malware payload", "value": "17473f1042a6c3a205e5c4609c15f0bbeb37c1b97ddca9a229d7b34e318223fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515521, "uuid": "e370aa76-ba70-493b-bd0c-ca52f867c240", "comment": "Malware payload", "value": "2299655bb6da698bddafa0eb165fe7a8cf8d341d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515521, "uuid": "74e43e30-9913-41ce-8523-ab223d7b5086", "comment": "Malware payload", "value": "4dca4008afeebfb12ebad8ee85b945b74187074882da91e695d04a74505d3a737a04220cae94e5b2f26991facc67a8d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515521, "uuid": "6c5459e6-548d-4ea9-8b8d-38247f962074", "value": "T19F53FC74EA7A04F3E840ECBE658557087F6ABB400FB1F0C195756ADF88EDB224E14A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515521, "uuid": "09a40c0d-96c9-48bf-8d2d-300c8c07bb67", "value": "384:vq9w/rl4T0XYpmPUZGGxa4XveVqcqKIMfqP:i9w/rlm0XYpygtxDXveVqcqKIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515521, "uuid": "7f4cc7c2-ee1f-4ed3-8b11-52fbc5d03578", "value": 61406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515521, "uuid": "181bccd8-4ba7-4c94-aff5-b1d0703dd086", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515521, "uuid": "7ed64d8f-c507-44f5-be88-2b8f91d2522d", "value": "224d1ad607e58bfa7605f3314471f62a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a79bf05-1fa6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773493530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493530, "uuid": "ccb1bd73-05af-4d0c-b6a3-97998979ad05", "comment": "Malware payload", "value": "c06d55be90ee50948936e8de232f4edc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493530, "uuid": "aafbbebf-0a25-4ec3-aa7a-f0f43b63ea8e", "comment": "Malware payload", "value": "174bec903bb33e5063eb9cab64c4b943db194933a3a2a87f9c6d2d48ba991a44", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493530, "uuid": "891ff709-d6ff-4adf-9f62-4dce3fd91ddd", "comment": "Malware payload", "value": "cb5b3f5fea1fc3626af33a5dfd4bd5de5084973d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493530, "uuid": "cbcbaa95-fec5-403f-9406-86f8afbc9dfe", "comment": "Malware payload", "value": "4b9ec9e9277f0a37f89d72e6aedad0597400a2641b4674c8abcc25bc86a3f2f6de5fd1a504fd9698b10513bb05b88b98", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493530, "uuid": "b03eea64-a504-4f44-bf36-9dc57c6c517e", "value": "T1EB925CB512896D79FBD0CE39AF3C6F4CADE8C2C42124A3ACBA4F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493530, "uuid": "360520de-a6dd-4a93-aaf8-a482417c30fd", "value": "384:wIFcuQpWx+BL0SWL0gfzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:dF8i+BL0SI0IzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493530, "uuid": "56fc7db0-87d2-4c18-941f-24569fb89740", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493530, "uuid": "237d8ba0-9018-4730-8a89-32542327418f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493530, "uuid": "42e1f445-2e57-4232-991e-87ac2ad28096", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8be139b-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515163, "uuid": "92eaa68c-179d-41be-a414-865d08df025e", "comment": "Malware payload", "value": "529773a4e15ceee56e0021cccc23ebb4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515163, "uuid": "154252cf-2aef-4499-912b-746553516dd1", "comment": "Malware payload", "value": "17b619799905d1d457ff7cc4cddc879a3bc60c044aaa7c6bb7cc67db1b93a6c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515163, "uuid": "4b8c1933-c3a6-49c1-9c4b-8e0ed69789e1", "comment": "Malware payload", "value": "cae439be4cd37fe269e4c2c29c7231da2fa64821", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515163, "uuid": "22dc2242-4f2b-4818-afea-8f0563a94fa3", "comment": "Malware payload", "value": "2d514ab2b0bd9baa725334c7faf2bbe4a1f6099fc00cf7c99e0555e3e315fe405562eb3c66133d4e7c46c5c409559530", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515163, "uuid": "09226f6b-8887-46c9-b944-7e1e9132c192", "value": "T117F1F63A92950B61481F08DCB338028EB508C76462223E805F1F9D67FFD516ACEBE1A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515163, "uuid": "f7a1f065-3e2c-436a-bad3-f8232d01cd9b", "value": "192:L/Un929RPca8bNBN8aWAhNwJE+gGZWjRymP4COZ:39RPtePt/T+gGZW9R/OZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515163, "uuid": "20bc884c-6e2e-46da-8881-80bccfd6d691", "value": 8080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515163, "uuid": "24b2c5ba-78f2-4ee0-adb5-dc263abcc293", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515163, "uuid": "ff79876e-a4f6-493a-b780-d388f33aa2be", "value": "529773a4e15ceee56e0021cccc23ebb4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4a7d4c-1fbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773503143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503143, "uuid": "b8b5072a-6c14-49dd-9d55-917bc870846c", "comment": "Malware payload (Mirai)", "value": "e6e39bdf9506b5a27206b489c1360b2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503143, "uuid": "644ab117-0c8f-486d-9e7b-57cee0480125", "comment": "Malware payload (Mirai)", "value": "1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503143, "uuid": "fc19d7c7-47a4-4fd2-9837-4c7fe7ad0348", "comment": "Malware payload (Mirai)", "value": "42e4650555e699c20ccf606c3b6ab3a1175b62d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503143, "uuid": "d248c205-88ab-4598-9bd6-284ff57c7345", "comment": "Malware payload (Mirai)", "value": "b6daf03fabb2e7f0364597f47d5ddde21d1cf631122950bf5c85124afd6257d41fbc1b85c3b6d0b7b03bad219ff07b1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503143, "uuid": "c6517c8f-261e-4999-bbae-4d534b160770", "value": "T188110CCD31A8643D5D408F4170A2CE64A104F6E7589B8FC8AC4C4D71B18BAB4713AF8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503143, "uuid": "604ddf84-a1e0-4fb9-a002-4747bd88a8a1", "value": "12:UzFEwZUfEELKNI5rEiZ3cKrEy6+kafaE+wVnI2edIIe2c/wWODYI7XU:S5NIcKRPkAGwVI2E/c/ZuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503143, "uuid": "97c0f0b5-19e9-456e-977f-7e2740840a8f", "value": 875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503143, "uuid": "31c14857-fbde-4264-a5a2-28a72ad39cb7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503143, "uuid": "b249994f-fa2f-467d-a851-429ac45ede81", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532ecc1d-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773494323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494323, "uuid": "1c1fa3c7-e7ef-4bda-8ac7-761b8ccc6060", "comment": "Malware payload", "value": "fc1f822b8813e45f277276d404de4cd5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494323, "uuid": "c69ddf47-5d80-43af-a3c1-365acb877fec", "comment": "Malware payload", "value": "1a61c91c28f265aed8cc451a2c38bc0dd7e83359c50ad304f68184743be88da4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494323, "uuid": "acb9fa81-280f-49ec-b2ee-b33da41ee9cc", "comment": "Malware payload", "value": "beaf6c15aa027f6b7feae8c3e875a9e7fa7a77af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494323, "uuid": "5b70592c-cf8c-4a0e-bcf4-6f52599b8623", "comment": "Malware payload", "value": "d3830035648d5797da06eabd98078c486ae98dd5d06f3631c5581d5b1ce2a31da0899e08b5060012cd69f4b4ea1ae366", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494323, "uuid": "24e1c815-477a-4fc8-8050-f5ba8dbbdb6e", "value": "T116512FCB02910F71696A7717FFB98E2C318264E2A8932F4496DF34E55B8CFC87544A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494323, "uuid": "00246574-ab32-4e2e-9ef9-d3300e377f8f", "value": "48:iRAhmlR2nElRJCXlRlePlRaCazvZlRa0aFvjlR9Nc9z4gelRSjclR5SvlRjCjzqC:iUmlwElmXlqPlY7zvZlY5FvjlLsz4Zlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494323, "uuid": "680eb0ac-281f-4e79-b52e-0139aabcc856", "value": 2989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494323, "uuid": "08aadcd2-0922-4531-b9e2-3bb37814fd7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494323, "uuid": "4c5801b6-3c66-467f-bd51-a20133e03d71", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec017214-1fd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773513048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513048, "uuid": "377616ae-0821-4c1d-91c4-d95a5f05fadb", "comment": "Malware payload", "value": "f24f8dd5758a42c39862c1f83d4816f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513048, "uuid": "5f31f729-0cef-4d48-8ce6-7efffceab8d1", "comment": "Malware payload", "value": "1ad3c75b844b2ce6f20beb1c324eec749d2783364a685a0db64638ee10279b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513048, "uuid": "15469465-7297-4841-93fa-d5566efe35d0", "comment": "Malware payload", "value": "6ed44fa5f6c0e645a54e3cfc7f34e074e7ab2a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513048, "uuid": "d5ed08f9-aa91-4c97-a244-78fd966dd393", "comment": "Malware payload", "value": "09e19ae119c1eb26b47efe05b22f929bdb1a74221fd45435f40efd05cf9c76814644b0b2ecd2c9353358c67a23dcf77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513048, "uuid": "39ec72fc-a1cf-4c2e-9efb-44a5beb5fbdf", "value": "T1EFA2E60BF35318EDC456D434CAE3A332F1B1FD19153A2B6E8264C6323EA56756A3DB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513048, "uuid": "cf3d0393-aab6-4008-a392-2a0ee69900b8", "value": "108eb78d3c8e0a910e013cb7425dd852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513048, "uuid": "f51bebb3-496d-47cc-bf45-ddcc7fd43b5f", "value": "384:G3DL4GTZgEZ5Akja6p30g9eyOg65U6EDTgDd//I9Rho:G3QGlPWkjJt9U5Gfed/uR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513048, "uuid": "7972e0dd-0a41-4a4e-bf08-7fddabc95cc5", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513048, "uuid": "10b0db24-3a86-43b0-b687-7feab4cf4acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513048, "uuid": "1b7ea9cb-464b-48aa-80e4-bc0bd64bb555", "value": "f24f8dd5758a42c39862c1f83d4816f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049a5e3c-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477441, "uuid": "17d1b287-0da5-4dd1-8632-a77b65210d5f", "comment": "Malware payload", "value": "3c18e2fda158047169dd2c6ebde84085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477441, "uuid": "6a123bf0-af9a-4a4f-a757-4ff9698f10c6", "comment": "Malware payload", "value": "1af7803887653711e1b9c06410df879f8b4783543d9fa503a9580d6d00a9e246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477441, "uuid": "69c9cc87-fbdf-4386-aa4b-5d6912c58efc", "comment": "Malware payload", "value": "1081f10607be16b2f4a6b67f8018bb1201924156", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477441, "uuid": "92231fae-5a41-42a0-aa59-541f3f3f098c", "comment": "Malware payload", "value": "3724257cffcbea06866d37ea662b4b1c37c1920e593d3051971b93829465f5a56a778cfd22c516395347b581ed4b65d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477441, "uuid": "a617bc4c-4b4d-49d3-be0f-ded457b29043", "value": "T152362997B8924982C4E4367ABC7E81C473635EB99B9752576D04FE3C3BBE1A90E34700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477441, "uuid": "8a517555-008f-4603-8c9e-77eca224d00e", "value": "24576:dO+nPUOHyGs/hVSYOzn/nuZyEy8DWO2FFWMCYTREkZHpjOlAA6518zm9A717GzSo:dj3Owhv6WSPo7ctxquaL/ua4Um3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477441, "uuid": "be8a6f7b-02b6-482c-b31c-4e141a5f537c", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477441, "uuid": "3cb30cf6-aa23-4cb5-8aa4-88fbe8cd061d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477441, "uuid": "e5474c6c-35a1-4d4d-abb5-07b24f4178fd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9be8f9-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495226, "uuid": "920e6fc3-bf34-4018-a165-8c8d202e32fc", "comment": "Malware payload (Mirai)", "value": "8a6b20171dbe8049397b3db6dc2aa640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495226, "uuid": "21b7b85c-caa0-485c-99f3-899f5029135a", "comment": "Malware payload (Mirai)", "value": "1b0803f1869ff42c172d06254092ef23e1af067cb40099113637d1b04cb27967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495226, "uuid": "cc2aaa00-3d4f-4d12-bacc-9e39dccde7eb", "comment": "Malware payload (Mirai)", "value": "0904395a0eb896ff34e832af92ca4a79fe096f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495226, "uuid": "710c8cdf-1070-4a02-ae89-aa8b5ae3ffcb", "comment": "Malware payload (Mirai)", "value": "77eee45d6eeea5f16aaeee81d31b265e1f3be3533217e55bcb8226e94c202dcd004c56ebc1b50ce48bbc31a837bdd982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495226, "uuid": "db5bc7eb-ae8e-4b0e-b2bc-78067b6685e0", "value": "T15D734CC26A43DEB3E91310F012F7AB365A32F93A142AD6C3E375FEA299415C1B50635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495226, "uuid": "ad913c44-d10a-45d5-aae0-92525d27078f", "value": "1536:neIBYKAp02IUkLw6HagdTo9/eIzWXg4d1dab/iy5SOBL:nuKAa2IUkLbZJGXzqg43AbjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495226, "uuid": "4b828928-fdee-4fb2-8647-07040ebdf8ac", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495226, "uuid": "d70bd465-0b1a-477e-ae71-1fbe73e6bfaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495226, "uuid": "cf38cfd5-6c2f-4ec5-a482-da28a1691bb4", "value": "xfr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefabfe8-1fb1-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773498477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498477, "uuid": "f53e5869-e714-40b1-96e4-62042513d68d", "comment": "Malware payload (Joker)", "value": "21b42a865e2c891da2c65542997606c2", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498477, "uuid": "dbc93dac-9297-4d56-aa2f-b84c8ccc77a1", "comment": "Malware payload (Joker)", "value": "1c2bb6a917cc74e21f95ac7fdb9b5f8014a49ce95c2c6e9388fec3eb9512ac25", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498477, "uuid": "4796c48d-365c-491e-b84a-ed487706f093", "comment": "Malware payload (Joker)", "value": "f70494e58a642da675e2f827b2818419b842fa2e", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498477, "uuid": "94d4a0a0-4c7a-4651-8035-2e53dc74621d", "comment": "Malware payload (Joker)", "value": "a983c27b66a597b83d15b6ff6625ed3f1636ff904158dc1eab8f433d9f753de4815d5c9cf990a8a758cfd46db60d8a42", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498477, "uuid": "5733a5c9-a1dd-426a-84c7-614312e210dc", "value": "T16DA7220AE7DFD82ACFF7B07D8A5D2222601A68D85641C3DB29039219B9D7FD44E15BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498477, "uuid": "3f71c942-eefc-448e-b171-616a8fa6238c", "value": "786432:ALwNQMdDW6mcRzU8iEa4nhPsPJ6/4sb/XGykTvUqseLQvVD2AuSs:wwNRNW6D5USPsx6/5eRTvQvTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498477, "uuid": "fc7583a8-ba5a-43e9-b904-fc8fb8444423", "value": 43670811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498477, "uuid": "bfd436e8-e488-4eb9-be5f-008c3bb3e748", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498477, "uuid": "3c170e4e-6240-4458-b3b8-bb33cbdc2607", "value": "com.fda.easy.deljunk_1.0.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225b8ddb-1f46-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773452150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452150, "uuid": "befd180a-fcc5-4765-8799-6087287b2e45", "comment": "Malware payload", "value": "1ae1b96f6d4282b33547f8a8de94b2f0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452150, "uuid": "19de1ba3-3f4b-441d-9d77-f4e3a524105a", "comment": "Malware payload", "value": "1c8d08e52a4971eec1bc0246a008cddbea4e637ba2187560b8885a83f08ca6c8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452150, "uuid": "61cd147f-8f13-4ebd-9c37-98f5270f9c06", "comment": "Malware payload", "value": "c9e9aef96d511bb213b70f86b173aaf8c03068c9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452150, "uuid": "d3f5548c-5537-4d61-9944-1f874b7614c3", "comment": "Malware payload", "value": "91ecbc22c0d3efbee12edb593a2fec6668804c49237b90144b40ed17aab63eb72e491223de2561d376b8bb8db38ae8d8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773452150, "uuid": "055ba80b-6a20-4c12-ad3a-5925f3fcd3bd", "value": "T1EC6733FFC4824ECBD43F4474D5B89A1B813A6D204BA2AA77727DB3A312F37942239155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773452150, "uuid": "d41b91ee-d2b5-4643-8066-3ad0be4c4c00", "value": "786432:9SRZmJIOuAkj3WEzvCbY+4f0USU00TgR6YrzTHwpEMHqxr:9MZmJIOSzvQv4f0PU0Brzbwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773452150, "uuid": "5aae2fdd-ba6a-4aa3-ba95-167aee647ef2", "value": 29827072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773452150, "uuid": "3dc1a89d-1260-4c8c-b1a2-db5b8fab809a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773452150, "uuid": "dbd10121-32ac-419c-a0e4-7b0ffb38f3ea", "value": "YimMenuV2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f5a82b-1f78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773473717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473717, "uuid": "9874ad5d-e4e7-4f01-a087-c173d39341a1", "comment": "Malware payload", "value": "fa83031a6964319843f67713fdd56b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473717, "uuid": "363ad435-5882-4132-93fc-7e5e13160043", "comment": "Malware payload", "value": "1e3eb765015fd335cfdcb0ddd020565690b5a2f15a2a62406d750bcb21b6d77b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473717, "uuid": "8de5e46a-f8cb-406a-ae7b-69d98da2e554", "comment": "Malware payload", "value": "42cb9b12c6287225772e040bf8b151c8935bc7e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473717, "uuid": "f1a284ae-8944-48c0-9c7c-d9c4ba302b58", "comment": "Malware payload", "value": "b1b2b9bc5de523bd26ef9b320b2a4436d239aa073a9b1f729a2e67f4fcf92e384f7645bcfe754dab6c3e2e45133640ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473717, "uuid": "e72132be-f3c3-4881-a2ee-6dc800e8df19", "value": "T1E7364A57FCA545E9C0AED1348A629252BA717C485B3123D72F90F7383F72BD0AA7A344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473717, "uuid": "a1e96caa-7636-42f1-b6c8-f0658dadf796", "value": "49152:IJPpsCDvmLCyk8NbrRpeGICkKhhbnRL5EWOiGr9Y/zA95xwEhO:CpsAvmLCc/e6RXEBrPvxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773473717, "uuid": "4e235924-b907-4934-a666-1bf0b5029bd2", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773473717, "uuid": "4a33ac73-c7f0-480c-9cdc-0127855e90f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473717, "uuid": "9bd91b5d-f4e3-4d07-a6e5-e25322cbc583", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b16114f-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773507329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507329, "uuid": "be63004a-5046-4351-bc9b-f26bdbb2e774", "comment": "Malware payload (Vidar)", "value": "f010034cc9224c85c63f2488a7aa2dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507329, "uuid": "d350b406-3aaa-438f-8223-89007622712e", "comment": "Malware payload (Vidar)", "value": "1f0234e713ba00caadffd6d42f05e6f8d484d9204f804aa202dc67f85985dafe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507329, "uuid": "acea62ef-8da4-4a0e-a49c-8b47d7fbdab4", "comment": "Malware payload (Vidar)", "value": "495415346c59c603363a8d5f0303de442cfe72e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507329, "uuid": "d52404e1-c07d-4a0b-a2e1-7c07e7613c71", "comment": "Malware payload (Vidar)", "value": "7f5653f340efc87d697e9030da42f6e9eb287ee90a39d20823ef82e8006debeef600b9435eb60d3c30c40ddad977bb76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507329, "uuid": "1ab746cb-c740-48e7-b0e1-ec2f2fdced01", "value": "T14966063B2E60D6E9C15A933AC4978E40E5F3B0764BF3D5F70E9117688E964C44E7AE20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507329, "uuid": "a848af16-0b0e-4814-80ab-3ed9b6fd6eb3", "value": "00d782a7ded6a3c43266f1a10c5d7773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507329, "uuid": "0d810311-b693-4542-aff7-c563976984b1", "value": "98304:4IoZyQ01KG5KKMv9fZE3zo5tMJbh6eQzEG+J:/G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507329, "uuid": "c5dce5a7-d374-4862-af1a-77656a03d632", "value": 6628864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507329, "uuid": "ac63df3e-2fec-43e6-9dc4-58075c057e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507329, "uuid": "563ecae2-b38f-4560-bfff-5edf13af4364", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c6e830-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516225, "uuid": "d77fb405-67d6-459c-b859-7557f16eb8fd", "comment": "Malware payload", "value": "2672a7f5fc89c4c1c20d93714cdbe616", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516225, "uuid": "54054c08-1fe4-46de-aaec-c44a1c84da86", "comment": "Malware payload", "value": "1f6f3611056873ae5d14d22887a4b285cad311b1e3ccce8c488d40bf7a0b5e61", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516225, "uuid": "2e592b0c-e894-4317-a772-18e44f41517b", "comment": "Malware payload", "value": "909cbba452daf77016dccd0532cdfcb8de2c1cf6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516225, "uuid": "aedd1518-c174-4941-99a9-023b63ffe240", "comment": "Malware payload", "value": "116cff93db526eec762694a3696bdff06f857bcaca6d68a77e7d120a600b89bb80e4f7b49fe8b145c9fa6fd407227f18", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516225, "uuid": "f617b1b8-520c-49bc-b4fb-e628a5b802db", "value": "T16635D53691310E9DB2E57C3984680CCD6F4863F6CE6E9E63504CEFF9AE00AF865E1654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516225, "uuid": "b3e87a61-d295-457e-81bc-2f8f7427e9e6", "value": "48:ZiwjekypzIfcjbe3xfbw1W92Vw+AZSCB+peT9aj+wt98vGpwtI8vC2E442Ms+u64:rJd/+MXVVt91ziDJ593C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516225, "uuid": "3fc747ea-3fd1-4784-9532-f7e0a64377d7", "value": 1163207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516225, "uuid": "1f993be7-3862-4beb-b648-9bbbbb4ee8d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516225, "uuid": "4e6cc330-f315-4c14-a9f8-0349a3a7d24f", "value": "2672a7f5fc89c4c1c20d93714cdbe616.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87891be0-1fd6-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773514168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514168, "uuid": "fe833431-c916-499c-80f5-b33ae102970c", "comment": "Malware payload (PhantomStealer)", "value": "0f44e71a090ed69d6d09c5952e4349ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514168, "uuid": "1ed3afbf-9653-4ff4-8e7a-4cc94e67aa36", "comment": "Malware payload (PhantomStealer)", "value": "1fa92fbb50bb6c75280168805549d46b569e5cd87bb1cb0b379a4bda86b56ab7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514168, "uuid": "08f3a775-f31f-48e5-b4e6-ef9457575b51", "comment": "Malware payload (PhantomStealer)", "value": "bcd648360bfccc8fb2c762b46ea871e207468621", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514168, "uuid": "7b893388-b45c-4d8f-a4e4-98028c24c58c", "comment": "Malware payload (PhantomStealer)", "value": "7a748d8cb6f6f5cb2898ae85b924409d5b5b13663e7666ece7f399a7a4dd8edb86da8aaf5bd7a3fa9e2d830f98978b2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514168, "uuid": "31db0815-b351-422a-9797-1d3c293b66ac", "value": "T16C269E69827B9EAA19C1D25CC1EC504444F09BE5D4DBAFB83E33F8D56EF74A908C816C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514168, "uuid": "19322887-7d60-4fdb-b517-d42487c0c6bd", "value": "49152:Ab1K2Z5Mk6RMD4WKpMmhnvOBmmHY55+5Zp/IciOZBY7D2YiLf7RNwwu+SBugnJ1s:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514168, "uuid": "6cf8d596-29a8-4f55-912b-c24d93864103", "value": 4564350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514168, "uuid": "1915d856-6f1c-4667-9fa5-8fccf42b49f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514168, "uuid": "904c97f4-3855-4ffa-8839-c283d7b7626f", "value": "0f44e71a090ed69d6d09c5952e4349ed.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c221edad-1f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773478188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478188, "uuid": "1a3ccf39-66b6-4aea-99e5-b60a28da14ef", "comment": "Malware payload", "value": "c18945966b452370170d651d38edf5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478188, "uuid": "bd1eda85-ec0c-43e4-87d1-b30551fa23fb", "comment": "Malware payload", "value": "207a5ef49e260c9cdd0d86d8bcd242af1a7287ee40dd503517431e53fe517ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478188, "uuid": "4ad3d5b3-6c9d-47d7-a6a9-d9cb49c4cfbf", "comment": "Malware payload", "value": "bfc5497dc774e916419af21c6eed55157a7c49ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478188, "uuid": "ead3c743-c640-4e42-995e-e8655da1a5f5", "comment": "Malware payload", "value": "d2849ceabc064f9f503176ac49809d81333959300505def011d958f9e22ff479cbe981a7dd437a833e157552fd7a2a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478188, "uuid": "b1615bb9-abdb-4142-99dd-e903bdc3fc8c", "value": "T197A7BF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478188, "uuid": "c30155f4-3575-4900-88a4-4a99ca8465f3", "value": "f0486e7e054aa57188c99b0f71783b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478188, "uuid": "de03873c-00bf-4d0e-9c01-5bf112e3ba59", "value": "786432:F3on1HvSzxAMNRFZArYsV481YPvmPv0R7OZtdQN:FYn1HvSpNRXmHQauYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773478188, "uuid": "d2748a9c-835e-44c0-87f5-76af7ab71e72", "value": 45978392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773478188, "uuid": "45cbdef4-ccc4-4a22-b6c4-d877dbd8daed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478188, "uuid": "420023e4-7282-479d-97ba-bc5e550242f3", "value": "Aimzcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1f80d8-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507334, "uuid": "e5afcfc6-af0f-466b-aaf6-012fff572d49", "comment": "Malware payload", "value": "c49f3166db730c8963115dcc7fd58d83", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507334, "uuid": "a12dc7fa-f7d1-4f41-bae7-089b22557bdb", "comment": "Malware payload", "value": "21029dd228723f4f1517b6390d89021866ecf77045224dc06ce62ee3a39c0da9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507334, "uuid": "156f03da-edf0-41ba-a35f-b9a59c6239ff", "comment": "Malware payload", "value": "5c1aa80b65bf1e24bbeee05c1b80f4b3c4080627", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507334, "uuid": "959b335e-5606-4bff-8428-1a55b25efce6", "comment": "Malware payload", "value": "e32010c1fa1764c1a2317fcf29a608a91b9ac50e29f3bf829259910afeecfcc03664cc7d49e1b2011ff21fe1b289e9d6", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507334, "uuid": "f92ba199-ceab-417f-97f1-294827bcd253", "value": "T15664230AC11D35F63E49104CEBBE7D2DCF616DA368A8E3E873EC40661F273618A2E455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507334, "uuid": "28fb079d-0194-4ac9-b56a-d5b54e54df77", "value": "6144:hkOkS/znivy3ve31GeG8ZTcQZHS+g51q7L3gtq86N/fMOmIM:rZW4vwweL2Ay+pgs86N/ZmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507334, "uuid": "69426c91-8462-415a-9179-b731e51dd244", "value": 321183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507334, "uuid": "f230eb3c-faae-40a4-8f48-8dec73c2eb9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507334, "uuid": "b2e5ee0c-928f-4756-b18b-50bbb63c2944", "value": "21029dd228723f4f1517b6390d89021866ecf77045224dc06ce62ee3a39c0da9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a07840d-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516212, "uuid": "ea801e77-5f2a-45e0-9d36-a3153336e65c", "comment": "Malware payload", "value": "962e2cdfa71c95730c8c785288779116", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516212, "uuid": "71a01f3f-d409-46f3-85ed-e7d6896688ac", "comment": "Malware payload", "value": "236fb06a5a1602da404031117c8e880d25d706b8c1c54522c93b4d2e48a0b1ac", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516212, "uuid": "062d82eb-3f6f-4a66-872a-74e686cb9d63", "comment": "Malware payload", "value": "c16458ee0220f69c1cc110486ed21d3c07079090", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516212, "uuid": "1fc1560e-777c-43bc-9ebd-f500caf32531", "comment": "Malware payload", "value": "be085be66000d893dad8b5388b5247eb25501fd962243057a7b9b74c2fa0a2b793041b4f0263ee1a33d13cdafee03ef3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516212, "uuid": "e9460543-c773-4609-b7a4-67cdefa4cfeb", "value": "T19A9274ADAAF6F11625FBD393CE5112104D1FBC1BB1167C4B1EDE1A24112D8C4AEBA4B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516212, "uuid": "7e917630-3b20-4373-a47a-9c16dbcc505b", "value": "192:AahgIylVlv0GSwSNZmQU3tVg6IsMiJ21eyOwXMUXdN64u2td06YPaAs0etjh2cDr:DdhI8Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516212, "uuid": "66fb3bc9-65a4-4ac7-b2ea-407bad6fca9c", "value": 20582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516212, "uuid": "41b49132-afe5-4d04-b60b-8345b7378ca8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516212, "uuid": "9cde6b96-fbed-45ca-841c-79ad5ba33614", "value": "962e2cdfa71c95730c8c785288779116.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a17c52-1fcd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773510430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510430, "uuid": "41f9c3b0-2b7a-4008-88d3-ae2c8c641679", "comment": "Malware payload (Vidar)", "value": "2994cd82427723d165e6bd3af06dd9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510430, "uuid": "e71fd4b9-86fd-424d-ad07-cd7ea00ddfcb", "comment": "Malware payload (Vidar)", "value": "242f22c234df785f164e75f75714704c1102325d9b12737504e1287acebd09d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510430, "uuid": "d74278f8-627f-47a0-9726-6dad1cfdfa10", "comment": "Malware payload (Vidar)", "value": "21ed05bbc1775a67dfbd438063c904ff9b8dc983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510430, "uuid": "c6d4ddee-441f-4923-ae58-7df38451eb31", "comment": "Malware payload (Vidar)", "value": "8444e6a3cfcedb61c0ce3d46823d38c56179c3169deb82a64e2e8622706bc0b123dd1943d6a9fa209cafc21cd0bc12c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510430, "uuid": "e0a43ccd-941f-4087-a337-a3586b7cf1a5", "value": "T1DEA58D4ABCD104BAC46993328CB652A6BB71F8191F3223D32F916B783FBA7D05935714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510430, "uuid": "133ffa75-4600-406e-840b-5e10a6294e65", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510430, "uuid": "04ed9e87-a5b8-40c8-bbba-c6e0f35ac970", "value": "24576:Vqf7x7BQHc8NCUni36vzfBnl+bZsb5dIp0JMOrKI49PFsTlII8gyOGiWfKozbR0:VqDFB+CUnxTIwfGJ9PFshII8r5zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773510430, "uuid": "7757fd7d-cb60-4e86-a0b7-ff5380445f81", "value": 2211328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773510430, "uuid": "f623aabc-c20c-405b-94ae-7d46293a2e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510430, "uuid": "ac055b99-ccc8-49da-9dc8-ea15b4f33809", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1710a1e9-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1773515697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515697, "uuid": "ffd4612c-8616-46aa-8ea2-52d04145e7e1", "comment": "Malware payload (SnakeKeylogger)", "value": "17aaf09246b97db19f735f2fe9e26708", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515697, "uuid": "9c5448e8-d77b-4a0b-b0bd-ac75f675f241", "comment": "Malware payload (SnakeKeylogger)", "value": "2497074eb3708b530f8aeef43812d6a4a57c10f0d6a8b4ed2529bb4e778b1712", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515697, "uuid": "144e4b61-32d8-4831-89de-25cc0985245b", "comment": "Malware payload (SnakeKeylogger)", "value": "5f35d0d0e31a58eb37f432cf347902dab2a9d5a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515697, "uuid": "afe50c88-b9ad-4752-972c-456c71081b9f", "comment": "Malware payload (SnakeKeylogger)", "value": "10d20635a57e2f4410aa797715dd93bb03d99f6a4bbd493a2476b9aa0ef5b26118c5b194d2f114f3568ff755c1fec2dd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515697, "uuid": "b2785333-e92b-48ea-b3bc-22de3ec5ad52", "value": "T16245861AD5757709066EC7CDC0741A0782FE034BBEDB2EA2766AE1EBAF048111DE5ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515697, "uuid": "59062952-51f4-42fa-9440-ee156d980ed4", "value": "768:9bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbw:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515697, "uuid": "494daa9f-ca1e-4c12-9463-52e74c257fb8", "value": 1196682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515697, "uuid": "49e9ceee-0f97-4503-bd5a-5bc146648441", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515697, "uuid": "5f88f5d1-c1c2-4bda-8f39-e623dfb0b120", "value": "17aaf09246b97db19f735f2fe9e26708.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95093f7-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501876, "uuid": "be021807-c12b-45d2-b6ad-43dcb23b55c3", "comment": "Malware payload", "value": "1ae916325073c21dc18441ccf4c9de06", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501876, "uuid": "e7ac295a-7ff7-4b65-8023-556cb39988a5", "comment": "Malware payload", "value": "24a9a22d4570fcfe278665f1666092a2362ef4977a9b287ecd3cab96f72cfb6e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501876, "uuid": "c03bdf16-0b50-4fa8-93c1-85c9748918ff", "comment": "Malware payload", "value": "ae60e45e9fb426117dd6d740ca720337c801432a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501876, "uuid": "2441ccc8-57f4-4687-8e13-d748f9d81d7b", "comment": "Malware payload", "value": "60016013c49109adc1631160d0f968ecc10c6a979a3f391a522b3b45b9034490bf92bedf6b7dceedfcd80546b4d995f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501876, "uuid": "1beb1eea-9535-4759-88c6-f652e4533912", "value": "T115924C61BB7E140F6CCE6399016A05B32BA1AFD0C168F57C71863B29E54BF2163C035A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501876, "uuid": "fae46ab5-3dfe-40ba-8b7c-5bae418c873d", "value": "384:ZM5mwvENbtSODaAM/lL9blEpBpY9ev2+uNffSS9QLpCtizwW0FTAOwx1e:MmwwGmFMffDQNCtdXTAOwPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501876, "uuid": "baf04dfc-1ffa-4af7-917f-994be390ee98", "value": 19431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501876, "uuid": "6e32c399-ed29-4bf0-9464-3bca915a008e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501876, "uuid": "a76d6633-e455-4d33-8048-44a7a1b23600", "value": "myverifyblog_fake_cloudflare.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6987806e-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1773506386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506386, "uuid": "e8ff3cd8-bd37-406a-847d-03be1f378160", "comment": "Malware payload (RatonRAT)", "value": "721017526097002a862092ba7d7b60d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506386, "uuid": "034f4e97-4dd6-41dc-aae3-fcf5cc392aca", "comment": "Malware payload (RatonRAT)", "value": "25b442da47743d5c195cdf6178248d2b1eeb5238d22341dc6a7fedfa5abdab37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506386, "uuid": "647a7bcb-5ff8-4dae-9c8d-2bd5197994f3", "comment": "Malware payload (RatonRAT)", "value": "e04d1b86582998f563206d34a8221e4a88d42fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506386, "uuid": "74596787-6c27-4555-8bc5-de9ed8b60c17", "comment": "Malware payload (RatonRAT)", "value": "7c45038cf0d63801d28fd4673540ba7817950073cf0ecd9e5baccd6ed86ab0bcb6124f81d890371c79c198df7ee7e027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506386, "uuid": "56367654-7506-43d0-b6bb-3b1cef591e16", "value": "T1D98417A1369859C9E9BF4F7C957068A005377E773E6AF50D6D64BB0C0C323829864B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506386, "uuid": "07f9d0a4-cb4a-4497-b580-fd7aacaa00d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506386, "uuid": "b026e018-957f-46df-8a6b-dbb8561cf137", "value": "3072:xUDcQlehAX4tnOUWlbuKXw1qxyZnnnnnnnB:AcO2AX5bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506386, "uuid": "106389e7-8c57-4587-b79b-dc79fb8cad23", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506386, "uuid": "18f9a15c-2b6a-436e-bf42-9dff3721ab6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506386, "uuid": "b35ea100-6d31-453c-bfc6-38a5848d2e10", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f6ce45-1ff2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773526107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773526107, "uuid": "490103ea-706c-4704-8793-42a217070198", "comment": "Malware payload", "value": "635929a81db794f22577a0fdd10eeed0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773526107, "uuid": "d167f941-c9d8-4390-ae0b-989865c1eac4", "comment": "Malware payload", "value": "2630f5e7c3d30f63229b84855cbc9a96ede8ce028e3a438cc131a3528450b00a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773526107, "uuid": "683952cf-ac11-4853-a8d5-43910e546e88", "comment": "Malware payload", "value": "7c3caf709b3e96f24932fa91f4556b321faa78cd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773526107, "uuid": "5fa57b60-f44d-4fb6-9862-bcf95447e682", "comment": "Malware payload", "value": "7502400060d8bb8b23743aeb1d6c3f930f3dc7ab072fa8ffac5547da4b7759da24cc5a774be5ffece3074a54b598a5ec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773526107, "uuid": "4602e561-4ffc-4587-b52e-f77fcd55bdb7", "value": "T1CA57339AE0460ECAF03F94318BF8D58D86837C564E9B04ABB426725135F77E5E3B205E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773526107, "uuid": "ca4b1288-89dd-46d3-b2ee-6681111fa12f", "value": "786432:8TJwQGF6ijGMtajyqEAy+m7ZVAeqmEwBfYeA3qimJQl:8dwQGFzTiyqEAzm7mwmyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773526107, "uuid": "2697a083-c546-405b-a7b4-84b830f9d79c", "value": 28762112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773526107, "uuid": "b1b197d1-d26a-422a-95ab-3a43458eba95", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773526107, "uuid": "beab71ae-58cc-44f7-8a08-54218981e9b4", "value": "Installer resident evil requiem.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a6373f-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501867, "uuid": "0197ab1e-6424-429c-a9ac-f83efa3c7308", "comment": "Malware payload", "value": "499479fede486838856c842509bb29ad", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501867, "uuid": "3cbe2986-7bc8-457b-a87d-33ab5294f6b9", "comment": "Malware payload", "value": "282d83ebc2b79943c66cc4d8051a2a120da5ded69ffde6e810608571692b1dab", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501867, "uuid": "72257712-fc6f-432b-8ebc-61b92aa45370", "comment": "Malware payload", "value": "34b6b011b35aa34020d83efe6e4127c61a4af25f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501867, "uuid": "83fd710f-2eaf-4ca1-bc73-9deecadb4027", "comment": "Malware payload", "value": "8138398bb4f7f4367e2005a5088b33d64a695100ed48a9c27d0f226566cff80526d09489599f810f9c05a3af3645ff5e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501867, "uuid": "e2ea7dab-0418-4c85-b26b-8ac3cd2da379", "value": "T1AB825C6B8DC73F4757B05A0675ED2DD6051D47CB3482884ECA07DBC4C2E5B8A25E82ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501867, "uuid": "45ef6f75-1222-4c98-ab28-e1182f393679", "value": "384:vEwJhORmUhJKl8722GyZyZ6nFTx/Cmkn59HVsXOXQipItzyLyNv/qDvLMs:vxJMVhJrGFZWT5Cmk59HVKOXQipItzy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501867, "uuid": "6421fcf4-2c07-49f6-9fe7-de86e20e2810", "value": 18801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501867, "uuid": "05e68eaf-105c-4448-9396-28dd0e4ca4ce", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501867, "uuid": "faa231c3-5de4-4f95-af54-861ef1a27380", "value": "fitmoversuae_iclickfix.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb151cd-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773491472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491472, "uuid": "9fa47693-f456-4604-a357-efbf1cab023a", "comment": "Malware payload", "value": "f73c77ec31aeefc57eb93ad5903574d4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491472, "uuid": "2feb51c7-cc90-4804-ab1e-b90f2b682905", "comment": "Malware payload", "value": "283b34c5d64049f8908f17a4d7ad4a3c9cb477f6f6d741466807e892e0f4fb37", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491472, "uuid": "9c046685-9193-4571-b2e5-6906b973c01d", "comment": "Malware payload", "value": "0648d79696b25ecb2e06e16232c51183f5af483d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491472, "uuid": "81665e3e-a35a-48de-a57b-d5192cce4a85", "comment": "Malware payload", "value": "d7cd3c65595710386a9d5a15b8392670a7f6bc2aa0280db8c77d9ddef8a96326635107a456232d9e1a0289b6bae2b503", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491472, "uuid": "fb7956f3-a4b7-4bc6-aab2-6c24a0679a6e", "value": "T1DD082347E748ADEEE4F39732967481CA61174C744B83F7D29D5171B80AF3AC04A2AEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491472, "uuid": "126f66a3-a1e7-4a7d-b989-41263294298a", "value": "1572864:b7siR3L6Wtp/38JyL65e9sBa2bfwEct2vdbsBXAWQmiu5w:fsiRb6Wt1Ou4m8a20t2ShMJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491472, "uuid": "cc92bca0-a3ea-43d2-9727-66056221e5fd", "value": 77342561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491472, "uuid": "bd437e15-6d3d-4b79-903c-c42215f7e485", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491472, "uuid": "405ccba0-19f4-4db6-ad5f-414fa16a4c6a", "value": "MOVIE_APP_1773458213152.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9f2c71-1fb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773501209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501209, "uuid": "1c92d0f6-1899-4325-9698-50dae3a1453b", "comment": "Malware payload (Vidar)", "value": "0db151f70d2cdf45306297cc409ee716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501209, "uuid": "a9f60da2-9b68-4f4e-be25-a8699072dbb9", "comment": "Malware payload (Vidar)", "value": "28de2ef5b88de6675dec6ddbfa585a9b82a486d962acbe2bab8a03f2f8829d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501209, "uuid": "809fb9f7-6754-40ed-9aad-095b03c44001", "comment": "Malware payload (Vidar)", "value": "3dc1036cb24e67020b6a3b07d51594b646d28575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501209, "uuid": "eb0af851-cc32-4c3a-b3da-cf2ea5caaf6d", "comment": "Malware payload (Vidar)", "value": "63f1dc5c9bed4dd0b3242298e064ab5835e45cba160a5d8cd001f13f48c43aa438be90d8f7b540f3714b9707c2b9ee83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501209, "uuid": "3cf89f2c-5f7a-4513-af51-3076e261ae71", "value": "T184B57B0BACE859E6C0AE973189B656A27B70BC490B3263D31F90B6783F72BD05D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501209, "uuid": "9b56fada-eb0c-42fc-9081-db5f83509d42", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501209, "uuid": "81c83fb4-4477-4ad6-8cba-67702d52e782", "value": "24576:KSSPLrCwdgAlg+pH4f1k21OPWM9bxxnKG9SbBYLKw71cNAAIZUZtPXgxyEr:KSSTrCwdgAlgdfLseex39SuLKk9Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501209, "uuid": "5b45fa4e-c8e9-471b-99e4-9d2c79c491d8", "value": 2396672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501209, "uuid": "96b81d28-60ec-4ea0-9b60-fb1d45a018d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501209, "uuid": "3ebc18d4-e3a3-4ec0-83a4-bcf08d1d52de", "value": "nap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e19ef14-1f39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773446587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446587, "uuid": "c1edee21-0c2b-4cae-aff1-e608e3d335ee", "comment": "Malware payload (Mirai)", "value": "42f7874123e2043e075ab8c88bce2990", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446587, "uuid": "c039ded1-7ecf-4fae-bb36-4a8708a951f3", "comment": "Malware payload (Mirai)", "value": "28e9b342a81720cfe2c4f31ea72b09ff119312a98bd89bc9fc1eac84cfcbf3bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446587, "uuid": "56ec7595-f6cf-47f7-b3af-88e68381184a", "comment": "Malware payload (Mirai)", "value": "69afd4f16cdf9b7f1aa4255c900cc5bc7431c2e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446587, "uuid": "f226c422-2691-405b-9299-17218021e439", "comment": "Malware payload (Mirai)", "value": "50536a5334bc7bb93b7947f2676f9931733b431d2a7e14fd6db21954aeca41a02802efb18256d6022d277cb922d7d974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446587, "uuid": "b816b1ed-1ab1-491a-a5b7-d2345f5da716", "value": "T1FA935CDAF400DD7DF80BDA7B4463491AB631A3915A830F37726BBD53AC320A95D27E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446587, "uuid": "d87f11a5-0299-4a9a-9f95-a26c42bd4d29", "value": "1536:VicX1PrEER4nfNanjMTpMlRkRQNxpBflZwFJr2Ay8ts0ydbevat8emMsFoSnwDXU:lanfNajICRkSNxpBPoJr2AHydbeprUSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773446587, "uuid": "0552fb1a-f472-449d-a78a-9718b23fcdc4", "value": 92288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773446587, "uuid": "fa543972-75a6-4963-af2c-78d7ec40f18e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446587, "uuid": "73adf0f1-837d-4e5d-a505-c9125eac7712", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ddcdf1-1fd4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773513282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513282, "uuid": "4829007d-9692-4855-a17f-813fa595d88c", "comment": "Malware payload (RemcosRAT)", "value": "a606c3ff0d350e755d99f26420573bb8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513282, "uuid": "cc09cc88-4ea0-470d-952c-6623fbf3e1d8", "comment": "Malware payload (RemcosRAT)", "value": "2b547b9522e538f571eb9c03bb9d95eaf6d18e4ee9292654b9a8a01b94555ecd", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513282, "uuid": "d465fd1e-a690-4ac6-8112-131a1bae869b", "comment": "Malware payload (RemcosRAT)", "value": "3ae897d465cc3c3a02e0d0aa0cd177f7835bf74c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513282, "uuid": "11959cdd-b830-4d65-b954-be3482dd9916", "comment": "Malware payload (RemcosRAT)", "value": "e581f3f46c6940f7fc436a7619325c4f51e4a6345ef1fb508cd465a096437a50cb272942cd296b224ec4460368f054e4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513282, "uuid": "f00c86d9-79b0-4695-b89e-2cd2e713960f", "value": "T16D418C5523D10325E3A2CA3198B369A5763B7453FD01CA1D90F3028D446361DA569BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513282, "uuid": "7a1adaf0-d41e-4f80-bc0b-6cc36e38c053", "value": "24:8Tk15SddSBm1XuHYQn3E580Cj+7SxIGvMJO8Rzn:8TiSdQBkXuHt3W7T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513282, "uuid": "68fd9ecf-06fa-4aee-b364-4926e08f4517", "value": 2410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513282, "uuid": "1cc05fad-ee8d-4d89-b748-5c594c3694af", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513282, "uuid": "399254ac-8066-4029-909c-1fda2960736d", "value": "REFORESTGAL.VILAR-SL_NIEcopiaAusweis.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad2aa0d-1fbd-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773503516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503516, "uuid": "b77fb3f8-349a-4e4a-b4cc-aed77b8cc999", "comment": "Malware payload (SalatStealer)", "value": "50b8e4ef67d3ccc55a1d9a509d6149f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503516, "uuid": "9d8aafca-4946-4eaa-81f5-a060c3cd5817", "comment": "Malware payload (SalatStealer)", "value": "2bc1faa319b02dc4bae6c00ec584a6f6f8bf7549f6bc54b05d030fa886e033a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503516, "uuid": "ece8ed9a-2a7c-4e9c-b2a2-3d4feb6e8f2b", "comment": "Malware payload (SalatStealer)", "value": "3edc0262397f556baf8b069574d2adb3ef633262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503516, "uuid": "1e542712-01c5-41f9-8585-26f5639939c9", "comment": "Malware payload (SalatStealer)", "value": "8ff119f51f5525464fe1807818b7f57500a6fd160504e1281ff2cad3c502960a8f3578e1c48b3d454178dd061a153ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503516, "uuid": "d1b08fd1-e27a-4de2-b8a1-ea01a12a58bb", "value": "T101C45B12A6544DE6D83782F8C812C635CAA27C454760D68B17F0BE2BFFF76928E2D750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503516, "uuid": "9a121071-c832-4337-b49a-3607da5e86e1", "value": "80ea0591f480acb5ca871400d95d2542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503516, "uuid": "a1db68f7-6dba-4770-b166-4ecd65a72f82", "value": "6144:2L7EwQxCqIxGu4XF94oMZr5usNep9zivkraO2zJap:uYCqIxob4lZrM3dJ2zEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503516, "uuid": "2f67d31e-1115-49c1-a082-87ce1bfced37", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503516, "uuid": "995afe48-7818-4067-a70f-2926d4fbdc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503516, "uuid": "f696ff8d-571c-4a45-aa0e-7347c5353a78", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7448c405-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493949, "uuid": "e68397dd-193f-464c-9f23-56ea19747c0b", "comment": "Malware payload (Mirai)", "value": "e9c4b47a2d61f2b3fe2f8830d0de8057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493949, "uuid": "913f4b37-8ab4-4cdb-a9d7-68450c8e8db5", "comment": "Malware payload (Mirai)", "value": "2bf7d131a73f9909354a737ac00882ac1e48fcdcd549f13ec1008de6d703b007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493949, "uuid": "14e758a4-dc19-47bb-9b8d-2c441a1f7cd8", "comment": "Malware payload (Mirai)", "value": "3252ebd89cde822735376b8cf99402156549e85e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493949, "uuid": "02c889da-acf9-40ea-8162-3bf1f6ca031a", "comment": "Malware payload (Mirai)", "value": "acaad9e22b49e7b222414c258d6b20d9d31361279fae9fde570f61efd9382fc1112a3646d6caea86e53cec81fe9488ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493949, "uuid": "6afe4a7f-e68a-4baa-9c91-c51bda6a0ce3", "value": "T1B6832A95F9814B21C5D512BEFA2E118D3323177CE3DE72129D10AF21778B96B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493949, "uuid": "11aa667c-f965-4fc1-a8af-36c3f628de78", "value": "1536:4wnW6LltCc1HFiEfnA/vAa4Ww11Q2M8i6+fghe3U7AL5YGYC61d6dOO:BhtCUtA/vAa4V+fghe3UUL6GasO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493949, "uuid": "bd6755f0-054e-40b2-975e-422511b657ca", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493949, "uuid": "60ebd135-2ff1-4afa-8691-7f39773612ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493949, "uuid": "e7d3bd6e-c6a8-470e-b26a-2fcc665779db", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a45ea0-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493951, "uuid": "7f61e959-11e9-4fbe-8522-e70ab2c32221", "comment": "Malware payload (Mirai)", "value": "67bd7725084381696c047b05cf05aae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493951, "uuid": "da90ddb5-965a-4551-a6d1-d41e587aea5d", "comment": "Malware payload (Mirai)", "value": "2c19928c3cbee5115e5cf1fcf09975f0d1af047fc6d54ae195b251cfd0ecdbfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493951, "uuid": "3d40ba91-9796-4712-9df5-e263a16d7924", "comment": "Malware payload (Mirai)", "value": "893a60ad1b7b78132d94f883e63a1e67073a35e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493951, "uuid": "a4acf929-1875-4903-8a9e-0516c1cd3e66", "comment": "Malware payload (Mirai)", "value": "f3c068259381d79c4068ee6cb7d338090769633df5a9e504e87c1c30c0e9746dc5e36b749f084658a781debab4fba177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493951, "uuid": "c51538b0-65e2-447c-a133-1f6c925563be", "value": "T17FA30709AB650FF7DC6FCD3706E9070635CC651A22F97B3A3634C918B60B64B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493951, "uuid": "f4f65df9-1cf5-465f-bad4-5d562a70d694", "value": "1536:uJri55uEJPlFNjBCALbF88QUW/M1ms56XGZDQ+wbp4lx9LJxXY61d6cM:A+3uEJ9LbxW/w6XGkmRxX1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493951, "uuid": "079fa31b-e6d2-4ac9-8c2a-c7fe2426d58b", "value": 99560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493951, "uuid": "3a2a5b0c-61c6-45e4-8624-418a9d679fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493951, "uuid": "a9c87583-473e-4950-a3d0-60054f1d4e3d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb498166-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491491, "uuid": "a226d4e6-cc53-4e38-bebe-71dfd9c61f03", "comment": "Malware payload (Mirai)", "value": "477c6682f7c6bdc8416ba39bcbea550c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491491, "uuid": "b40c9dda-fe6c-4b84-9b0f-daa34b43e6ed", "comment": "Malware payload (Mirai)", "value": "2dc15b526f6b998a70b33ed68e63a595841f6ddc463d81e51bc756c4407d4d9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491491, "uuid": "fadd374e-1933-4aef-8798-72a6424b58f5", "comment": "Malware payload (Mirai)", "value": "b08be50e53e48158fe62fddfeed1fbf18f073884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491491, "uuid": "cf3c05b0-fe84-475a-a090-4d54613dce14", "comment": "Malware payload (Mirai)", "value": "0ad42b585f4673734b4cd5d891b72e9ba7a6030ff3f4559351e45a5d3bf025cbaab14826e4477b87ee82ad2782107146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mpsl", "colour": "#F498C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491491, "uuid": "7c6ba0c8-7c74-4791-8d01-99ced823470c", "value": "T116F44A03AF405FEBC4AFCD30492EC65711DDE9C756C5A62A71FC4A8CBA9D25A0BD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491491, "uuid": "0635cd68-1bf2-4278-b074-77669ccce85b", "value": "12288:LiAaVeSgT3W9lD6s7tF6cxFyd+jrB57ztaq7ZwwMEFl/5X+qaPagq9lpXGIo3veh:q7r9kmGu7U6GwMeEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491491, "uuid": "864be201-03b4-4384-84f3-f1024174fe63", "value": 753396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491491, "uuid": "e807f63c-f082-4089-8a31-39b535c31ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491491, "uuid": "0e51a16a-1e5f-49f2-a652-84bebe3b1ff8", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79be721-1f4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773455488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773455488, "uuid": "ee74d341-4bb0-443b-aaab-d4a587441efb", "comment": "Malware payload (Mirai)", "value": "8d2e19635afcdb50aa58714860e1efc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773455488, "uuid": "e346cee7-ce3f-4967-ba7e-c3bee1220863", "comment": "Malware payload (Mirai)", "value": "2e8c0d6dc54e6310e4aa63f49e31ba48cd2d42c5124e703a9bc4b0276f635c3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773455488, "uuid": "fee94048-0904-4e33-abc8-c55b333099ef", "comment": "Malware payload (Mirai)", "value": "7f9d6a24f8b46994500ded4875069f0e1c6dfb95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773455488, "uuid": "5b7844c0-b4be-4db2-ba4d-ceba18cecb34", "comment": "Malware payload (Mirai)", "value": "d635cbdf5e0b2447027da36214225e8c29bb04e9afde8cc93c7c2af08808e87ca7c34926f7496bff0d7ab1a19565df85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773455488, "uuid": "18735dff-4d60-4a5f-892b-8f3682653c85", "value": "T1A973AE32D4166E94D1844A74B4E4CABA5763F90495832FF699A6C2F99047FECF20C3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773455488, "uuid": "8da13ebf-7b80-4c6d-a279-0ccd3c24d961", "value": "1536:zAtvwyVL3gLbbN2xok0OBK3kfFKA59J7l8aVC5ZQnH7yxw:zYTAmBK3kfMAJSaVBH7y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773455488, "uuid": "fb8f3f32-a022-4fcb-b674-384752dc6b67", "value": 79120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773455488, "uuid": "5ad67395-cf6d-4e24-9cf9-4636caa665ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773455488, "uuid": "b1f895a5-9dbf-4731-b5e3-f69cb2a6fbdb", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62389b22-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506374, "uuid": "90cbf0c8-dad2-418d-a0bb-7520e26d0ec3", "comment": "Malware payload (Vidar)", "value": "2f71ce7b82a3b9658887fffff8f7fdc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506374, "uuid": "3633a779-e391-4b10-9b4c-402b57654829", "comment": "Malware payload (Vidar)", "value": "2f1f27aea6326434f1c4700ea66b4fc729103c69b7e8b14a6cc69239d54fc310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506374, "uuid": "ea154a96-5ce1-46a1-9162-db48feb0c4aa", "comment": "Malware payload (Vidar)", "value": "0eca50661224fbca0f3490f69b572559ba87f91c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506374, "uuid": "026f4a4e-a655-4c55-af7a-737ac31b14e3", "comment": "Malware payload (Vidar)", "value": "3c09e13d18d4a809cdfcf3749e0eda031c063fbb8b618a6f60da5b4983d6491b2644a0ceb51446b93dbe93d217434e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506374, "uuid": "57e37765-e31c-49b1-bc1b-8b41a02bc377", "value": "T13224124A41374DA2E4DF50B827E840238A4865BB7F4E358438B8179A847DED5DF1DE87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506374, "uuid": "bfe76b93-cbe4-4a4c-82c2-67abc8a07754", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506374, "uuid": "43156da2-cf9c-4ca4-8009-d459757be7f1", "value": "6144:BhJdXXtPqr2ztW5L62zrVlORNc78ZTQ76M2:nJVdi6xWzZlORKQZTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506374, "uuid": "f5058de8-24ff-4c1c-b128-b0ba7c77f4b3", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506374, "uuid": "06b3bbd4-d61c-4267-b739-1b0be1700d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506374, "uuid": "8fb1a80b-ed6e-4c8c-9ed0-d8e2e4f74de9", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de13d1db-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773501858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501858, "uuid": "c141e9b4-0b98-432f-934c-4cf675a8482d", "comment": "Malware payload (NetSupport)", "value": "e7a170b7dd2d72d769ca6b456d0668fb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501858, "uuid": "4751c344-acbb-4e3b-81f7-3f71f9d29f58", "comment": "Malware payload (NetSupport)", "value": "2f3f5721674bca6bf2b73760e7f925fd10baaf3009a46ba8ccf79ba23bf8a6cc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501858, "uuid": "c69d095b-1e4a-4447-a152-1aec1d08acdb", "comment": "Malware payload (NetSupport)", "value": "6a4535238f7633b9339e4d9b697c2dcb5fc882a2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501858, "uuid": "8d578444-dcd5-4e18-9033-0aebc676271f", "comment": "Malware payload (NetSupport)", "value": "b3a26a86290b68e75faa6e2e0ae586509257898ea1053070912002df6eb0f5a3c1940a6e7a5080e719c7c93302e9d74f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501858, "uuid": "61ffca2b-7e92-4d07-afc8-e05bbe7996d0", "value": "T1F08195C73160415489D3CA82D2DFE78A774690CF066E0EA43D8CE5C22F316FA8F63686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501858, "uuid": "074cb921-5746-4210-bd0c-acb29c0393b8", "value": "48:SjyFWtn00b5MXqhj17MbrtHHIOpFLZhuZ9brtHH9leyeb8iyWftTVbEL+yeDMCyw:SjPV717MtIOpFLnGtegWfttvwGPHuLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501858, "uuid": "7b9c9443-37b8-4b52-a849-e23355896f79", "value": 3913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501858, "uuid": "aee4a221-5bf2-4840-b161-b684be3bb5c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501858, "uuid": "ccab32cd-a09d-4ba8-bbe5-43ff349c59c9", "value": "gosidefastandpure_netsupport_dropper.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ade8642-1fa3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773492296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492296, "uuid": "1f0a5c78-820b-41b4-a64f-0fd9dc877847", "comment": "Malware payload", "value": "b334b95d269f40d1fafb173bb4649831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492296, "uuid": "2f152391-90ff-4d53-a1f4-d3dedc1cb66a", "comment": "Malware payload", "value": "2f8bb95837f68b34f30ae8a1e06342a4249d13db09188363e73e3f5190b85408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492296, "uuid": "fbcea29d-02f0-4a98-bd7c-43f90c694b89", "comment": "Malware payload", "value": "4b0831973cfebed7a8b32476a2b3e12eccc12df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492296, "uuid": "7610b189-9582-4fe7-ad15-93e0f9fd44cb", "comment": "Malware payload", "value": "69cf87b3a23c144b2ce221ccf75fe83620f52de3b5310e3b5ccc7c5184cc95852507cc7ea7013e0e1764257814c4b02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492296, "uuid": "c4e5399c-51ac-46e0-99f2-b05e7b78bc32", "value": "T1B4D20A4DA3DC8223E66F5F7D6971414A8B31E1279851F28F38CC59AE3F633829542397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492296, "uuid": "e67888e3-6f93-4943-b675-4f11a18349f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492296, "uuid": "600a6d06-814c-416a-89d9-d5bfb563d523", "value": "768:V+ZMqTvEEeoiSqMomEdElj1g3+VJeV6lc5tuYsxYho:iMLhulxg3+P66zYsxmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773492296, "uuid": "890e7f29-871a-4881-99c8-dff9472338b6", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773492296, "uuid": "aa941bf4-a395-4d4a-9e31-a2823cb1bc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492296, "uuid": "8bacc5cf-00e6-41f1-8908-b14f7df171b6", "value": "AdobeUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26bc210-1fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1773506106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506106, "uuid": "dc06ae83-dcdb-470a-a567-21497e3f5703", "comment": "Malware payload (ArkeiStealer)", "value": "cadea484d0c00ad818db1d7afe3865db", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506106, "uuid": "2b900776-1a32-40ba-b152-ee4af17ad4d5", "comment": "Malware payload (ArkeiStealer)", "value": "2faab85d58733d27037720a9696a5d858ec8214e5fd44e6deff7cd18dc5fd4a1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506106, "uuid": "ed0ec47c-dcaa-4fe2-82dd-75e004508b25", "comment": "Malware payload (ArkeiStealer)", "value": "2a1ca4290c4590836860f89cf21097e68ae27913", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506106, "uuid": "b7896df0-98b1-4277-b495-7c6f35bff133", "comment": "Malware payload (ArkeiStealer)", "value": "be0e92befcba30f154b36985cfbf73ab182cea7bd7597449f54d1f53f3b8e8414b6702861edee5775850ac9f9ef5982b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506106, "uuid": "5f307900-8b23-435f-842c-45b7e815bcf6", "value": "T11CE4F11279E5C032E1B3527251A4F22005BFBD724B728E8F27D91A4C0ABD5D29F66F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506106, "uuid": "f154a50a-90e2-4d8b-a393-2faef76db5bd", "value": "07d37e75d9962cab799fa02f76aacc42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506106, "uuid": "99917978-5317-4b0d-9242-749927c8865e", "value": "12288:oO2gpHgluZS/Poh4MmN8qUWNKmHkSFbRY7oOaUsgBSpEdGc/D/1HxOnIeYuxlypl:17pAlhRN8iNKmDYVsgBUCP/pInfgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506106, "uuid": "38dc9b03-495c-4927-b5b5-e661ec41332c", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506106, "uuid": "95b1c544-14bf-4d42-ba6c-af1cb3d5087a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506106, "uuid": "d91dfa8e-4e79-4ead-b905-57b57fc06f57", "value": "x2faab85d58733d27037720a9696a5d858ec8214e5fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57823eb6-1fc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773505497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505497, "uuid": "c73a6839-0041-4c89-8a90-4d794ea083ae", "comment": "Malware payload", "value": "4b5a1b05c70bf2e63e03e037e6718ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505497, "uuid": "094b6a1c-2aa8-455d-b147-9814dd26f4fc", "comment": "Malware payload", "value": "2fc7359e91781e8f18968a923e54e44265e9ea9d984af99e5320a5f341ec3d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505497, "uuid": "84e0b394-be39-4c93-a011-fbc8d0804c32", "comment": "Malware payload", "value": "7082e7f4a9e7708808a791e69b5f3218ec688f26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505497, "uuid": "ea833fc1-e535-4900-829b-cf6e804579f6", "comment": "Malware payload", "value": "d3c7f7db9e70323bedf95580287189f21e69e3199afa2d450b3da41cd759498778ef2754e240e2e20657a99c4dbc27ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505497, "uuid": "a18aae56-ea89-4b32-ba9b-e9e0f35798ee", "value": "T12B187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505497, "uuid": "7a4d7f6e-04ca-4c75-9f2a-38e3c5963e77", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505497, "uuid": "d20015e0-1da7-429b-b678-74d561882826", "value": "786432:hAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:hAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505497, "uuid": "55934826-fad4-4c1f-8f63-db66f2c6c193", "value": 90260480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505497, "uuid": "742c141c-49ba-4d4c-aa9b-d4de0aea6268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505497, "uuid": "85c3a5f0-f386-483e-9501-5a3a0f00ae45", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1613109a-1fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773520420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520420, "uuid": "fe659e04-f0d8-4ad3-8258-30de2cc0ad64", "comment": "Malware payload (ConnectWise)", "value": "69eaa79a53733fa4575420173f585d76", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520420, "uuid": "38b1c209-1fd4-4689-81e5-7ff8ca4b6f8d", "comment": "Malware payload (ConnectWise)", "value": "302a9f9af9eda01fa968e300725a84252cb06c75f2066cd843222b64751a6956", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520420, "uuid": "1d641ebe-427c-47cf-a2ce-1d1ef5d80a5b", "comment": "Malware payload (ConnectWise)", "value": "bcd270473d9fc8a3a774a550053e63a10d3d217a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520420, "uuid": "029d29af-d354-4a25-81c7-84e263c0db69", "comment": "Malware payload (ConnectWise)", "value": "2ff9f95a92e3a00ba660f915a6017f17aef4c522e3759135d34611190c4e1cecca58d5e9a5763755e966098d3c140b85", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520420, "uuid": "70e341d2-d735-4516-9b71-25c9c391bbed", "value": "T1A00723328F30FDDE077C7124E06A2F1A2EA00B939A75969DDA4538A7095D781DF5F82C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520420, "uuid": "27b8866d-f88a-451f-84fa-dc672b4d68b1", "value": "49152:PLT/r0qZ74qQcR6okNRCdjPmRoJCZqK+203xkUYik7vwJzac7RkhX9OcrO8TmIV1:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773520420, "uuid": "2d644436-38df-4c25-841b-6d536f3de811", "value": 18051856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773520420, "uuid": "24b8face-cd07-46dd-b919-7fce597dc675", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520420, "uuid": "84bb0231-1b9d-43a5-a439-706f2596636c", "value": "Z00MUpdateInstaller.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855e5eeb-1fdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773517171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517171, "uuid": "925823d8-eaca-40e6-8140-b33280dd74e5", "comment": "Malware payload (Mirai)", "value": "bd8d26402b05dce1e789bbc6c00094c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517171, "uuid": "3275b2ec-7252-4da9-8b2d-ce94da044e2e", "comment": "Malware payload (Mirai)", "value": "312e42ea7b8edb0a61355c50c3c02a91cd5ada0fa6baec96ebd8197db2ea754a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517171, "uuid": "12493181-d6a0-441b-9c24-86fdfab3daf6", "comment": "Malware payload (Mirai)", "value": "42c5ec040f99c7ce344a3d9d252e3cb325c027d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517171, "uuid": "47c1c88a-f6d9-4d23-a144-0fe50c270875", "comment": "Malware payload (Mirai)", "value": "ab7c88ff78908cd377c90e7f20cee9915a8628f9272c0afdac52597b108f1173da5eb8eb7d627f7c17ac29594864600e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517171, "uuid": "fe0f4d4a-06f3-4921-b24c-544ffef61d8b", "value": "T122E3F981FA43CBB7E44B07F001B6AB338531FC3A542BE686DB74FE6669619C0E615358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517171, "uuid": "d8e31acc-c46a-4365-92d4-16d9aea192df", "value": "3072:cn6lWv/d72ljoBrEFUggXnOfRYETeFw4kLEiYu1v+Iq4PkI9VGTYW8yfVTEyvLA0:3gv/d72ljoBrEFUggXOfRYETee4kLEiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773517171, "uuid": "7647981f-688f-4e00-b37a-0d455362e812", "value": 150624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773517171, "uuid": "cee9e11e-7f62-4678-89fd-742b1e54f530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517171, "uuid": "ed217573-efd5-4088-96b0-4d38ae16dec3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc9f288-1fb3-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773498981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498981, "uuid": "66cfcf5f-8bac-4e84-9573-6a349df41a1d", "comment": "Malware payload (LummaStealer)", "value": "e6ac1b022a6415277504a7d94156f8dc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498981, "uuid": "12c1d3ec-d870-4f90-99ce-91de17010576", "comment": "Malware payload (LummaStealer)", "value": "315e1aa6b6aae26f189bddc5ba32baab8509c9d204d282c3f1b49d284b225aa7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498981, "uuid": "85f1f9b6-24ff-42b1-ab42-79ae350750f1", "comment": "Malware payload (LummaStealer)", "value": "9c69db21e726b7b854b5780a3a93bd4b99f57d78", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498981, "uuid": "0a2a458d-031c-49eb-ab2e-0a24df793cf7", "comment": "Malware payload (LummaStealer)", "value": "0a40e99aabfa6f820d46d22c62d4ba271d367e0571d5cac9e2115053aab8f729704604fc5cd5031d41a5c69ddfe5f56f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498981, "uuid": "853062dd-525a-4ea3-aad6-b8d7ed470f3e", "value": "T1C3854B00FEC794F1E8061A3259BB63AF273998090F339BD7EB403A79B9762D10936755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498981, "uuid": "40a44f8b-58e3-4133-9280-34928f83ad3f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498981, "uuid": "931328b7-f687-42ac-a057-5305b05459f6", "value": "24576:Y0gXapB4oKjQvLsTeqalT4hcON9YZJiu5iba3YEzu1dBW5EC6I+RZnnnXIC+HX6J:YPA6ohaSWdBW5EC6IQYC+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498981, "uuid": "81fb19a0-47c1-4cd8-b685-7650c9b80a14", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498981, "uuid": "6faa7c84-e3e6-4db8-8fc8-e627a586c97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498981, "uuid": "ed191f2f-bfb7-457b-ae3f-c0b0713ac7de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130f355f-1fc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773508389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508389, "uuid": "069e1f9b-7316-46b5-bb5a-c102a240cb9e", "comment": "Malware payload (ACRStealer)", "value": "3a7c5c133871117d6aa318597f17cea8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508389, "uuid": "daf59a01-cfca-4dc5-89db-caf1e9cab8f8", "comment": "Malware payload (ACRStealer)", "value": "3216b475687aabac89ff151cd84b4698f5b40cf3ea7c1922bf2bd1066d1a2317", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508389, "uuid": "0f31d25d-bdda-4db5-8e57-f6c507091c8d", "comment": "Malware payload (ACRStealer)", "value": "f0072542fb51b336a010347cc653f23b885831af", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508389, "uuid": "6f962f00-1197-42e9-ade4-2672d6668e73", "comment": "Malware payload (ACRStealer)", "value": "f1079691bebae5e0a710f3fcbddb6f9f7004e4f969dc3378fc0ee485b685015b76d93c53a2142eecba19d9bb86727db6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508389, "uuid": "fdd0bc06-06d1-4113-9ee8-94102c1b608d", "value": "T182755B1A66EA41B6E2AA413C8557564FE37374606B31C6DF83A8C67D4F33BD0AC39B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508389, "uuid": "9cce3e69-8ea4-412c-b484-396242c05557", "value": "4fd30c09bb847446c8025f1f1f68cd10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508389, "uuid": "d2ede5cb-1578-4945-8946-5e0de2e5f773", "value": "24576:xWjHtQJQNoMnDocJeLvp9bosg8wUjEBkKt8ipUZu9h5bQUg5hecZ6V7EXCK1pCDw:qG9Pbpu9h5vuhzZ69EjsWo0Dr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508389, "uuid": "23747c6a-e056-419c-b9ab-9da50414f13e", "value": 1644032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508389, "uuid": "c3375327-1262-4ff7-9880-019c21aad591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508389, "uuid": "def0b04e-8eec-47c4-809a-92d3e32cf964", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b179ecf-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773505181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505181, "uuid": "6dc45e02-3a06-4def-9e93-85d5f64dcb80", "comment": "Malware payload", "value": "25c9be619e0da2c0cf1f43170774e1c7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505181, "uuid": "a1709f56-273e-42c3-b366-6145031cef12", "comment": "Malware payload", "value": "3266a74c653f1c93ef4ed5b671a46da0a7a4f36519f78ca55ad75d395734c695", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505181, "uuid": "743e2bb8-888a-4832-a7a0-5664877ff98e", "comment": "Malware payload", "value": "1eb699491ddde894e5d0d70cf32e895a306d77dc", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505181, "uuid": "d45d87bc-f8e8-434d-9ce4-9a9e53072828", "comment": "Malware payload", "value": "e09b1632c00b8b27c5bc0d1fb820c1f9281f024aaa075270a92f28583879fb178a12cc8915a39540a6f3c15a18a56264", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505181, "uuid": "a677ed1d-0ef6-45c0-b3de-6b5fe1bba63c", "value": "T1DD6423DE9E30EE2C4950E77D06FB7ABD436F65649508370BB2C8890297CE7202D6E8D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505181, "uuid": "0c6cb4f5-8d4c-4f43-b95c-e4bfc04714d0", "value": "6144:FpzZeU2Fy0kwx7vnH+pdxkv6t4dJ3YtFzkkuWwS:PzZ/DqBH+pdxpUYtykug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505181, "uuid": "10fe6e6c-2d6c-4ac9-bf9a-2c346e89b814", "value": 321125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505181, "uuid": "39426571-1462-4959-82ec-6f206507c4d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505181, "uuid": "f2c487ed-b294-4b5a-8eb4-46ce7e373d58", "value": "3266a74c653f1c93ef4ed5b671a46da0a7a4f36519f78ca55ad75d395734c695.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110fbdf3-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486481, "uuid": "15dc1de7-930e-4ca1-a057-2cbc5daf977d", "comment": "Malware payload", "value": "26593a5f264c7e81f93ceb1f29314bb9", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486481, "uuid": "84618130-bcf6-4bb6-9102-f060ce708cba", "comment": "Malware payload", "value": "3277c7a830a3705e8c99b1c28ccb1ccb68c9d8cf77150c270326b8b96982815b", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486481, "uuid": "a280d7bb-cb34-49a9-ba99-043465423c3d", "comment": "Malware payload", "value": "07a072ae7d2ee8ec21e1ea2bc4099c76821710d3", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486481, "uuid": "56351a48-d158-40eb-82b4-4899a85c1ad8", "comment": "Malware payload", "value": "cb20a388e42653fdfdf264df81db72c7e49b3d34d86eb3548a8d99a09aa999f40b3360660b5c02ff782aeaf1b4e52c14", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486481, "uuid": "ccdbbd64-7a6a-4339-b6a4-dc0b871fd763", "value": "T19FE0A3395B3AF4C4434AB06055049D9921913927D7BD5E5FF92219A96D20794EF0F14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486481, "uuid": "b8a6d7a6-8084-4c22-a6d2-d3addcc4319b", "value": "6:s8bloOVsukO6hu2Un8Cu1760kTZz0g6eMiNQhkac/VZgkznKqr/q16Atap4:s8hZGrO6huJA1fRguua+ZgkzKq+P8p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486481, "uuid": "2e576618-885e-4bf2-a461-caf2e451d826", "value": 433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486481, "uuid": "f7dd11a1-ee49-4764-95f4-2e40884f0b12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486481, "uuid": "73c1f652-07b6-48f5-892c-464cff4e76ea", "value": "12ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db85598-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773486476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486476, "uuid": "ff7834b0-b6f5-4f07-b0a9-29bce6b22499", "comment": "Malware payload (Phorpiex)", "value": "51384dbcbafd55389292d443b2a13ac1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486476, "uuid": "7afca5d4-f393-4806-af29-23475ecc1985", "comment": "Malware payload (Phorpiex)", "value": "329080a95db1014599344f3158c57148613a03e8210c68a7670ccae2e170c303", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486476, "uuid": "dc3e569c-ee4d-4f14-8f29-18e9617021e0", "comment": "Malware payload (Phorpiex)", "value": "8e579b106b1ecda2df28868a9e2ae79b36358c53", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486476, "uuid": "0debd204-b71d-4707-a61f-9b4df88527a4", "comment": "Malware payload (Phorpiex)", "value": "52ec11b518ccc34ca671a947a2651e0586fdf7adf44b4207428bf306daff995e237780c5be55dccb9d4e4261e1c91a7f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486476, "uuid": "8c529048-edca-4b55-9a11-99b8418751fd", "value": "T16EF13B06AD928072D3EE09F417B581994B7D04533BD620FFBBB2C95A0FD42C0945267A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486476, "uuid": "6a374769-37af-4940-86c2-012c7ebe9ce0", "value": "7d043fa7bcef8cef39f98c88b1875ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486476, "uuid": "be630c12-ed37-48af-8d4b-8327fc4600d2", "value": "96:aioLDBPbdRyD3d9LT+YmACn7wcgNOwQL7aFJxSEj2FFp3C7tCEGMuHNx:foLDBPQJ+e4sN8aFJx3jmFpcGfHNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486476, "uuid": "34b5bbde-a463-4509-9aa7-556484acdbad", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486476, "uuid": "6bf18709-a23f-4f34-8c14-6e552916df38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486476, "uuid": "2ce487b9-15ca-44df-b6b9-ca541433e481", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c00fb98-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515491, "uuid": "b568f3dc-27a5-4a58-b60d-1b71b21cc85b", "comment": "Malware payload (AgentTesla)", "value": "04d7315cba675ca81ee9750cd5c38f16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515491, "uuid": "14731a00-18e5-49f9-b06f-40fed7d07b7c", "comment": "Malware payload (AgentTesla)", "value": "33ec2d1e08678767613cc5f223090db4db6fcbb030c435138e8040462212ff88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515491, "uuid": "706809d6-b4f3-4f39-ac85-0b6b38c09f48", "comment": "Malware payload (AgentTesla)", "value": "db2ebc2dcb780a4824eade51b2b8ecbb94fb659f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515491, "uuid": "42d18e1f-c67f-41e3-8586-faf84c24d1bb", "comment": "Malware payload (AgentTesla)", "value": "ee4561b5fcaad2f278e124e8273a2273053f44502c3359220cc1b4fb3ee7668cd4df6f596d97215d111a105520b66af5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515491, "uuid": "c4011df8-35a7-48e2-9ae6-98d800fc2679", "value": "T126655C04CA899FD7F10C1F6B63BE0E97E2F00E655EC3298D7FD1DA9919B8A51038D261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515491, "uuid": "ef3fa8bd-372b-4241-a422-4010f25cf110", "value": "24576:hRlrasb8IcsJ2yU7Kf+ddsb9x4TnsLuFCHU:vBlBjLuFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515491, "uuid": "71048ff8-548d-4512-aed3-b62082a4081a", "value": 1420227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515491, "uuid": "31530957-3c2e-4f6f-9fc9-7703d21edb72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515491, "uuid": "88bde3a2-2a02-4323-b4ef-b2adbdc27654", "value": "04d7315cba675ca81ee9750cd5c38f16.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a92358-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477443, "uuid": "68f73818-2d08-4b80-868a-279f2df625c3", "comment": "Malware payload", "value": "cf92034bec9c6a9d98f2b3943400bc44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477443, "uuid": "43f4965a-fd66-4fa4-9d86-e403d30a4590", "comment": "Malware payload", "value": "33fa4033899c47316bfbc56f491c41c02007fa279e708f13ec3de3cefb1e7b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477443, "uuid": "833c4d27-6544-419d-82e0-75882b247441", "comment": "Malware payload", "value": "afecbe22b41fac343e6e81dca8d4b40740bad533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477443, "uuid": "f53667af-b4b9-4a5e-810f-7039873bea93", "comment": "Malware payload", "value": "8e7ea0999dca8ca89f42ce56bbbbf0e29662bff9683375c563d34b3cd2fb81eed214be4c2aedac9c6c4cff2175f3e19b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477443, "uuid": "4b25b400-80de-4bd7-9a33-7e360e76ea19", "value": "T175460955ADC22F66D6CC137486ED675623603E454BA2073323A4FBA83A7733C9F5688C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477443, "uuid": "7464ae58-fb29-4520-b036-a62c39c51523", "value": "24576:DUbltto9YJamM7OLtx3dVo0bXuM7hs9g/9JOW3rWfDHubmxpkKkoVqI+R02GShze:UoeJaP7O7o0ZAgdWfjuixpkVA+W2GSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477443, "uuid": "48000c39-4efc-45e8-a84e-1196b28ac19f", "value": 5832704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477443, "uuid": "1167d835-4c29-4c6d-b6e6-d9d6c8f89ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477443, "uuid": "35b2c033-69c0-48b3-bc77-c4296d7f7ab4", "value": "mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760d5cc2-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495241, "uuid": "82f534cf-7cf9-4d4d-ab18-0d92e32475ce", "comment": "Malware payload (Mirai)", "value": "f9d6153a6b6b2e72737573c3d27ba231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495241, "uuid": "7801c127-e885-48d7-8af0-042522a137e2", "comment": "Malware payload (Mirai)", "value": "3479c8d03a7d08c3afda0a1a6ad119f4c048eaa974dee1f9840a6f37a1a1f70f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495241, "uuid": "5d28657f-f560-4045-9db5-19473468477d", "comment": "Malware payload (Mirai)", "value": "5af7431cbf16afc29f8e27011547d6e07ee7481e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495241, "uuid": "232f344b-e360-4b3c-937f-0cc19e6640fd", "comment": "Malware payload (Mirai)", "value": "5c96549e7e6d035dd4eed2328d8e6c0c7b4621062cc6b9afe9e05b495e7091d614ab1433259653cef72ebf0c1dbdba04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495241, "uuid": "54a99773-2b33-4228-9331-5e056c82056d", "value": "T19FF2E1541722029DE53349BF1F4B2BD12D6B2BF21D53BD0AA841E8E6EDDE27DB8121D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495241, "uuid": "ae21c472-85d7-455f-847d-d8b6c9660f20", "value": "768:ylWqYyhCgKf+Mz7AtAMi9JM/FRBHhfJgGlzDpbuR1JQ4:Jq+gNMzQAHcZLVJue4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495241, "uuid": "25f0ff75-ba70-4d66-848f-db57966f192c", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495241, "uuid": "94918036-d7bc-401d-a869-1cc67ea0a5ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495241, "uuid": "b0990401-e7df-4352-a7f1-4db73e907e2c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d30e04-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516227, "uuid": "c484c6d0-64e6-4854-a0ea-eb7cddb21334", "comment": "Malware payload", "value": "2026f766656dccb9db4999368eb0828b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516227, "uuid": "af6fcab1-c309-495c-8515-62f6cb3aee65", "comment": "Malware payload", "value": "34a86aef213adbbaf88f0432ec63df4ba6b105f78e813f400a464e7cdcab99f1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516227, "uuid": "56c65bc7-dac2-4c47-96c1-61ef7bf35fbd", "comment": "Malware payload", "value": "6410f39a1dc92d1fcb74bdbe64de827f01015551", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516227, "uuid": "01907878-afad-4afc-aae4-55b88d78e438", "comment": "Malware payload", "value": "64294e8411383e077164d1969a48b4f29a0777bdf289ec93396bb6df218a8d867549cd0baf5be09aada18541aac8cd20", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516227, "uuid": "4bd75e89-95f7-46e1-9f62-df032ae539eb", "value": "T1AC458507AA2995FD5C62492690D07D96DA6E370F0D6569A9E0DAF22CD3ED0CCBF7C030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516227, "uuid": "0b2859dc-c876-4a9f-adab-54a3adbba440", "value": "48:RuL+zMABRXz9UKfxWy1SxWAEAKFtCENGPECnlCQGAm+02vXC:FMABnHbSA2KdNGsgHG5U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516227, "uuid": "e5f37c4d-051c-4074-aaca-ce48c8348d60", "value": 1247109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516227, "uuid": "fadb21ef-c0c3-4f11-beb7-ac10c1c4b5cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516227, "uuid": "e2716cf0-69b8-4909-ae5a-b722509337e0", "value": "2026f766656dccb9db4999368eb0828b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8b4be2-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495228, "uuid": "6b70e73f-23af-43d6-800f-3ccf226964ec", "comment": "Malware payload (Mirai)", "value": "b049296a229670651ca8fec1e813875e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495228, "uuid": "dc3189b2-6bb1-42d7-90c0-14736aebdd67", "comment": "Malware payload (Mirai)", "value": "36b8b8dcd2af53779f2609f3d13a097fe559a2ad7e3199255ae4051eb8d5b047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495228, "uuid": "bf461778-3e7f-4c83-af1d-3323e1e55879", "comment": "Malware payload (Mirai)", "value": "0536b7f65fe60b4b6a2cbc587334cbeb04de4ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495228, "uuid": "87d2e16e-9538-4aa1-9666-b2174a38a62c", "comment": "Malware payload (Mirai)", "value": "7f2b1514d859b4daa2f81ee90db637bc14eb84ee8344fa9853f329bd6619a17ae5c6dda93c4b6c7a92795c8f2315ccb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495228, "uuid": "bcc64cdd-0faf-4c91-8c64-f3a29c47e597", "value": "T15D932B52B9828E11C5C621BAFA6E418D33137F7CD3EE72128D20AF9137865DB0E77616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495228, "uuid": "369b8e64-1fe9-48cc-af54-96d490329d4f", "value": "1536:Wan51rMDhp4L94u/W6KcpYiwqddfaZeRy3CM7iIyGSXZy7tI54YLl61d636+7zx:+X/8xpYQddfaZnyGSXZyBIyw4Kpzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495228, "uuid": "874f388a-984c-4e69-bb90-2a0921186599", "value": 91388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495228, "uuid": "2fafb174-a00a-42ed-b441-0768e025c325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495228, "uuid": "ab08f692-9f3a-4878-ba4a-0bd9ebdb06dc", "value": "byte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc85882-1fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773504808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504808, "uuid": "d76c7fb4-9f1e-4995-ab85-f6972230905a", "comment": "Malware payload (CountLoader)", "value": "1a5c8ee1527a3f585a523d737002eb01", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504808, "uuid": "e0b2eabe-fe25-4679-b9f1-6528e3d18058", "comment": "Malware payload (CountLoader)", "value": "36cd729674787b8d7fc0830779afc98eb5958c3e07d4cbad0d0dee5c50f70a56", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504808, "uuid": "0a005a6c-bb85-42d8-afec-241f0b492629", "comment": "Malware payload (CountLoader)", "value": "213590a66707df4db42f65dbcb3cd08c2eeadd9a", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504808, "uuid": "4df8abf7-06b6-4659-b762-03562d878c13", "comment": "Malware payload (CountLoader)", "value": "b565411eda1fd2f04eda5cbf6d972d1294417a4501e8c4bedf5e0f942a94cc337f7f5b5a2b24df9cecbc4837b01b52d8", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504808, "uuid": "c2ca548e-1f1a-4082-9c18-93a6500240cd", "value": "T17EB3FFCA098E88EC875F2429451F9D07DADF5213062DC5D47DDEAE463F32DE8B0A6AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504808, "uuid": "9a8cb340-7655-46f5-a61c-7469888a1d0c", "value": "1536:mUJQkcvjp22CQtN6508/7E2qJjctvAcWjpy63mJlKLEOaTymiLu/:4jp22CQtNq08bqJjcts3mJlKLEOaTymV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504808, "uuid": "1b95625c-2f24-4cae-bdc9-9225a03d1f7b", "value": 113525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504808, "uuid": "38cb3077-8983-4c10-94cc-18d86fcc428a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504808, "uuid": "5537f3c3-5c97-42bf-8a77-e17085ddf815", "value": "Marketing_Core_Report_295.mp3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46c8365-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515505, "uuid": "d06f54cd-ebd7-4145-9202-7ec65ee396c0", "comment": "Malware payload (AgentTesla)", "value": "93daed4f48230c436a90fb530a3bd038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515505, "uuid": "6c9e7cc2-69ec-485f-8b4c-663e0a97792c", "comment": "Malware payload (AgentTesla)", "value": "380a95702aaea93a380f83f836ad1924c49dfa5fb6a0750c48cf595ccdaf12e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515505, "uuid": "52216c31-be07-44f1-8a5e-cb8b2d34ccbf", "comment": "Malware payload (AgentTesla)", "value": "4d5f8d64ad034658d6cd7e28aa43cb8e07081859", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515505, "uuid": "18a4f866-bdc7-47a5-b063-cc07e07b9859", "comment": "Malware payload (AgentTesla)", "value": "bb2fb42d17d7360fbbe000db29466d16597330cb1c33e3ca4fae6783d55a0db3d1093d4437c6f13e60f058f3c1d10206", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515505, "uuid": "e417ac1e-67c0-4cc9-bd00-da95417d5791", "value": "T13B556C8C55D019AEF9AC8E1BC1E8774B66C16D23B943A0C896A5BF6903334FB74107B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515505, "uuid": "6d326365-8e05-4bb9-a977-eee6d6b4a63a", "value": "12288:RlNRSna1UNkD8V+XihLLZGKTzz6cbOsWcp/mEJ+unO/fQkT/wyDSLYzkEP7/ZDnU:RjRSa1UNkDBbA9Ln3nNQa3uToFeRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515505, "uuid": "6f0bac69-ec41-4509-ae54-8e7ccc8dd8fc", "value": 1376396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515505, "uuid": "1c8f233b-3065-422e-9e33-4e687caa121a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515505, "uuid": "3d6b4795-15a6-4b2e-bb75-be19500e036f", "value": "93daed4f48230c436a90fb530a3bd038.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3540b8-1fc7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507517, "uuid": "f7febaf5-4d3b-4f6c-81e1-2083569532da", "comment": "Malware payload", "value": "79aa595e7976e3d077f09061c2006d97", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507517, "uuid": "380f7b68-cb41-4b1c-8b28-9261a76d7343", "comment": "Malware payload", "value": "3817396836ce3600d4cf2463388fe887aeab8e16a08b5d8b4bede0a41ae53d37", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507517, "uuid": "43c74fe2-0e69-48c1-a904-ebbd9cc8514b", "comment": "Malware payload", "value": "97c5baeefc5ca5dd1de00d9f5c11d284c6aa0f31", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507517, "uuid": "99976c10-c6fd-49f8-ae1e-5d21ab5aabdd", "comment": "Malware payload", "value": "b621c473c606de03704e35a02b0e854e23708d15cd4c2da489c19c9de503968b1154b53c89d95783e22876ca5ef5dcb7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507517, "uuid": "58989c4f-1fa4-4de4-b8d2-88a686ea4d65", "value": "T106642372EEBA15B91B8603245A1F68BC54F11E66420C72E5F1DBA9004F9F7E812DF70E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507517, "uuid": "d7467511-132c-44a9-aa47-dbf6db8a4475", "value": "6144:6HAsQMcRkMrD4wtMRVQixNzCNHfyLXlofejuB9pq6A0ka:uAsQhOwudPzCNHfy62qBOL0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507517, "uuid": "69c3b840-97b6-438c-922a-6ea99827e372", "value": 321162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507517, "uuid": "0400e038-fea5-4fea-bf57-e96e7104bc59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507517, "uuid": "965b3851-1aaf-4d76-b99a-f5e88baf9ed8", "value": "3817396836ce3600d4cf2463388fe887aeab8e16a08b5d8b4bede0a41ae53d37.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4806bb53-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486573, "uuid": "de3fb537-8bb1-4db5-866d-ccacd5ed265b", "comment": "Malware payload", "value": "43b67cdcea81bac79644cc48f6ccdff5", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486573, "uuid": "45009ddf-1ed0-4d0d-8d05-499f728a7ae0", "comment": "Malware payload", "value": "38364c91040eac2de796aca98ab902cccf613b89001bbb7a65578472207dcb81", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486573, "uuid": "682f0544-8dc4-4594-8415-8396c09e10b4", "comment": "Malware payload", "value": "11f847289a4292c561e4bf0ab8d49b8432f88e8d", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486573, "uuid": "cede191a-55e9-4c6b-9360-5149a1e9e048", "comment": "Malware payload", "value": "131fd142feb3e8d5e623986d3736063125fa2a20f3077cb61f9b0dcf32657be85fa1ce4bc56e4d351473954103bc5a7b", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486573, "uuid": "fce891e7-8cf5-4f52-b2fc-c97da3dbce17", "value": "T1ABE055258270FAA043AD608015217E1F20811E529BB65AADE62208443DA17CAEF2A24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486573, "uuid": "43466d26-2bf8-4ab8-9f55-cea5bd204725", "value": "12:s8hZGrO6hQeH+lXl7btpsCoMADXtQFjohognia9kM:rZGrf0lJbtpRoMAGF0hognZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486573, "uuid": "58f78200-d821-4d1d-98b3-7354097066ad", "value": 429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486573, "uuid": "24495442-337e-4459-9e5b-026397712004", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486573, "uuid": "a0f35294-4bea-467e-9e36-c66466b2399c", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e643fef-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516139, "uuid": "e97058b8-875f-44bc-bf95-90d9484a6d12", "comment": "Malware payload (XWorm)", "value": "50ee925b6e24179f00091d9294142356", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516139, "uuid": "665633ad-22cf-4294-9caf-64bcc0dfe411", "comment": "Malware payload (XWorm)", "value": "38531e1859cc2035fe0e9ffc9c865e9393c4ff9c08dcad2bcecd48afef82f8aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516139, "uuid": "9be1e0f7-f25d-49f5-8c15-dbf647c20147", "comment": "Malware payload (XWorm)", "value": "736e090f991bd64291eb0fb4f6327204cc0e52fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516139, "uuid": "11fc0577-d25b-4d18-984e-c1dae352031e", "comment": "Malware payload (XWorm)", "value": "c553f1085ea1c26ba448e248d25cc865f59c587e3a94df6071a99be447eb71af2399a1464428141031bc2ef0bef96322", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516139, "uuid": "efccec7e-ac98-4c99-b9e4-96461f5ec66f", "value": "T1C6451AD3FEBBF29340549241CC636B62FF2080EEB46ED64D68554385A22E1CE2537DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516139, "uuid": "3a42bf92-6748-496e-aa15-5dd07ff238d9", "value": "1536:4F4Imfmvm2rmmlqcfYqcqrmEqrq6qrrIqrq6qrrIqrq6qrrcqrq6qrrfqrq6qrfR:4Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516139, "uuid": "39284006-a3d8-4f9e-a3aa-3e7fd5676f58", "value": 1259972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516139, "uuid": "32ae3931-47a5-4cff-b9aa-b779c1e46f3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516139, "uuid": "3ea3532f-10f7-42b7-9c8c-e142de6c7bf6", "value": "50ee925b6e24179f00091d9294142356.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bc604f-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504280, "uuid": "c4a2ff60-c0e6-4127-9998-4e281d3cfb99", "comment": "Malware payload (Mirai)", "value": "57d95732ca842395b114796b13817b9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504280, "uuid": "9384a32c-f171-454e-9b03-5cbd137738ec", "comment": "Malware payload (Mirai)", "value": "3877ca1892bd6c2b1be78c81521f87420dfe7bf881d94955a73c0006dc6a44b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504280, "uuid": "7fb116f2-4555-4842-9977-c4c5962902de", "comment": "Malware payload (Mirai)", "value": "9ef1cde30bcc045146578776bfa5a109404b36dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504280, "uuid": "62dddcfa-3172-424d-9f3e-d4e1048ac363", "comment": "Malware payload (Mirai)", "value": "a3eb2e9bf5d9609efa17dab601136e78e622ab51119ff571e780b0e526ab11b2e5ad19d3f24ce9fa8a1272d973ae9701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504280, "uuid": "99d8b8d7-4b6f-4f39-8bc3-a3a809e2198f", "value": "T117936B9FF24B1461C85246F01BCB9FCE3E2322A1AE1798E73D2D167A18751DB1D06F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504280, "uuid": "1cc8b9ae-9e1f-4911-8059-34f4d41ef45c", "value": "1536:OtAP2EmoJc0mgfhgRMMXY7u7t1N96Tv44g6qo/LW+:OtAuboJc0mgfhgaKwuDn6Dlg6qoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504280, "uuid": "71363bc0-63a5-4591-ac76-f61302ae33e1", "value": 91468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504280, "uuid": "ebd0d333-6418-4ca4-bbf5-da0adbb587d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504280, "uuid": "7e58b803-1e51-4429-a3f1-f08107582bf5", "value": "wlan.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937caae3-1ff4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773527073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527073, "uuid": "2826acfa-2f6f-44f0-a984-44a709ba62b4", "comment": "Malware payload (ACRStealer)", "value": "1e69afbc6313c4a7379691465998b18f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527073, "uuid": "685bbfcd-1978-46fb-a203-f1e35386ff37", "comment": "Malware payload (ACRStealer)", "value": "38c53277006fd3fc4c13e8542acffbef3da3ae84272b42a119429afff9dba93c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527073, "uuid": "ed37a643-1984-4421-92a0-ae02741f9987", "comment": "Malware payload (ACRStealer)", "value": "805edb49721b673bfbd0902e2b7ba9ab38f79383", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527073, "uuid": "6dd672b0-4d51-4101-b961-34f26558076d", "comment": "Malware payload (ACRStealer)", "value": "dd503c63fc39e36342897b4376dffcdd1435507bfd3f4e79ddca623b43cdbcf134b78ad6f7e3e6a24151437a80b2430b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527073, "uuid": "65168b98-a6bb-41d7-92dc-532a0eb223cf", "value": "T148A5F885039715FEFBCF0A3B8166819F6B3250085B11EAF7919DBF53B633AE19278085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527073, "uuid": "5b8f2aa2-2930-47bf-818a-3b5533f8a584", "value": "7c1d71ac79723539070c82f2820958d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527073, "uuid": "74b0bedd-bae9-4e3b-9398-38d76231d032", "value": "24576:sqGZ1ubR4OACPCypOl0gZyH6Se9lc+aJbCT6H/K40kUsvYbIZcuvXO50j:sWQkDKhsMIZcuPO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773527073, "uuid": "aa284196-c7b4-451f-af70-bd1b31c69063", "value": 2180608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773527073, "uuid": "ce0a0805-b008-4b1a-9af8-a5cf725e4ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527073, "uuid": "0f20d41d-531e-472c-89a3-71628a030bce", "value": "SecuriteInfo.com.Win32.MalwareX-gen.65659884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76994e4f-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506408, "uuid": "e3030c1b-a8a3-4a64-acef-2d0eb4fdfbed", "comment": "Malware payload (Vidar)", "value": "b26d36617912be0bc8dba0215db7e5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506408, "uuid": "32e9dff7-d44d-443f-802d-d7fb83ce35c2", "comment": "Malware payload (Vidar)", "value": "398a826556cfab4535e5da1d2fc155ef9ea8275ebeba202032c8a281b6b1f021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506408, "uuid": "ff11833f-c2fb-4e10-b15d-264e13531fa4", "comment": "Malware payload (Vidar)", "value": "2e8ae0261f9b3db6b0aa593fda7069f70f6694da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506408, "uuid": "b0c91832-6b05-4b83-89b5-dc6919661a7b", "comment": "Malware payload (Vidar)", "value": "e3f4f134ba36afe852e9440fdfd6b7a8fb0fdaa9dda422ae17ecb372b821af20eba3224bb9d41e4aee6c0991df7d6613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506408, "uuid": "b603166b-0eb2-49d5-8f64-e1b091824bda", "value": "T175B58B0BBCD818E6C86A97718DB762923B31BC580B3223D71E55B97C2E727D0AD75708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506408, "uuid": "94c31328-e5af-4b46-9617-846f0e92812f", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506408, "uuid": "5c07c382-5242-4d84-980e-9be176b5c7fb", "value": "24576:Zv3FuRnvlyT62DpH4qPF1ioB8bc00O9uRbhGLz3aBKx/aWtPhxhiIOz:Zv3QRnvlyT62iqPF1h8bcHOENzw/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506408, "uuid": "f0d9b879-0f3c-49eb-b1d9-1d64a5c02757", "value": 2331648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506408, "uuid": "2b555127-b7f9-40b4-923d-5cbf19eeb845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506408, "uuid": "e24f7e54-ef54-477a-a8ca-d1b3ecc5b197", "value": "398a826556cfab4535e5da1d2fc155ef9ea8275ebeba202032c8a281b6b1f021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976f1e9f-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507322, "uuid": "02656bb3-e46a-4505-8e9c-5313f980b763", "comment": "Malware payload (ACRStealer)", "value": "fbfb1781ea6e47fd0100a8e3fea14eb2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507322, "uuid": "c905d48d-263c-419a-89cc-b5692fefd8ea", "comment": "Malware payload (ACRStealer)", "value": "39bfb391dadca8f2c376556968ba871da63c87e7a9b841119b67127974ab02a5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507322, "uuid": "f19971f7-b0f2-4b13-b228-8f7b30a7f231", "comment": "Malware payload (ACRStealer)", "value": "c1cb76c6732161863b63af156e2d7b6a191d9a3a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507322, "uuid": "b9d1c61b-efe5-4ab0-8f90-5d5cacf238d9", "comment": "Malware payload (ACRStealer)", "value": "47c624bfb7c585d5bcddebddfac0cd95e4252b67ee5286a7baa0b0c8a838a51d61f2b7ca24ea19f04694398c47741be7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507322, "uuid": "924ab60e-19df-460f-ad5c-2a3b16b0d11f", "value": "T13B85F8C70197C7FBFFAB993205AA759F6B0905A87F11C9CF81582E56A9B33D35238081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507322, "uuid": "ee491d27-ebc5-4f30-bbc2-9122c27b4aea", "value": "94a70cd09e3df0a0d4ab2cd2ba80f2f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507322, "uuid": "399d20bd-4e25-4164-9a5c-b34fa61c69ce", "value": "24576:gPdWz9Z7zLVEgXGopbGI/nNy5ppQg88GiQ7w+LLcof4yKtde5NqR56Aq8epdeRuO:brPUofP8dCNA5/q8CdesG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507322, "uuid": "76cd3571-8a52-4f6d-b041-8e1d0ed823da", "value": 1837568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507322, "uuid": "4f1f678a-05bc-41a0-b95f-c90b1c0e891a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507322, "uuid": "462fa282-f828-4a66-8830-f830e438e14e", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4cfd43-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773515174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515174, "uuid": "0544a948-1250-4030-bb30-54fff3d38da1", "comment": "Malware payload (Formbook)", "value": "ce54c2a8863a13390a7c9d045e019a3c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515174, "uuid": "5e308ad6-30f1-4b59-9edf-c6b17e03ef1f", "comment": "Malware payload (Formbook)", "value": "3bf403c406a2db1446172783415ae79c87f179a5d31937e258eff16a8ba083a7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515174, "uuid": "10695cc3-fa87-4842-9b15-ce51c6be714f", "comment": "Malware payload (Formbook)", "value": "7a636e060f2ecb53f5c00011a28e48cc8d5a7e18", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515174, "uuid": "201d17d0-7676-4205-92c9-851198ca1e32", "comment": "Malware payload (Formbook)", "value": "dc11e2ad2f5f8ff57c126c694be3c0bca28a40ff068ebd23e270228e903f97cd3cb42bf98c09a70338124cc1928d801d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515174, "uuid": "36bd2584-16e4-4c51-bc99-3c60ad04814d", "value": "T1DE95AE8963C422F4D7C42B0ED1FD844FF3FA804962A6789A6DA2F36D35F7B09524E254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515174, "uuid": "d569ccc4-a5ec-4e22-b0ee-ef2a41bc2375", "value": "24576:9HqqO9CjyYWlwLKNzPgDvIfVdrl7JBcScbkVptS55EX4asPa59GCmQxKvLmvxqCs:WMmDp5vYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515174, "uuid": "ca151a9c-8123-4ce0-a0d5-4ea35039f43c", "value": 1988651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515174, "uuid": "50760705-ff3d-40c9-86bd-82b2452bcc3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515174, "uuid": "8636f137-e07a-484a-a170-575b24de3335", "value": "ce54c2a8863a13390a7c9d045e019a3c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7fb752-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515438, "uuid": "aa329651-b441-4a1d-9dc2-35db45f2ea52", "comment": "Malware payload", "value": "44d48dc1d3a098d037fe453d814f93eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515438, "uuid": "e268fbc1-df49-4831-9cc8-c8aea738cae8", "comment": "Malware payload", "value": "3c144bd3da75361915fe15619f2af14ac7c309ac0d892a3fa1b8ca92e7571873", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515438, "uuid": "03425aa4-27ad-498f-b50c-d4e9db04f29c", "comment": "Malware payload", "value": "6e5b5f61fa0473d91987388f4c5d5a30d93372f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515438, "uuid": "5a0c7c39-0bf6-413d-9ad7-e9be56cf5fdc", "comment": "Malware payload", "value": "8cd3c4482a96c2790f367f1357b950d302199c4d0ea08f6f38dc44b48dad43861164189370334d4958b71361ed55c377", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515438, "uuid": "dd06b1e4-8929-435f-9d29-efc83f3eaded", "value": "T1CA45D0FA66B20C96001C2A7BE32462B1297ED5EF5DBAEF133445CAF9E60014CC9B1775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515438, "uuid": "fc47af5e-9b93-469b-bbbd-d12ba9240303", "value": "768:THVDa3p6DYRr6lYZT8xNrGyHry5CsubtPngh9NZShgah48CRpglTjLLY6RWH2XOs:yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515438, "uuid": "bf0e3378-e4fe-4e09-ad7c-b38c481aab22", "value": 1165698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515438, "uuid": "6d2971c8-f432-4c90-803a-fe8cb6995331", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515438, "uuid": "2dc3f155-8ab7-4b38-9af7-d0d4def79891", "value": "44d48dc1d3a098d037fe453d814f93eb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cdaf69-1fc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773508424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508424, "uuid": "0c21c2d7-0a1f-4538-aab2-29e60c531213", "comment": "Malware payload (ACRStealer)", "value": "d25f5b21313d740171f18fbde46c02e7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508424, "uuid": "1d200fb5-fbe4-4798-a062-cdd1f3d9d679", "comment": "Malware payload (ACRStealer)", "value": "3e9e0fa581b930881c6b193c76f4a25a3ceb9c247c5b7e1e51b4309f86ba4b11", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508424, "uuid": "f56a850c-86a2-42a4-b509-0866fc13a645", "comment": "Malware payload (ACRStealer)", "value": "1c4bd573b106435790b4919da84ca7ac5bfb2f85", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508424, "uuid": "9e2d40ac-fdd4-490c-9c1b-9c17e2e5f3fd", "comment": "Malware payload (ACRStealer)", "value": "44d88af54ae6006d7bf684ab4e78d0f4b80d1adbc1e8ad43a9f0098ecfadbfca913b89a0e1e2fe45a6a1c4d4455e71ef", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508424, "uuid": "3f01bcb4-2332-45b9-8390-db3c6af09411", "value": "T16B558B16B39508B0F66B0138C66A91DFD73AB46C5B30CEDB135C499D9A3BBC06930B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508424, "uuid": "8ee247ca-6f36-438a-a041-6c42e8cd86a1", "value": "bfcd38ec60e320374e16febdde67dc5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508424, "uuid": "280e2024-4bd6-4b90-99c1-bd3368dedfba", "value": "24576:AUbdDAsRC1xq8vFr3bm0MIKNDw3PoSBRx/Yc9nFtIG:wigBvZm0MIEw3P/BRWc9F5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508424, "uuid": "fcac51e1-17a5-4ca4-8229-b1f49218b50a", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508424, "uuid": "2b515d35-f9f5-4930-936c-8bd3c78c3bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508424, "uuid": "03237e54-b959-4c1a-b94a-1dad0d239533", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32cc932-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503933, "uuid": "c89c99a5-dd3e-41fa-9cbb-99f6d34a2ddb", "comment": "Malware payload", "value": "754b3ff54360b7028b4cc21321496f94", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503933, "uuid": "33403dc8-c5a5-41d1-9436-22a4518cbb9b", "comment": "Malware payload", "value": "3ed543cdaf97deb296b5e698ddd40c14039908dbb79a18e2727db8c685c04172", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503933, "uuid": "b38a45d9-02fb-4e05-bc66-fdd5ac43acb3", "comment": "Malware payload", "value": "fb95619fc0f002cb125cb4f47d1e1d3d773c51e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503933, "uuid": "cb1a1837-f38a-4999-96cf-c3502a57f9d0", "comment": "Malware payload", "value": "b18e2a8a30d9af4d57ff847db7f781349f9302b409475c9fefa656f657d6b11d0db4ebb2e23e0a1613a34e71369ab35e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503933, "uuid": "13e539ca-cf9d-418c-b795-0e791d41a562", "value": "T165C369E713980AAE6B9089D7C149760758EBC17B2C5E1388F9E25607F13F920B726F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503933, "uuid": "0ee9e9aa-fd48-4583-abc4-997899cfa442", "value": "1536:upAZ1OUf7wZkL976N8odeOMATYJMkBFHntcZNE84rvRvgSqT7voytrF5pQeHRHnu:JGRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503933, "uuid": "f1a951af-5ee7-417e-bc67-00041f7aacc7", "value": 124282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503933, "uuid": "680494e8-8a65-431a-8f32-730189e3c881", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503933, "uuid": "f28aac5a-7f66-49cf-81ef-7ef4200dd687", "value": "load.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79aa504e-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493958, "uuid": "616abb75-ff9a-4a08-92ba-931fc71f8c49", "comment": "Malware payload (Mirai)", "value": "eb4892e5bda84353f319f37dbfbbb16b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493958, "uuid": "83bc97d2-5c0f-47d6-9b32-6a04b18d293a", "comment": "Malware payload (Mirai)", "value": "3ee3c678787b2bc37c039fc50539bfae452c2a20fa93a984cc696875cb5c725d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493958, "uuid": "aed8cced-d0be-47c5-9b98-cb7b8c2179aa", "comment": "Malware payload (Mirai)", "value": "cedb45ae2819d897278dd33df26ecafffed536e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493958, "uuid": "a60f6ee0-1936-42ca-8d72-53f7cb56a552", "comment": "Malware payload (Mirai)", "value": "dfd9ac000566322caf0808c6c3766f6e61e227ca46694369810fe83e6127ee14e7c710755e8e8f119c7a461ccd9fd8f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493958, "uuid": "9d42ff0c-0ce8-4398-acba-77a0020dd0f4", "value": "T1E1835C91B9815B13C5D012BBFB6E018E772A13A8D2EF7213CD26AF11378785B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493958, "uuid": "b4d39047-8026-47dc-8c84-c7ef1285c3e0", "value": "1536:K1gjTcAjL0MRlJCkLumT8tOs/ycdt/F15wvb61d6ow:K1gjXL5LuOBQ+qRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493958, "uuid": "4e2a7fff-2100-4bbb-9dbe-d742af9b174b", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493958, "uuid": "1ef18494-98b4-4749-ac85-1843856b7bd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493958, "uuid": "cd0f898f-7ea2-4e92-b99e-359510d8125e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f57d469-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515389, "uuid": "7bc61093-87cd-4e31-961b-2a2281e68940", "comment": "Malware payload", "value": "2b42d454a73f724c6705aa7f226631b5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515389, "uuid": "91e232a3-cd5d-4e74-853b-0031bfdb2333", "comment": "Malware payload", "value": "3f2ef1ebb164bf082378c4529cb7bd5a33d654d8853e86741ef0bc2961af77a1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515389, "uuid": "faefa2e8-2c82-43a8-8c6d-95293a6334f7", "comment": "Malware payload", "value": "52647416973087ed60ac1b51e4d3cfad9aa4e62d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515389, "uuid": "1cf03cf3-d49e-4e85-a97c-6434c4dbf054", "comment": "Malware payload", "value": "f86a97c636a9f56b6608a019d357bb0536218c16ec3c69122de833b1bc08d020935a778e7b4c8698ce3792835a31ede1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515389, "uuid": "44ee3d70-d102-4e3f-b1e2-54878e0a292a", "value": "T127B3118B5D8EC8E9CBAFB828450E5C57EA8EB11300AED4D03B5C7E593F22DA530765D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515389, "uuid": "8d592488-92d5-40ca-a8cd-3cf16d910e7e", "value": "768:fTOUFX7t6Yd2OuCaNYq1ylK+VAAcDC39SW3WwaXyFmZoPF517yeOPFVmQtyJyCD4:jmB99VmcyXky6y9xXlcdjF0JWPvOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515389, "uuid": "7226788e-9ba9-4d51-87fa-b2575373f5da", "value": 114095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515389, "uuid": "62a2c8e0-062d-4d0f-b520-286926f0fdd2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515389, "uuid": "756f5035-1253-4d5a-8e3f-569d1ad648d5", "value": "Berlin_Audio_Final_332.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066951d6-1f93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773485175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485175, "uuid": "1dadcc42-fd54-44be-a7db-69f34b7f1dec", "comment": "Malware payload", "value": "b49a691572d74dfe8b3eea97aebe8656", "object_relation": "md5", "Tag": [ { "name": "pw-9937", "colour": "#04073E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485175, "uuid": "00519a9d-d202-4456-8995-9b4cc833986d", "comment": "Malware payload", "value": "3f7f808b9c0c3bf7980acb8468ad34917bb8910bbe1797b1d3fb548aa1c87d30", "object_relation": "sha256", "Tag": [ { "name": "pw-9937", "colour": "#04073E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485175, "uuid": "58163c88-b808-41cd-b811-5644e30f012d", "comment": "Malware payload", "value": "4ea42c978b52160567c76b9ecea10458a20feeca", "object_relation": "sha1", "Tag": [ { "name": "pw-9937", "colour": "#04073E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485175, "uuid": "0faad2df-ae74-486b-becd-ddc56e1b3569", "comment": "Malware payload", "value": "eacc4f3bfd3a5d24180c500641d3619995c5f5c96886b82cec615281d195cf9f7a3442182b270d922e0a2490d37d8a37", "object_relation": "sha3-384", "Tag": [ { "name": "pw-9937", "colour": "#04073E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485175, "uuid": "62db01a6-fc62-4266-b93a-e32bacefabfe", "value": "T17BA73345F776C9468A4F6E39154D15FA4DA2ECE57E253BAA03E806BED640B0ECCC08D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485175, "uuid": "12d0e939-51a5-4747-987b-54a61e7ab163", "value": "786432:iUXZxDSE27Vh6dFiKdQla3rJ2KK5Fcre1Z9ou1sTBE45l4Kgbh0QsP3ZU47RHXxe:1St7j6LiKqsnKDGe131EBEq4KrQs/ZUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773485175, "uuid": "d79bfe83-bf79-4950-8678-572dd3b3f5da", "value": 46237374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773485175, "uuid": "b56926e0-70fb-41a8-9565-36b84d41de32", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485175, "uuid": "2da315bb-c02f-428a-96cc-2527f46e195e", "value": "Word_16.0.19127_x64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2455eed-1fcb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773509488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509488, "uuid": "b9cb8e67-f77b-436e-9cd8-546a92d21e62", "comment": "Malware payload", "value": "108c94707fc5dbc1206a26988140adb3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mgbdpki-com", "colour": "#A0892A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509488, "uuid": "ef2e5aa3-20ae-414f-9c92-2f78f6597311", "comment": "Malware payload", "value": "3fd5f79220d0198714b9323a05beb794781f1a4939f1329574177647b0d87b46", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mgbdpki-com", "colour": "#A0892A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509488, "uuid": "bf68ee37-4abb-4670-a294-dadf69dbd2c6", "comment": "Malware payload", "value": "25e20fd5b1b5fb3577ee582d23e470538a03d042", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mgbdpki-com", "colour": "#A0892A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773509488, "uuid": "a1c072da-0182-4aa1-960e-7f04e7ab41a5", "comment": "Malware payload", "value": "224a61d668510f0ad08df6ebdecc91458cecab1d807d4a93ada0cb4d360aa10558faac69bae9c8be92bacb98a9890fa0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mgbdpki-com", "colour": "#A0892A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509488, "uuid": "d5a4dc4e-bdc9-498a-a127-301af07e9fc5", "value": "T1ACE6335B2117EB0A6FF8E25858AE5CCD98E9E40BD1022000377E5DF636D9A8CAC7F057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509488, "uuid": "f4ef0989-d3d9-4fce-8089-29dcdf2bc0e0", "value": "196608:bglBxOBttmEB21vk4L6AroCd6hZPr5WArtYBDdE2rF+1ymbS5Qtq8vzchBgG9hRL:bgJc2Ewm4L6AqaRDK2IQ54uHRTKqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773509488, "uuid": "aef385ad-983c-4fcf-aeaf-55f83246272e", "value": 14308685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773509488, "uuid": "d6e8dfc4-7882-4e68-8436-d38a46f93fc9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773509488, "uuid": "db34897f-2aa8-42cb-b524-b6c2fe1d2968", "value": "68c0d563fa1512a702c94f54e0d077e1b4dff6383c1c2f173d7c73cd01756faf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1066974d-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773515686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515686, "uuid": "1a2820ea-b487-493a-86fc-18d86cd168bb", "comment": "Malware payload (RemcosRAT)", "value": "5c965858b207650924d9369c14cfb8b7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515686, "uuid": "ff894f39-a0e8-4b06-91c1-abf7b9e9ef96", "comment": "Malware payload (RemcosRAT)", "value": "3fe85714960499a2df3580edf0cf07cbbd74acf67ae2bfe23f59f87d26805627", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515686, "uuid": "067e95c8-f1f7-4400-8da1-b6b477476485", "comment": "Malware payload (RemcosRAT)", "value": "080eba60fe21c4306da3f16981c035d429309eff", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515686, "uuid": "e903ad06-043d-416a-9ffa-ddcdb0ecba52", "comment": "Malware payload (RemcosRAT)", "value": "f40fe1516b08da0bd4af3a27109c4cb53d5dfb9d9b187d787d11538d146e6534423f9c13a9aedc01afe12fcaf033bb43", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515686, "uuid": "1193fc2f-80db-46cd-9ae0-acdcb7b903a6", "value": "T144B412ED299AF72662F8738A1F43DF9640AB4CCB1106307FE66B19420C6ED41617CF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515686, "uuid": "bba5dea1-22b1-444a-ac40-8cf641431693", "value": "768:Yiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii:cI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515686, "uuid": "07bdedda-e64e-4bdf-ac4c-ad6e4077d29e", "value": 540760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515686, "uuid": "9ac2901c-2cb8-458d-82d2-df7cd74bb223", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515686, "uuid": "8e2f4faa-d7ed-414d-84d1-d00bf037e049", "value": "5c965858b207650924d9369c14cfb8b7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eff49c5-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773515335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515335, "uuid": "496ec523-2edf-4deb-aa3d-d2bdec21a0fb", "comment": "Malware payload (XWorm)", "value": "53d1cee7f8823dcbb2f3a3c798f77cb7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515335, "uuid": "e9b45961-d0a6-43b5-a6c9-7fcd900ba391", "comment": "Malware payload (XWorm)", "value": "3ff530b5f0a185bb9b6d656f863751de1fd874a63d1a7e8fc2f25b401a0e26f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515335, "uuid": "cbf0ff53-1973-4860-bf56-b1c4e61be89e", "comment": "Malware payload (XWorm)", "value": "e14a7fef14c9e65214aae6ddd8dbe0ac08fe67ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515335, "uuid": "6485ff33-fd01-4e47-bb3b-0d9b88b5bebc", "comment": "Malware payload (XWorm)", "value": "e031c77ad99b8a7e90163cc68dc6d29f832c738ebd29d139b696fed91c52021a47da2946eca35dfb681ceb8d84c2f3ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515335, "uuid": "77bc21c8-ac42-4a74-b247-2d1df3446b87", "value": "T11B45E1E57DE99092438DC58DE0A1B6B26D6116439077EC2CFAE346F89A523F30DC97B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515335, "uuid": "ab443b76-baa7-466f-a5ee-e3aeabc6187a", "value": "96:X5quQ6V9TfkiOw676l6Oks6pZ6ET6aL6nU6wmPWNuUWOAotOz6Lh6X6HiULO//6S:X5qu2/RRDPjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515335, "uuid": "dbd2b689-0ce9-415e-a65c-699c803bc6ce", "value": 1218853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515335, "uuid": "37833934-a5bf-4f50-aaf8-06816ee845f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515335, "uuid": "36d85aed-d663-4ed6-8a40-f4eacb5b146b", "value": "53d1cee7f8823dcbb2f3a3c798f77cb7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8e4374-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493773, "uuid": "1eb1a4b3-1503-46d9-9565-866258460366", "comment": "Malware payload (Mirai)", "value": "a3f2cbf44b936e0157f2d48f110a1ff6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493773, "uuid": "05b3fcad-ea43-4163-844e-989d289c143b", "comment": "Malware payload (Mirai)", "value": "4035590028cb3801526098c77fc2eb4216fb8f1eb119051510922c9c7d4b84af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493773, "uuid": "0a619bdb-59b2-470a-944d-e50ef6d3a7ca", "comment": "Malware payload (Mirai)", "value": "31523bf327a756555a2d458f3327601a492d4e58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493773, "uuid": "a7244797-3e73-4b57-81a0-b49c62e599c2", "comment": "Malware payload (Mirai)", "value": "489d257df6aeddc4dd44aec1b8f5fb34f98c7763f78289e7fb22b963c43729a0ac22fe028d050aecff84fa96d614c47c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493773, "uuid": "977b535f-d314-497d-ab47-145900518bcd", "value": "T1F2F47E63B7318F64D3E1D27405F38B219A9911A20BE251C6A37CC7207A6076D2DAFFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493773, "uuid": "758f6029-6182-4fc6-bd47-2fe80d67ee98", "value": "12288:dfFnNqndkP866T/fukqqHGZhYJ4+94eaGY0RIqKKBHDjNygpk6tUIuOPZpYqS6g:7nNqndkP866Dfukqit4eaGbRRKkDB3aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493773, "uuid": "99eee072-ebb9-47be-81ae-2638ae930930", "value": 724020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493773, "uuid": "06a56496-f24b-4fac-b7c6-ec0443e75a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493773, "uuid": "8c52ed57-fb83-49b5-807e-c9cceefb1ee3", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ac5732-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773516342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516342, "uuid": "9b2e5020-bd1a-4c3c-8437-d85138518b4c", "comment": "Malware payload (AsyncRAT)", "value": "28e17d7095350c89ed80d08429d33517", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516342, "uuid": "35179905-7f2b-4099-b9d9-db7903b6bee6", "comment": "Malware payload (AsyncRAT)", "value": "4172ff83b7e93674b9eded28b00533b7f069d6704251ab80d29a3ad7d6b9e92d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516342, "uuid": "5e13c5ac-4c9e-43c3-b3c4-012a64bcd951", "comment": "Malware payload (AsyncRAT)", "value": "d144a677152de0ad97eb12c3ea4bb17c92bfef36", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516342, "uuid": "fe830e91-ea6c-457a-965b-3e9fea6046bb", "comment": "Malware payload (AsyncRAT)", "value": "36148b287e9dba897ef7f3fe05fcc75a66f1e48bf6d4a1c89d4c275333f43e727094bbc1fb1fada9e71c9281ce5fddd8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516342, "uuid": "ac4fb5ff-8530-458b-8f18-5fe3ee3ee751", "value": "T17545DB2D032E65A79177976A49EB9ACD3DB1A7187107FFC6610281A270F8D304F58CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516342, "uuid": "9c9f15b0-0fcd-4e40-bd39-7fbe6f4d4db4", "value": "96:hYtrQBWXMMvPQGJpVn3lgNYY//aBcBpKkr1L9tJdnm3wYAB8kvDN8ATPZPyAi2K3:SsW8XtJ0esGV4TZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516342, "uuid": "471b3509-e62a-42d8-947c-1cb42b4c3cd3", "value": 1228853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516342, "uuid": "97ab5b5d-1a71-471a-8d29-8c2b6f33f628", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516342, "uuid": "faf031e3-e59b-4fc4-ac93-2bb9c0fd1c15", "value": "28e17d7095350c89ed80d08429d33517.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2f2329-1fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773504757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504757, "uuid": "3be43552-aa89-40f5-bea7-70eabca7d7e9", "comment": "Malware payload", "value": "3ed1a6730027e3142c08c1593a30c7d9", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504757, "uuid": "6e9f8be2-0cf4-4640-87a3-1df88715d09a", "comment": "Malware payload", "value": "418afd03a98cfbdc9486b4aae25eba8ea4465c19572e7ce60663c27df50b65c9", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504757, "uuid": "4526b81d-ae46-4b57-b586-18af8c31263c", "comment": "Malware payload", "value": "431721b2d3f98f74ae0699b42d197217847e581e", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504757, "uuid": "a0b9aaf2-f187-46fb-b2aa-4a8783cf5f07", "comment": "Malware payload", "value": "4c397bf1f069b5107fe3a68c843c477144e72eb809fa31b17fd561e8b33d589bbd95512f958838d85001de750f892513", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504757, "uuid": "be0e6be2-c801-419a-9a2d-16ba3fb797c0", "value": "T15CC71317F14AA09FC05FC63846578F25399738874F1FBAEB15C092A51FB2BE406B8E49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504757, "uuid": "346a35f0-93d9-481a-b93c-7923665d0b02", "value": "1c7a490216124b1bc98bf9c2b898abdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504757, "uuid": "e02e1b37-2495-4763-a6a7-5fbcdab16ce9", "value": "1572864:aN+TYPMoz4Gy4HFKHWC1ITSMIe1M54n5:w+TYPMoz4GtHFK2sOzIeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504757, "uuid": "b53962e1-84ff-4527-abe7-a1065e670fb9", "value": 53498368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504757, "uuid": "3fe24960-1912-414b-8854-68c7b3909c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504757, "uuid": "8ff95f6a-0a56-4864-be61-6947fcd4ea30", "value": "Safew-Max.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6dfc3b-1fc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773508354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508354, "uuid": "cc85883d-8537-4259-8762-b1961ee10fb3", "comment": "Malware payload (Formbook)", "value": "1a6c9d174d3d2dc1a5698ff2fa9c9828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508354, "uuid": "576047dc-ab02-4c3f-bbcd-e039de29deca", "comment": "Malware payload (Formbook)", "value": "4215dbd9fb380bec17e4d6693142f8738e68a690dd57b6769fd3f2e298812d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508354, "uuid": "8f15d07f-7be2-4659-8e8f-dd6508fa52dd", "comment": "Malware payload (Formbook)", "value": "2b5cf2fa49d3d052ca5d2ce3d8860c10dc9122b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508354, "uuid": "3282a926-b855-4305-be27-b2bbe096632d", "comment": "Malware payload (Formbook)", "value": "0fcefd75047820e1e1752989b78f40ef87684e66ffb25a458922160c3cfe6de6f68392cbb02b967e2a00cb257389dfd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508354, "uuid": "5b30c655-4677-4eea-8590-0dbab7122f4f", "value": "T18E35F1186367DC03D5A55BF18DF1D27803F05E899922C3438FFAADEB752679A6880393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508354, "uuid": "8621ca95-4cec-445e-ac82-af0ab3800882", "value": "24576:RVTG3dG1BciavIAhqf8GauFF4PgA9ys62RaJmcZ2q1V9ivn6g/:HfceQqf8Ga7Pxysampq1Xkr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508354, "uuid": "5c3c0ac5-b3de-4eda-a12f-a4b3774d0d12", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508354, "uuid": "70ed52c5-61d8-4da5-83bc-b22112ddf58d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508354, "uuid": "8029fd7f-ab5a-419d-b4e2-79f992cb8722", "value": "Quote-RFQ-556787.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e2ce92-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493900, "uuid": "3c275ce5-a494-43e5-a888-4ea5fd57399e", "comment": "Malware payload (Mirai)", "value": "a6632307d9c639d7be6fe93f8efc26b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493900, "uuid": "4d9ecb0a-7201-4a67-ad3c-0cedc8084ae0", "comment": "Malware payload (Mirai)", "value": "439956088d70cb579633e2c8b583ae16f76005f9947926e7a41417e6a26a99ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493900, "uuid": "dff5a9ea-3f60-43f6-9da7-653e165b88bd", "comment": "Malware payload (Mirai)", "value": "fb94cf75983c691010161221afa4af39e37ed7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493900, "uuid": "4c72b909-21e7-4847-8a3c-6168cdc94188", "comment": "Malware payload (Mirai)", "value": "d9e3086d66235ab09cfe2723a6d0f2024c1f8646126e688497374df39b2edc82d05f83b326ddf8dc5fd1c72bc9d9edc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493900, "uuid": "b5172164-4302-4585-8750-a344f263fd2d", "value": "T105639EB3C9393E94D25541B4B830CA795B53B48481871FFA5A98C6FA4047EBCFA093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493900, "uuid": "59f14ccf-9008-4304-b38f-4f3d107f4db7", "value": "1536:sa9wtr82FLQgB9PHK9QATGRuzuCy2KNdwq61d6o:sib25QgDPq9sRuzu44q7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493900, "uuid": "d90b1f80-7127-4f52-a0e7-f6db8404e566", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493900, "uuid": "a7c3d51a-49e4-434c-a5e7-8dafc54770f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493900, "uuid": "cc91bb52-c871-4b61-abdb-1b3f15dbe1c4", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0952add5-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773501501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501501, "uuid": "5c9d4f82-5274-4e52-b03d-958c45f28a79", "comment": "Malware payload (Vidar)", "value": "20f45b97f5018bb461212e6790a5d8d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501501, "uuid": "e71b284e-6ee7-43e2-a1ca-942fa6effd20", "comment": "Malware payload (Vidar)", "value": "4487cc46856c240686c9f7c4e0e7f987bfac13407f5cb02c94ddb36faa8d01c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501501, "uuid": "6e5a9cfd-30f4-4e82-ae4f-d44903cc7973", "comment": "Malware payload (Vidar)", "value": "e57646028fb5b90a73dfff546ec5dd30c9dc5def", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501501, "uuid": "31428a42-25dc-4154-8d68-61182e33688a", "comment": "Malware payload (Vidar)", "value": "5f6d75a07830502af0501d17d22b9bce3b6616c57789765afd00c0ce13af4c237824446702a2763d8277cd0eb528b901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501501, "uuid": "bb8db151-b75b-4ee2-a8d6-12896b5a84e3", "value": "T1FBD55A43ACA598E9C46E8235CDBA57927B31BC18473263D30B97A9343FF27D0697A704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501501, "uuid": "3a5973c8-2776-4f0e-b931-94b5040dee60", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501501, "uuid": "4f1caba0-0e06-4b37-831a-76035dd562e9", "value": "24576:s+qQS+9Zh0DC7/pH9gNLDVpcBxuIv/yjmVgHIIznUnj0X5oVUZtPXODjCyruzJ:s+qP+9Zh0G7LKHVpcj+vUnjQoVU4+zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501501, "uuid": "3f9aff7a-7c21-4b3c-90da-901fabb475d6", "value": 2804194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501501, "uuid": "d42251cf-3111-4b51-b032-b6d0084d0d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501501, "uuid": "f7f87b5f-5c74-402f-9dea-4dc515594ea0", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7278d392-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495235, "uuid": "d2869d84-98d7-4caf-b3db-365115f0e983", "comment": "Malware payload (Mirai)", "value": "a08af0febe020c5e3bffd616848b7e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495235, "uuid": "cef8ac8c-a3a3-4c7a-9070-92706aab2f80", "comment": "Malware payload (Mirai)", "value": "449bcae6d61c2d556081d279291dadc98e956867a216245ae8bf091194951cce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495235, "uuid": "6779011e-e01b-4d5f-b916-2411e39fc1e8", "comment": "Malware payload (Mirai)", "value": "f799ae90e33ac8a23c68cc769bac4c40896da81c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495235, "uuid": "c00b091b-68da-46fe-84fe-3cdef390b2f9", "comment": "Malware payload (Mirai)", "value": "5e4b783cf999f1aeac90d7627a134888fa1b2c096a46adcea2fc95f8c452c10c5f18d59405ce022015b422fe352d46ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495235, "uuid": "47f8d065-5373-43c6-9b60-3ae3c4b16664", "value": "T151364B43FC9545E9C1AED23486629253BA71BC494B3423D36F60F7382F76BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495235, "uuid": "b99d3ad5-a72a-4ddd-bd98-6698c2daac3d", "value": "49152:wXrdHZg3Iid3Xl/vlkssmdeNsJRZitjPzEq0S5EC4cGVdYlilbKwU6Hr:uUHl/dbJRZYEmEVDXlGeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495235, "uuid": "f71ce467-f3e3-48a2-b10c-af84d1b771fe", "value": 5312664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495235, "uuid": "88354537-9c5e-4b7e-81e4-a4f366aac4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495235, "uuid": "3e0b99ff-b8ec-4b53-ae13-cd567fbfc7ca", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982e6a1f-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515055, "uuid": "45c86314-65f3-403e-a1e3-ebbbc0b3500d", "comment": "Malware payload", "value": "dcdf96f4e00bb2419d245b9957bc385a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515055, "uuid": "7e11adf6-0f8e-4c07-a437-6de655396d49", "comment": "Malware payload", "value": "451174e99957ee7e6af9375703bab82ee3f618a307b422236102b2f9587344d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515055, "uuid": "c99a13d2-d03e-4bca-bf3c-7cb7a446e1d0", "comment": "Malware payload", "value": "32888cc37b4492fa931beba4cf45fcd78069d15e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515055, "uuid": "19203a53-8e92-4adf-90d0-07d9b07afac7", "comment": "Malware payload", "value": "6a70f7a3615a063fd8e33f52bef7ab34a8d6a0c5092084bb70d2cfb239be04f816a169625deca31944f9685dbce39b41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515055, "uuid": "be47aa2d-1716-4b6a-974f-4d838fc88f80", "value": "T19625023BC70694E9C9CA78C9AA3DA9808D6C4D07A21E094DF884D0DBF495D5D8BB337D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515055, "uuid": "1dee0bec-2254-431b-b4f3-310a255a7e6f", "value": "6144:+MW79z+wtZ61BFP0QPKOZPBHEK4EDlMzEoWtrcEBJ0jqdQJVZaE1oIeqvQtE1JEo:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515055, "uuid": "1b956852-6db6-4db5-9ee3-823893bff976", "value": 988817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515055, "uuid": "431e854a-7c4c-4d15-89b2-33e33c90dd04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515055, "uuid": "117b7e60-7a7f-471b-ad7f-c6946964a9a9", "value": "dcdf96f4e00bb2419d245b9957bc385a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab54b86d-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773515087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515087, "uuid": "0d571b74-a809-4f91-8999-8d4f884d03af", "comment": "Malware payload (AsyncRAT)", "value": "338f3a3c8419760b126720d0d3fd2660", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515087, "uuid": "310e6475-6d41-4127-b783-3f08ce875e0e", "comment": "Malware payload (AsyncRAT)", "value": "45389426978856331523bb108d44291b5eece2bb3c61d4b4ac1d7abd35641680", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515087, "uuid": "d84c0fcf-80d9-4b39-b73e-bb5104763710", "comment": "Malware payload (AsyncRAT)", "value": "59709fb630dc1bd4f2039ca59452a556d5f058da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515087, "uuid": "bb517a81-b135-4300-b57f-ee5132c0b2eb", "comment": "Malware payload (AsyncRAT)", "value": "75d14c3c10e16bd322203c892116fd851a10106e406057b4dc1fb1b3322387577eac3d7183f47c8b0b5f4e9bcba0e212", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515087, "uuid": "49fbde58-b9c3-4411-923d-2ac0e5ba0770", "value": "T1F4C282CC3DD7B46887413837A92FB4EBE13F8C82AC4E854CD59520B8B854768D0B69BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515087, "uuid": "53b02629-46ab-44d9-a4e4-8ea13bba7372", "value": "768:loqr4spPwDq4ztY3cOWczl5h5n4DKRxhoudqsISCO1ZdTCMaU3kxNnweqxf0CiIG:ZR91lul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515087, "uuid": "1c5fd833-12b8-4068-9f48-a0aa65468866", "value": 27362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515087, "uuid": "13e6c2cf-9444-4a28-a7c4-8622478a1143", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515087, "uuid": "9f3d7163-aeb3-4fe2-825e-be258ce28832", "value": "338f3a3c8419760b126720d0d3fd2660.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834b1673-1f43-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773451025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451025, "uuid": "ba07257d-8876-4acb-a620-34dca67f38e5", "comment": "Malware payload (Mirai)", "value": "2efd8fc21a501718c657a04958f77799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451025, "uuid": "86147efd-8eed-4d3e-a547-5d27019f140d", "comment": "Malware payload (Mirai)", "value": "455c8e75c00e5d5ad56fe5ed51d2676212ec8962391e65b339e6363a666a3b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451025, "uuid": "55bf3b27-1e4d-4ff1-a112-1c9edd4d4707", "comment": "Malware payload (Mirai)", "value": "715a03e7f1c3d931702d88fd75ecd4b17b0f794f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451025, "uuid": "463197e4-d417-46cc-977a-5a641de1a123", "comment": "Malware payload (Mirai)", "value": "bc6fe1b428cfa41b9239ccbb6a9c6093e7ba1fe256a2ca9ba31a0a87b4f90ba9c173362bc5115e1b180052bfe4ed722e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451025, "uuid": "044c76b7-411d-47c0-8d6c-69863317e0a4", "value": "T15C834B52BD829A12C6D423B7FA6E418D371213A8D2EF32179D256F2437CB81F0EB7645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451025, "uuid": "c73abb36-b026-461c-bab9-8c866a666aa9", "value": "1536:BUcWVuFSMGPa14vJN/IpBXNxjHnK/3I0jaORrJLnx/IfHQaUKylomOc9XLdPjm7T:BUcPFQymPIjfj4v1Nnx/QHDUKcTdi7yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773451025, "uuid": "637aef0e-27e2-49d2-97d4-98e591b6822c", "value": 88068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773451025, "uuid": "e7936f2c-59d5-4777-8fc5-a74a8d9b3aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451025, "uuid": "b9c31e95-5dac-4aaf-9d37-330066cf0eec", "value": "SecuriteInfo.com.Linux.Mirai.9774.1419.15734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b20abe-1f73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773471802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471802, "uuid": "16808ba5-d7a1-470d-afca-22bc35c72ff7", "comment": "Malware payload", "value": "854ee8941e20a8743f622ae1f766e205", "object_relation": "md5", "Tag": [ { "name": "distortedcoin-lat", "colour": "#4059FA", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471802, "uuid": "9f0a4fe1-2491-4304-a860-d7502dfd160c", "comment": "Malware payload", "value": "4566182bdc369fec978f18f378c5c4fdbdfe61db4dba73dac7d4ad696ec939c1", "object_relation": "sha256", "Tag": [ { "name": "distortedcoin-lat", "colour": "#4059FA", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471802, "uuid": "ae0c2057-4aca-4586-9308-536c48320d45", "comment": "Malware payload", "value": "c4511a1c06bfdb71e462ad7302461d00c97abf1b", "object_relation": "sha1", "Tag": [ { "name": "distortedcoin-lat", "colour": "#4059FA", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471802, "uuid": "7ac304fa-2825-43f8-91fd-acc92cdd5be5", "comment": "Malware payload", "value": "9acdd9c28c8ca759663c7c988b40fcfe34813dd8167fb726b0f45a23ef30419c120da18755890c512cbc5390b6e0ebe6", "object_relation": "sha3-384", "Tag": [ { "name": "distortedcoin-lat", "colour": "#4059FA", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471802, "uuid": "b9b5acb0-287f-468f-9a96-af9a40de0e73", "value": "T15CE055299330F4A043ACA48054303F1F20825EA1DBB65EE8F262080C3CA1AC9EF2B24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471802, "uuid": "0a7f959c-34c7-4bf4-8578-ca9a07b28275", "value": "12:s8hZGrO6hZlJ+hl7btpsCoMADXtQFjohognia9kM:rZGrfBJObtpRoMAGF0hognZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773471802, "uuid": "80aaed53-ee73-439a-8122-a60549605ef4", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773471802, "uuid": "321ee785-3d86-4456-9c9c-33f5b4ac50a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471802, "uuid": "61b19aa8-5188-49ef-a910-cd21364db0e5", "value": "2ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b198a4f-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494310, "uuid": "9edcebe1-67bc-47fa-a145-d12a259cbf59", "comment": "Malware payload (Mirai)", "value": "2a7be3c02b341f12eb1c9bb0f1b91f18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494310, "uuid": "43ff4f85-d5b7-4397-8b33-256e6280ce7d", "comment": "Malware payload (Mirai)", "value": "4601c4cdfc97bce6cd6280449554b724d845d44b25606ff83f1cad89ed8c9a10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494310, "uuid": "9b8fbc13-c4a5-4084-a5b0-40ee0d451a2c", "comment": "Malware payload (Mirai)", "value": "f2f3762cd9d5dfd7fb1b2b51efe6700e3a8c7ce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494310, "uuid": "9ec7ccfa-3fa4-4bc4-bf17-3c1dfd7f7576", "comment": "Malware payload (Mirai)", "value": "28a012253272c2cd297e5509c63b3a18d5fe2a909a656e57fd361be1f68a9db1391c94f26d7ad6f18893eb7908c60b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494310, "uuid": "9494ccc6-740d-49f3-a676-1e7bd5644b7d", "value": "T1F2F2E134C5A98FD6EEB9CEF417C553DABBEC0E8B17118CA331028F919B11411868EEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494310, "uuid": "f716f6ab-ecfa-4972-b813-dac5afc04171", "value": "768:teDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2FXrh4uVcqgw09t:tCRocD0Lu/PWUWr/iuAF4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494310, "uuid": "b9fe7f2c-f9c8-4ff2-853e-df64ec56afe9", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494310, "uuid": "e2ab4d75-aac2-4d1b-adc1-cff31a729ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494310, "uuid": "bb4a86c6-ba36-4008-be52-be3aa2b4d0a8", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543ef26f-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503774, "uuid": "ef3335c8-2f0a-4843-bb5f-e2d195054c36", "comment": "Malware payload", "value": "d9a138b29117b9e6505e092cf59e920c", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tds", "colour": "#2C9820", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503774, "uuid": "eb9edaf2-41ff-40eb-8acd-abf55ab8cbfe", "comment": "Malware payload", "value": "466dac1c9f5a7ceb8232e99dc9bf8a1247bd92dc02e166a46c932bb7f8466f9c", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tds", "colour": "#2C9820", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503774, "uuid": "728cddd1-9979-4288-930e-f03b310d4419", "comment": "Malware payload", "value": "8c4e826d57a8980626feb1b7e0d69383c9bd730b", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tds", "colour": "#2C9820", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503774, "uuid": "038808dd-772f-4052-a1fb-2785be4d058c", "comment": "Malware payload", "value": "df1459bbec36386c2cb499bbf1a222f87c3bc8916a580bdf9135ba287f6c8ccfa03f30c9ce0ea3d97475ebaf3d8121c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "tds", "colour": "#2C9820", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503774, "uuid": "2402ea71-75e6-445f-af96-2398599eee03", "value": "T1C5C1A4ED7C7315162577197A1A1F8104713356031C4EC8517CAEEA58BFA323B9AA2AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503774, "uuid": "b71d0b2e-7351-4ec1-b54b-2c2769ffe587", "value": "96:h45vYUHj/KhvzNDGE/GSgBWH7OVGXMfUzQbq5qdny8PqiWO0:0vYUHWzNaNW7c81wdy8P/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503774, "uuid": "8fa9617b-ba84-4d3e-9f3c-a2b32ded34bc", "value": 5930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503774, "uuid": "bc363454-327a-47f0-9168-5cea2d2aa540", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503774, "uuid": "620f7b1c-48de-4c31-a8ef-41fefbcb79ac", "value": "sasndfsdfghjasd_clear.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3310ad-1f8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773482928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773482928, "uuid": "87a62546-c855-4cd3-9393-d6d4df907eb2", "comment": "Malware payload (Phorpiex)", "value": "3e648d75991d7486c20f11483ae184a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773482928, "uuid": "d8ac8e45-c28e-4374-87ef-1a1745b28238", "comment": "Malware payload (Phorpiex)", "value": "47375ea5685ad360883191cf5a5794cc27f5deb7f66dbea2eab4a9fd79c914f2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773482928, "uuid": "788c1fd6-db6c-449a-a248-d115e9fbbfaa", "comment": "Malware payload (Phorpiex)", "value": "b58cc9021b2addb57d66a0d4921162a0ac8e6324", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773482928, "uuid": "617efd36-5e8c-4cb9-8b94-547c5aac046d", "comment": "Malware payload (Phorpiex)", "value": "5092e754fb0addc5643d332f977528a2d00228159db3561572e01a10bc3066d5fd8cc1169129c708fb38858f7e5f1f7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773482928, "uuid": "89d7c396-021d-4033-afaa-9dfba2c3b202", "value": "T1DB825C0FB9814217D1D100B59A22867BDA78947233D854EFF7904AEE1B686E2F83314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773482928, "uuid": "1126b7ea-c705-40c8-ac1f-c2bff5cddb1c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773482928, "uuid": "d25d686f-68d4-460d-91d7-2848e62191a0", "value": "384:D9GIUVp9cfcPwOQxb0YSLSZWXnZ+lNSLZav8U9chiY:5EifZ0pLSZKZ4MLZa0Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773482928, "uuid": "1378c42b-ff78-45cd-9dd3-87997d0cedfc", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773482928, "uuid": "e762ebef-fce8-4df0-90ff-0dc6bc1ff63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773482928, "uuid": "4c46ff12-c81c-447f-a51d-123f5940a998", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842eacb0-1fb7-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773500848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500848, "uuid": "c137e9ed-3fcd-4f07-989e-29e132f83cbd", "comment": "Malware payload (CountLoader)", "value": "71e2072e64de9b1d71645e40d4b4bdcb", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500848, "uuid": "be70d9d1-9e59-4106-856b-9eecebe8c11a", "comment": "Malware payload (CountLoader)", "value": "487cd5d70ac135969b6170690a3eac99353e37b7bb9eb5c093d01b75f7738e56", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500848, "uuid": "0ddd5b30-2efe-44c1-b8e5-c1e00d7c15be", "comment": "Malware payload (CountLoader)", "value": "91ee23ade42603a8e2f6eaa069c4af3c2db4ba89", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500848, "uuid": "ee842a54-fbb3-4936-ace9-59e9809c32a7", "comment": "Malware payload (CountLoader)", "value": "6cb5d23526887fecba3dc6213fd8c11c1c018d431eefc3b1401daf8e43f3edaad9823531bb3e0f84af8958488dea3db5", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500848, "uuid": "da5fad0c-c145-474e-a945-1948c6700c60", "value": "T174B3FB281ACB03D585D26C988BEB5506FB632517066CC7547B3EF6B12F601EFE0E92E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500848, "uuid": "1e0b0c92-31ce-498c-aa22-3f3b4a5370af", "value": "3072:xgREu+x+0MPoAyS0FT04y2Bu8ed2dzkds54mrnJM6Qu6ID4MX0kZFJj+2V48MjJz:xgREu+x+0MPoAyS0FT04y2Bu8ed2dzkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773500848, "uuid": "6923f008-caa4-48d9-9913-71d4785f62d8", "value": 115821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773500848, "uuid": "70c4aca6-1b2e-42bf-aeb5-644407efe2e2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500848, "uuid": "870058d0-d628-4760-81f0-e2322dc3937d", "value": "Global_Neon_Photos_749.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55629e2b-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494327, "uuid": "fded7f63-2876-4534-8bda-2fccc117b8e6", "comment": "Malware payload (Mirai)", "value": "25fdbcd92322277dcb44af1560841022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494327, "uuid": "599ca490-5b86-4883-ad71-e38ee7ad7b18", "comment": "Malware payload (Mirai)", "value": "48b23f25d72a69d41744f2db34bdbfeefc4eda6d9f160f739a4e07cf53fb28af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494327, "uuid": "6c3b479b-b329-4764-820c-718c25a730b0", "comment": "Malware payload (Mirai)", "value": "c7c3c5f8d2c2ba4c86d8d83f4421444d25e24848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494327, "uuid": "a1f66593-5d55-4207-8af0-3e8d824238f5", "comment": "Malware payload (Mirai)", "value": "9968a217da76e352d96040ab852797a77bfda737c3d1347681b82d4e6c5622f14963d560f7b64a772e1b86b9dddb4a30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494327, "uuid": "c1b0ca07-ce42-4b80-bd0f-83f6ef50138f", "value": "T166F2E13486FEE9BCC03E7539085D4B41B8C2F9166A65372B052992BDAEFB9C13E056C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494327, "uuid": "7295b9ee-4049-446d-a2a3-526c2f01b7b1", "value": "768:WwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTIgRTq1qUx0nZP:JOX80VqVi2otGtzX8s1TMZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494327, "uuid": "c0ba7f6e-303c-4371-b577-fffc3247aa7f", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494327, "uuid": "6816f7e2-29f6-4a5a-a42b-508b4f13efab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494327, "uuid": "6bf32791-4b91-4114-bba1-3f84356deeee", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018068f0-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477436, "uuid": "5c7ccde8-5e60-44b1-907e-dc7d2d6fb624", "comment": "Malware payload", "value": "eb7dc4aea8cf49f94da4e357f64cc435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477436, "uuid": "c20ba565-6b24-430c-9e6f-b1ecde6a1bce", "comment": "Malware payload", "value": "48c56f688f1990c5a6778f1e481e0a1d3102e746da236138664efe1bcf8837b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477436, "uuid": "3db46598-3d8b-4e26-9508-b894bf0bd519", "comment": "Malware payload", "value": "173351da7682f1bbb9a082c93d5d5d8e87bc24b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477436, "uuid": "8f9dcd1b-bf69-4be5-992e-d4fc6aa6e94e", "comment": "Malware payload", "value": "aec2e81cce5ee1b314cbdd2893243a982591ee2dbae9a95ceb018ab1c57d08097107172698f77aed690c4e83fe4bb3c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477436, "uuid": "4aeb1718-7dc5-42f5-bec8-c747682bc98f", "value": "T1FF361897B8C24A82C4E4367AB87D81C473635EB99B9756576D04FE3C3BBE1A90E34700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477436, "uuid": "71211c35-2637-4c9b-a0bb-a20244ed2b2f", "value": "24576:yd7bb70/cInRinno6XvwtOUJUstDMPIp/uHsyHO3XO+Yt2wYggg4jDGgHVNO+L/+:yvMfRJ2Ci+Qq9rM9J1G/raLim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477436, "uuid": "cd1504d8-cfba-480b-aec5-64480e26bebd", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477436, "uuid": "b3cbb384-0f69-4f0f-8f67-943416920dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477436, "uuid": "e4841f76-b4ad-4a23-b133-98393192e371", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e693cf1a-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501872, "uuid": "390fab68-f21a-4d82-b29f-d599354738ea", "comment": "Malware payload", "value": "99f586801f186895093ea42254be660c", "object_relation": "md5", "Tag": [ { "name": "blockchain", "colour": "#8ECF86", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "polygon", "colour": "#252CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501872, "uuid": "db1e8ae3-6e16-42ec-a629-0721d2ed04a7", "comment": "Malware payload", "value": "4a590db1bc22610e42751212242bad7ad63b158dded4684d61fc42d1c9cc18fe", "object_relation": "sha256", "Tag": [ { "name": "blockchain", "colour": "#8ECF86", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "polygon", "colour": "#252CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501872, "uuid": "7a09cea2-fd9b-4990-884f-e3cb7f718d4c", "comment": "Malware payload", "value": "23dacf18e4418b0deb139d9ea84a2f817c89a317", "object_relation": "sha1", "Tag": [ { "name": "blockchain", "colour": "#8ECF86", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "polygon", "colour": "#252CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501872, "uuid": "8613cd5e-5f92-4400-bd0e-97cd36f7f614", "comment": "Malware payload", "value": "bc29156efe950945930f221ed79d212e49c9e533ad9499bb44f7697e6d3f2cb748ea9d82165ba2c5a7c490ddb4e755ce", "object_relation": "sha3-384", "Tag": [ { "name": "blockchain", "colour": "#8ECF86", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "polygon", "colour": "#252CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501872, "uuid": "9def879b-6c62-4569-b895-6af7548079c8", "value": "T105723B54BB7F240ABDDD535D02690A735B529FE0C4A9E6BC758B3F28E50EA21338035B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501872, "uuid": "87631818-fcca-4735-b98d-e927275976bb", "value": "384:iYdvENbgSODaAM/lL9blEpBpY9ev2+uNfIV1n/0QzPRFVQt0ualUEAoPPd:iYdwHmFMfIfMQpQt0uYUEbPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501872, "uuid": "4ed51c46-43e5-4702-a5e1-89f429f818e7", "value": 17560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501872, "uuid": "b532a1ee-6c2b-42e3-bdaa-07c06e1c2d9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501872, "uuid": "0173b91b-1de3-4ccb-a3df-0bc35a53d227", "value": "fontawesome_errtraffic_loader.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5584ce6d-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503776, "uuid": "7be0e482-4faa-453a-a2d6-c63e37b7ff1c", "comment": "Malware payload", "value": "51e9f9f2376d0b5d51f80fde25b52ef7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503776, "uuid": "967ab5d3-402c-4310-b826-1bc59934ecf8", "comment": "Malware payload", "value": "4b78364cb434ab7380a20b48f79ebcfb8f1a0e90488887f8c890d9a696c903bd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503776, "uuid": "72f67d26-7bad-4fb0-97b1-6137e906bd69", "comment": "Malware payload", "value": "0a67af724ffd3c78fd8255aaa75a734733e56143", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503776, "uuid": "93ed5914-f46b-48ad-846b-3b93e2e2e012", "comment": "Malware payload", "value": "ebd9a70b949af483bfb1e42a84bec9540081c7b4dd707b4765cb10e794b89a54296fc5e4799a24ba782cfbbb3e109aa4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503776, "uuid": "f2af71a3-2130-4dd0-a97e-5bde222cf38e", "value": "T1A581108AFC6A1151C97332628C379509FA3212A71946A7233F6C02E46FB1491E692FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503776, "uuid": "676a7914-39b6-4e9b-b066-88582f5e40a5", "value": "48:Qi0iQff1NPItcYt8quDpMiibuQ07gNRrnwfV1cNnWwrj+1cNnWwIZ:QiY0BuDpMiibuQ07mwfVc+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503776, "uuid": "f73c1db2-53f3-4e57-8d94-fef2a20ea586", "value": 4039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503776, "uuid": "f182273d-f0f5-45ca-8c19-f1682a8d5e85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503776, "uuid": "83e60a56-c5f3-4f82-9e4c-b8467ed10351", "value": "ocherhydro_112.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bdf003-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493896, "uuid": "6dcc57c1-c8ef-4046-a6e4-5126471a09f7", "comment": "Malware payload (Mirai)", "value": "03f158fb3d5d906a1d34abe62da8dab6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493896, "uuid": "f5ab2cb5-c961-4412-9473-a845c0a9c3bb", "comment": "Malware payload (Mirai)", "value": "4c6aea8f57a8fa341d14765c77a7691f60dfe2549140166ca9b3d04d7c8f9195", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493896, "uuid": "5e5d2570-27be-4d5b-abe9-03d42047c246", "comment": "Malware payload (Mirai)", "value": "0c94ee5a3fb92b92c12c1f1e6098954c9adcfd6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493896, "uuid": "756b8e64-d9d6-48e0-865a-1d88cd7db3bc", "comment": "Malware payload (Mirai)", "value": "899224b26b809f7817537fd613dd31cca5431b138d6220edbead1104b107f7bb4cf95e268f543376614e5532ef800a77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493896, "uuid": "91373adb-ea7e-4f4c-b480-da6b7a03ae88", "value": "T13AF2F164FA9401F9FE7539345E26E6C163F48ABD668BCA9224D09EE319DF7053709CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493896, "uuid": "4dc5fd82-62b1-4703-86ac-a9985613392e", "value": "768:etuamiJLv9aBmeHwwpVhgQwos+3PLtPYu4IZhD2e1CmOA5c5Xp4uVcqgw09g:etuHy0meThvsYPCIf2e1or5Xp4u+qgwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493896, "uuid": "d826691c-c18c-4c2d-b336-b66beb2cfc42", "value": 36260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493896, "uuid": "db91e37d-9f73-493a-ade9-e0996b97bb17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493896, "uuid": "96982fc5-5dd6-4398-b8a1-cf3e90de4c64", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6f1680-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493780, "uuid": "61f7d330-12fc-4946-94a6-ff5fcebeac34", "comment": "Malware payload (Mirai)", "value": "d257ffdf700a80b35f662131c2947b4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493780, "uuid": "6d57145e-7b50-4a8f-9a7d-a3733dcfb431", "comment": "Malware payload (Mirai)", "value": "4c7b24e79fc258c3c1b7b5960bcbd56068217dd443b8c5c39f6d66d41c06d2e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493780, "uuid": "3b8e1974-38e7-4f92-9f4c-4f9f89b71d5d", "comment": "Malware payload (Mirai)", "value": "ac1ef0dddb07fc5aff55d4d0d43b24bf5866531f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493780, "uuid": "19331c60-1f55-4921-9e49-228abc1a2e2d", "comment": "Malware payload (Mirai)", "value": "5d3c6642ba0cf916ced99eef14aabcdc71b9844ac0fd54341c189bfa843809d2d9aa02c451ffe4295754bdc076a1e6ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493780, "uuid": "20b495a0-2ae2-4a28-b936-99d5188f22b8", "value": "T151E43A56F8809F62C5D1257AF65F82A8731347B9C3DB720689189B383BD786F0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493780, "uuid": "e8bd84ec-5293-4c62-b443-cddec17355a6", "value": "12288:K+fKJBUHjdF4OGRbGv3OwsLoT6eUl9Yo3WxHAmgpkgqIDdObAaB6QaqXst:KDkF4OGRKvSo8luoGxHA/JUAaB6bqXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493780, "uuid": "7c5e1808-7cc5-4869-a75c-1de0021f63d5", "value": 660996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493780, "uuid": "c3d63745-5e18-46ac-93ca-4640e640174c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493780, "uuid": "877c98e7-d49b-450c-95da-7c8988d84ca9", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5918d469-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773501634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501634, "uuid": "a569e54b-e25f-49eb-bc8c-79a143219307", "comment": "Malware payload (ACRStealer)", "value": "3402dd54e42102ecc90d2776000e9e49", "object_relation": "md5", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501634, "uuid": "f000676f-db0b-4961-9b15-d59d7c7f0e5d", "comment": "Malware payload (ACRStealer)", "value": "4c94621cc9f0ad9984115412d33e82b03e45b08586eeff6ae69fbc35e769f45a", "object_relation": "sha256", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501634, "uuid": "cdc29b3c-af36-4aa7-abf5-8a6acb9230f4", "comment": "Malware payload (ACRStealer)", "value": "08b16bd8dae6c6f0b25a8661bda3992413b4c71f", "object_relation": "sha1", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501634, "uuid": "a1b3b0ce-980a-4ec2-8b46-0e77f3fb1a05", "comment": "Malware payload (ACRStealer)", "value": "1faeb3f6e74f91f54a78fa9163b9ef557f5f8522e3feaf03b044d5d1efd20807ab627eff638f0a602e99b7059e08009f", "object_relation": "sha3-384", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501634, "uuid": "af5d0bce-fd70-47cf-9a2c-efec6688466f", "value": "T1ED8733D3F361A9B8C068DE31D0298536F67593A5C2F0230B4231B46959E37E96EC4E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501634, "uuid": "bc1a3657-482e-4890-adfb-97b84229afa0", "value": "786432:6o9W9VkD3hVvc2PTPr55aBlmMWCZQl3lCXvG:C9avvhPr5RMW1l1YvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501634, "uuid": "32f6aa46-9423-4aac-abbf-86b38aaeef7e", "value": 36545185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501634, "uuid": "d48972a2-33db-4592-a6e3-d847988812e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501634, "uuid": "e96dc816-11db-4293-b13f-e979c228b886", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c059f9b-1f8a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773481319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481319, "uuid": "9ad9e88b-d82f-4de0-80f4-2860be96905d", "comment": "Malware payload (AsyncRAT)", "value": "71c1ac875c0c0b600caa5ac1a7f64aac", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481319, "uuid": "6998555c-b3bd-40ac-a66c-28f99b14539d", "comment": "Malware payload (AsyncRAT)", "value": "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481319, "uuid": "e4eabe79-c1be-45fb-be0f-435a82d35146", "comment": "Malware payload (AsyncRAT)", "value": "423e6a5f53e6ec8643a712812b0b3652fc2cc406", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481319, "uuid": "7fb7c44b-a1ac-483b-b5e9-0f734ed5fc92", "comment": "Malware payload (AsyncRAT)", "value": "23a7fbd14598cdd139595e38d3b532932126ad3bbb475399b1326b799a17a8f0f0258209586bc2ec09b56966e53d9d12", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481319, "uuid": "a40959e4-8cb4-4faa-9392-111685308576", "value": "T17836C52621D1CFE5C10F51B1EC5ABAF902679D28DF214FCB6A903F193A716D1683292F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481319, "uuid": "1d597b2b-9e62-4475-a959-73a350d816ce", "value": "75d930149d98b9b34c55459c6a79b293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481319, "uuid": "d93d3b94-432f-4e61-8d54-430416d285a2", "value": "49152:09OiMb/OmYfRTHL4P0H6MX56HPA7LqQ3JB6A3wjQ4O8b8ITDnld5Lyk9HezgXv:cOiMb/OJthH6MX56veBzen5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773481319, "uuid": "040bd109-7fd5-43b9-ac36-a03e414c8eaf", "value": 5066752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773481319, "uuid": "3a73fb4a-7987-43c3-9755-7141a017cda8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481319, "uuid": "a3d58421-213b-4072-959c-c1d39336a807", "value": "x4c9d9e12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af76bf8-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503758, "uuid": "36db4530-27cb-48ba-9570-2cfb4afc4090", "comment": "Malware payload", "value": "62982f8dd50f6c05a33a6f4b21c8f994", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503758, "uuid": "20928f77-6042-4887-a96a-2e2e7b332b44", "comment": "Malware payload", "value": "4d58cf844f5364e8a83b73d5ee34100e1871b2333cb100183012608894f61192", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503758, "uuid": "814500b9-e99c-4b0e-a66b-ddea2dd09672", "comment": "Malware payload", "value": "390616f51787fdbacf842dc7253511e4268b987e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503758, "uuid": "ab85ac47-ab83-4fd1-9614-fb1223f66070", "comment": "Malware payload", "value": "e7f2de8c43d1fecea9d3e3323d4928f7b437f1c67cf257b44f804dd338209c64d19f4a1bff161f41f15d2fa834b3fde3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503758, "uuid": "f92880fa-7703-4a77-b5ef-fa2e7aa5a426", "value": "T105827EA38D4B3E424BF0A64776DD65D9051C078E34C1000FD71FAACAC6E269E5DC82DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503758, "uuid": "37ab0086-16e2-4610-8e7d-cceead5d5aab", "value": "384:vEQXWsNjlkwyJiNwJPw9LGIQ4m7YOkHJRKpuNHK1f7aS5aC92jjMF2Z:vyKjMlJPw9L/m7YOkHJRKpuNq1f7aS5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503758, "uuid": "64038529-c594-4f26-930a-129f22a61fb0", "value": 18841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503758, "uuid": "8eca3dd2-60e1-4515-a263-102d34f6ae58", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503758, "uuid": "6211247f-4dab-4a17-8541-140c34c95487", "value": "lubazra_iclickfix.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8964b21b-1f56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773459195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459195, "uuid": "c073072c-80e9-4294-bdb3-ccb5c64e69dc", "comment": "Malware payload (Mirai)", "value": "ae15dd1be64fa19537af94a6e55ca479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459195, "uuid": "61150d1d-7df4-4161-a4c3-d191d762527c", "comment": "Malware payload (Mirai)", "value": "4ddee2cee3b8d5962206ae72808d59925805a01d3fdf0a12772ccd13a8a7f779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459195, "uuid": "2bb455ba-3955-45e8-af8c-39b076c45a95", "comment": "Malware payload (Mirai)", "value": "f6382e7dfa9150268fed637cdfec6e5829a272ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459195, "uuid": "315efcf0-b48f-4303-8220-4f433dc16cb0", "comment": "Malware payload (Mirai)", "value": "f23205eabd5098bdfd696c667ab9670a92af4dc1737be3e4e3910480abcffab8267bbeb004fde9d7bade8b59baa0a18c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459195, "uuid": "31ab11b3-8db3-4165-908f-452fb427b58b", "value": "T1BDB3A71E6E318F6CFBA8923587F74B21965833D626E1C684D25CE6011F7034E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459195, "uuid": "e8b0756b-1330-40c1-b61c-c4d1324de60e", "value": "3072:T0CrRmv/CMxhfIdjfNixFrtazIQijH9e0U7ynt:xdmv/yhfwxFrtOoD907ynt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773459195, "uuid": "7d731056-f5ac-4e79-b1fa-20671a1ef62e", "value": 113568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773459195, "uuid": "4e99051d-ecfb-4133-8c98-ce7af9f62d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459195, "uuid": "6e325242-23a2-46f5-bf44-7f8b63ad7bba", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e60c670-1fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773507764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507764, "uuid": "ab606564-7be7-460e-bdda-c1b09757763f", "comment": "Malware payload (Vidar)", "value": "1129c9632972789aec2f9726209f1c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507764, "uuid": "fbda1ff1-bdb2-460a-be92-9446b7ea27bf", "comment": "Malware payload (Vidar)", "value": "4e4a64cb18e8c78c4c2ca94aa4ea87635c03896471395def17ff4c878b9bda91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507764, "uuid": "a1d149e4-24b5-4fb9-bc16-913d85f98ffa", "comment": "Malware payload (Vidar)", "value": "b759c340c6909fabbaf3c234a01c958fd9987644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507764, "uuid": "49deb84e-926b-46f0-9d87-bdd5253261a0", "comment": "Malware payload (Vidar)", "value": "0c8505ca3753d6aa41d0e3e0811c1680e45dcc993e392bb08bb0b11c1414bf241e4bb5bbae848c86d44077324786e7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507764, "uuid": "040fec4c-58d8-4765-9a9b-17ca1459b79c", "value": "T14666C52B725081E8C11AAE3AE4A3CA92E5F360674772C5F7D9D103B44A558C74F7E22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507764, "uuid": "8d5cddd9-0f75-4fde-bace-5f0d0554c5fe", "value": "00d782a7ded6a3c43266f1a10c5d7773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507764, "uuid": "dab33f9b-9094-46a5-bad3-24c23b08ebba", "value": "98304:GIoZyQ01KG5KKMv9fZE3zo5tMJbh6eQzQ00iWWXbt:V00FWLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507764, "uuid": "7774f7ac-b3c9-4771-86c8-de46d1e557be", "value": 6763520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507764, "uuid": "8d8941c4-9dd8-41ed-a990-3332f83cf34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507764, "uuid": "d2bded4a-f7b3-4f1c-acb7-eb2ec6ad748e", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c9bd03-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516292, "uuid": "0a10dfa2-3dbe-495c-8cc6-f0f79a8f7ae8", "comment": "Malware payload (XWorm)", "value": "39118e55349c0c36b261815b73275643", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516292, "uuid": "629a3439-efc3-4072-a4fd-0a438078ccd8", "comment": "Malware payload (XWorm)", "value": "4e759caac13845a074e67c97f944a50e28f4749e647f5a2884c8f917bf3772d6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516292, "uuid": "dd3bcf2c-0052-4324-b2e2-1c5eeae7fe43", "comment": "Malware payload (XWorm)", "value": "f6bda9b10507060921a0ed90edbd86f249c9f84d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516292, "uuid": "cedbf270-1d38-47f9-8960-3644a73181ff", "comment": "Malware payload (XWorm)", "value": "a18761e9ad9e972d8946af284ff4da739d04b24e1449c530410b50d2998f532f3582852740bc0c78dc776672e3d0ade3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516292, "uuid": "e18d4782-8c1f-4ebf-a7aa-ccb41da87710", "value": "T1B635E591AC31F0029E480F53764DB619507C1FE658F62611A52BE5FEB98C5EB30C2FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516292, "uuid": "b69ba801-ca48-4dd5-b31e-376d1f64c0e0", "value": "192:5usPemVLUWQmb17n9mIFmWgs9MkmbwTHZeHKLmeIpFNIzGTVLhHjaxN7pvocXmDW:tSNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516292, "uuid": "2279c3e1-54c9-4fba-9904-fd682d632e6c", "value": 1125916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516292, "uuid": "b08ffae3-f4b9-4bc3-a7fd-fe9197cfe0de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516292, "uuid": "c6a8dff3-6c11-4836-8b17-41eae96f83c6", "value": "39118e55349c0c36b261815b73275643.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3c3262-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493775, "uuid": "81ca2da2-a289-47ac-aa96-de05bf89314d", "comment": "Malware payload (Mirai)", "value": "84b219487029c148f6c3bfedc73aeb79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493775, "uuid": "5510f943-8cbb-46b3-9d9d-13f31b094a82", "comment": "Malware payload (Mirai)", "value": "4ecb55ff9d9f9b875b6c06c5bdfe97af5cf6319c834b288918f0e6ae9fc65d84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493775, "uuid": "a8524a5c-8045-4b28-9a74-40ab202bf648", "comment": "Malware payload (Mirai)", "value": "d296352aa565965708a3fde71223d96bbc2d3cf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493775, "uuid": "8784b106-460e-4546-99e3-45e523a66eb4", "comment": "Malware payload (Mirai)", "value": "841e715729188cf8e1c3a07008174fdad9d05920f612d525bda76696b48ca3af377b6b777ad6f454461812d45599e080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493775, "uuid": "2d6accfe-ddcb-4a91-b8ec-5b2afedbae21", "value": "T13052651B5292CF3EC478923087FB8931B1F1B014B7B3A2275710E6397DE375A4A39999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493775, "uuid": "8b9a08d4-5ad3-4540-a8ef-05820b6ad07f", "value": "192:RQq/7w2LVsCk/nCS5uKoSiaYZFEsx+2sviAUs:u0BsCE5oKo/ZPEc+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493775, "uuid": "086f8d0b-5709-4af2-aa8f-c1b591094235", "value": 14472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493775, "uuid": "f5bf6a48-6ecd-43ee-96f2-32da315b6978", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493775, "uuid": "0b8cccf9-3ec0-48c0-babb-6071960de8c2", "value": "android", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0238a32d-1fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507502, "uuid": "18e00314-82cf-4a2c-9767-1d30710a1c04", "comment": "Malware payload (ACRStealer)", "value": "26c73231aaad0d5f29f2777f7e9cdb25", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507502, "uuid": "d237664e-01a5-4d3d-8f3f-1069ca644e85", "comment": "Malware payload (ACRStealer)", "value": "50d97d150ee4c6c2f3ddef9ab8b8c46de1423c14d4cb3977da19cd9ef0f113fd", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507502, "uuid": "264f15cf-3cdf-4f8d-9f83-f6c9f1946a46", "comment": "Malware payload (ACRStealer)", "value": "bf5458e74a84984353e19c749126d3f5c477fbdc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507502, "uuid": "61c8e64a-1f46-4231-985c-bda1fff140f1", "comment": "Malware payload (ACRStealer)", "value": "0fa00a857958c3f840d62b6a3ec2ecf495d7f54b7577ec205d36dc9778a4df6028a826a4f496948ad91a84021d145f23", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507502, "uuid": "32701e99-4222-403f-b82f-cf7bbb7f047d", "value": "T16F75A6C29C1B41B5FB0F2F320519B65F375C41C88E18C9E79EA05E36B4A2FE75234A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507502, "uuid": "e6f9dafd-88c2-42b4-9060-527c94989cf6", "value": "b59f6e713a40760eea537cd2f16486e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507502, "uuid": "ac3ce337-2232-4666-9374-91cfc742662e", "value": "24576:yzFORuDSjzZnw5yQDEFRom8koOR4HPIfs565vhyeSmz6:z3uHP8thJSmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507502, "uuid": "0700b730-9d4e-41a8-b44f-8ce4d3f9c19d", "value": 1628160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507502, "uuid": "ddf3b6f4-5575-4227-8fd9-a8c6b2eb01e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507502, "uuid": "542e1adf-2a39-4c0d-b991-4d6f879e183f", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f080c7-1f95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486271, "uuid": "b348a72c-4960-466e-a684-3ee8d03fb483", "comment": "Malware payload", "value": "a387284738ca976ec271cfcfc9e1916b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486271, "uuid": "6cc61f3d-b475-416b-b3fe-b8dea10aff67", "comment": "Malware payload", "value": "515ebe50efa98cc179ae51bab5086b52c2deb1524165e6d7434892d56dead946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486271, "uuid": "69ea6f65-fd30-4da8-a49a-3d4686df87d3", "comment": "Malware payload", "value": "4fc99187fb11109317040e98f094f31a6824ec4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486271, "uuid": "47535e79-6990-445a-a52d-4fb5fde6b2c9", "comment": "Malware payload", "value": "1b80a87801bdabf5e48cfc661a28acf0a8209aeb7d68e33db2bf8aa4784d9c881167289402f6a71b7d7157597677e1d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486271, "uuid": "b7237c08-4b34-4329-9161-8caa721ebe42", "value": "T11BD623E894D162E8D4D34A00718B43A9B5C1A54E41FE5C1939CB7D122F16CBF628EEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486271, "uuid": "25afc30d-3203-47b6-b014-04ed030e836d", "value": "b0fdffa1f352d4f15ebfd190435c7636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486271, "uuid": "6c36c48e-c152-4fe6-a928-eb5034606e2b", "value": "196608:k3Q28gF7av87ntudh7c/mTtUwya05KA6XEPYH1dLfpqv2zFrZNih2+4Rb7S:k3Q28ghI87tIA/uUwv0+jVTJij0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486271, "uuid": "6645003b-f8c7-4dff-a050-0c870ee3185a", "value": 13033432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486271, "uuid": "f7608922-57b7-4f0d-a9a3-6ae0e8d5414e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486271, "uuid": "b7ef66bb-e006-4d1a-ad1e-54593f2bdb70", "value": "8BallPoolModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fcb78a-1ff6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773527906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527906, "uuid": "f3e0721a-0be4-4f9a-8839-53a675982038", "comment": "Malware payload", "value": "19155aba12e6874622c5691aaa6fe8fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527906, "uuid": "eb1df6e5-7120-4583-969c-2be686868a2a", "comment": "Malware payload", "value": "5175ae4c75a8e1d10decb0a787d31784a986cafe5e4a24d3aa0eb7e7748f916f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527906, "uuid": "d64391cf-bd5e-4098-b176-01eaddd7ef57", "comment": "Malware payload", "value": "10cbede4ec4039523e7c64bb02874d6cc8550875", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773527906, "uuid": "5ae5e955-6b71-4d2c-b3cb-73c53046ea6f", "comment": "Malware payload", "value": "fe54c359a8b53341948332e2a2220b8c1958664fdfa6986c89ff3915a74d33dd5c519f1e9bf71413ab02df8e9e351dfa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527906, "uuid": "d531f02c-f9af-4f37-967d-f098331231c1", "value": "T1F00733EDA6F13CA8CE92D571EA1A82F5F2652C080CB500177F463F851D3E867DDADA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527906, "uuid": "4d48c7da-df5c-4640-b6e2-c4fc0f58d890", "value": "3d9d4fa0f734aa85e027438ca479fbf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527906, "uuid": "ec6d27d0-4ee6-4801-a748-ac873eed3909", "value": "393216:ZpAN4fZvO1qoo9t9rB6O+lwaD6Tqwr6dMxgBF8IHbOs+:PIms1sr9mlwjX/gBF88Ks+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773527906, "uuid": "c1c090d7-c0ca-4e3f-ac24-22e003cee90b", "value": 17345280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773527906, "uuid": "95c5424b-69f8-4ce0-b36c-8cafa47797ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773527906, "uuid": "296873df-15d9-43f8-83f8-9627885cd930", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f7ad0f-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773503730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503730, "uuid": "aafbef4e-c3f7-478e-8e83-3cf420a3ff0e", "comment": "Malware payload (NetSupport)", "value": "a138c9af94803106b542a1c873261e4c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503730, "uuid": "95564339-74a9-458f-9edf-90fea510cb15", "comment": "Malware payload (NetSupport)", "value": "517fee961cdd99d528a070e2dd7c9a5b8f59750290264656b4c7e34e36b8ca0a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503730, "uuid": "cc9cb8e0-4222-4744-a887-96ee72173344", "comment": "Malware payload (NetSupport)", "value": "30a67fa70ee1f16b45655ab0c2d155c40079e818", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503730, "uuid": "27006b35-3327-4aac-b691-32ba4e34af82", "comment": "Malware payload (NetSupport)", "value": "334ec8c55207a2581bdd4aa663a6ffe51203e74237aeddff4f3fe0e65c998c1d178abd8994213c6774f53d0836330e7f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503730, "uuid": "77679b8d-e88d-4120-9331-ba89cb69bcff", "value": "T1EC6533C91E350C82898CB4FDDB39E565105625F73424AE9FA0D46B0A8C94FDFEF80766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503730, "uuid": "6c0eb8c9-37af-4d58-8847-7f36fc71feb9", "value": "24576:IWq1/qh6bND59hBpAjAT9BORwJpYgWuH61fsIJYn02Mu7ZRfa:IF1Sh8PqRwJp8uH6/UMa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503730, "uuid": "896c401d-1077-4c82-9bbe-28149ce58dfe", "value": 1512128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503730, "uuid": "7e83e38f-13dc-4be8-97cc-3ea6f5374f55", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503730, "uuid": "dc035ebe-8895-453f-af00-1bfb955faebb", "value": "cloflart_at.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a332bc69-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516362, "uuid": "3657ad6d-87c5-4dcb-ad9e-8e421951d453", "comment": "Malware payload", "value": "3516c597af6396862649b5612c6a983a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516362, "uuid": "fcfd6104-177f-4a96-8dcf-3a0b41afec6b", "comment": "Malware payload", "value": "51c497e9136a192e41c0d09508f45e7b016676bf63cc133980b7c53798aa01f0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516362, "uuid": "5c55c166-23b5-4ca4-94de-ee2243e9f261", "comment": "Malware payload", "value": "d34ef70cfeae62889d42be8c59ec8add003c6145", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516362, "uuid": "2970ba88-cfca-4e27-8f62-636a74ed5bf1", "comment": "Malware payload", "value": "d94675f1cbc321917acb0ad76a30c929f81b1b4b7c4d88f590572a40749e9364a0c74cb4525b9b9bda8cf0d34e2ef438", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516362, "uuid": "4cb12122-0975-4cb8-80ef-73ddd85dcba5", "value": "T11F3502A3DA49F618E5F05F50DDB95015A8D95C4023282DE42DE0BBDBBF81FE92E25C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516362, "uuid": "2583ef0b-4783-43ee-b630-c7f2697302f5", "value": "192:O35g3b3dUei4ei4eikeiPeMeqeqeie5eWeiJeieteReieiheneReieepeUeiiGer:oGA/An5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516362, "uuid": "75dcfc49-fe29-4ad6-beff-52a1067a7a05", "value": 1141784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516362, "uuid": "f3dc8d8c-c495-4d79-90fb-d1d185f0c5c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516362, "uuid": "4c4550d4-d139-45d0-96da-7c5e8f994499", "value": "3516c597af6396862649b5612c6a983a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e68164-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486488, "uuid": "19bd4f27-2d61-48ec-a1e7-41b9da244880", "comment": "Malware payload", "value": "f199c468aaa4510e8956de947f8e724e", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486488, "uuid": "f85a315c-8339-49ff-9ab9-14668de0aea1", "comment": "Malware payload", "value": "51fcdd10e3a6701f4bf74742e547c249abe6e65afbd412afe9724b507d6e822c", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486488, "uuid": "65f47f35-6b15-4ec2-9961-abd2a2cf13d6", "comment": "Malware payload", "value": "bcd7b77bf51793db358a986cf80e69b990d446a6", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486488, "uuid": "18d0dfdd-3e41-49a1-9778-f74c902f2603", "comment": "Malware payload", "value": "5a2a045fd2b7207aa3d66a59dfe0b15ae06e595ebb1adf9b792c918b0d06fb97f15f8acbe9494e1d4ad665213f2ab323", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486488, "uuid": "d4f54a14-3db3-4c0e-9077-fdfbfcfa3da5", "value": "T115E0A375EA70F8C0437DF14080353D1510D08E53F37A5FE8A3210CA66C295649F0B5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486488, "uuid": "a7f9b667-0e59-40b6-9cbd-35cbffb18de6", "value": "6:s8bloOVsukO6hsRp4YMkqCctckk5t0h++XPHZkTkM7hTalYWs6qa+sXkSqZTn:s8hZGrO6hsRp4YcPKP0RihqYvLAk1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486488, "uuid": "d4f575f9-cde2-404b-9445-a089938a3263", "value": 425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486488, "uuid": "e18d862e-b124-4da7-99b0-3e6fb6afafb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486488, "uuid": "6d29ad23-d282-41c2-8677-269e98e78b68", "value": "11ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdba67a5-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507414, "uuid": "6bfd48b8-d3fb-43ff-a28a-4aa43d45ea9e", "comment": "Malware payload", "value": "cde30dee3464c8d4f9749b64747659df", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507414, "uuid": "f128c3be-61a0-4f8d-ac93-ee2defcf4a90", "comment": "Malware payload", "value": "52317c44479795b9d7dff4ea70b6425240b8afac5dddfaa06859d6c44592d240", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507414, "uuid": "cf3cd85c-a784-41a2-a6cc-7f0be75b4d08", "comment": "Malware payload", "value": "2f31890248a341ae8a3815ed329dd300c487e502", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507414, "uuid": "f859837c-95b5-45c0-aa32-e3e049c34578", "comment": "Malware payload", "value": "6dac830fe3dcf03038d14ad5f28cc4ed1595c15f793931aadd96e7e7b5a85d0e7db06381b534dee32a56363b65b266ee", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507414, "uuid": "85602baa-c7e8-436c-bd80-845f6dd36dcd", "value": "T15A64230C6E97BE328C29E3B836FF795F9A598CB81C4014C135FD498E4B651F7974A224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507414, "uuid": "3274d955-7b36-443d-9c87-8c5e3d61bcc8", "value": "6144:iTSK8onI9/MLnKbn7E//uZZFs3a2z5J0BKH4Lm6I6Qy5wuDfoix:ilnI6LnE7am68rLXQy5wuJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507414, "uuid": "d7dd52e6-7719-4f98-97c7-3ad82688c78e", "value": 321120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507414, "uuid": "0a64352a-0e51-4955-990e-af18f42527bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507414, "uuid": "99576f88-1ade-4979-8bba-f426465ad812", "value": "52317c44479795b9d7dff4ea70b6425240b8afac5dddfaa06859d6c44592d240.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694fca4e-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495219, "uuid": "80ea6ce1-8bf5-4343-b44b-25e29d69eadf", "comment": "Malware payload (Mirai)", "value": "7ea59d4c5c8b61336505cf6414e83f82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495219, "uuid": "aa0e58ba-fd90-4724-9ffb-1bf01f1f6033", "comment": "Malware payload (Mirai)", "value": "534a82bfc3bb64179a473f4ef945aa89b452ef39ae4b5b7fa72a063b1778ec07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495219, "uuid": "fcd066ee-dd4c-4454-b63f-988ad3177426", "comment": "Malware payload (Mirai)", "value": "950b01f16b2f111ada0991aa67ecc84cb3a4126b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495219, "uuid": "15ca5450-9588-49fa-9628-2c31353c9474", "comment": "Malware payload (Mirai)", "value": "accab393bbaccc91981b4d675a1270bb08f457367101dafffa526293aedccac847d040ef9267cd38ccfe402b94c27bd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495219, "uuid": "d4cf4387-38ea-469d-9288-9b90dd386f2c", "value": "T1A6F2E012905899ADCA7004B0E03B47C60FA417EDF0DEF07DAE05972467EE897BDB29D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495219, "uuid": "3cf31a05-49ed-45b2-bbbb-47f3e50c03b3", "value": "768:eKiQ47RQtL4cQDjul5Ag3M8VeOuzCUVut4Q6dF9q3UEL6F:Ax7CL4ZDC0g3M8VhiHi16OLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495219, "uuid": "b8baeb69-4314-4f9a-bdf2-077bef33f852", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495219, "uuid": "f6fb7c2c-5112-46fe-9438-3e2c6c5b6d31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495219, "uuid": "b1c1454e-e1f7-4dc3-8be0-aed8469fc6b1", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7155cd2e-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495233, "uuid": "c984b159-0e06-4786-b4f8-56a561ea12cd", "comment": "Malware payload (Mirai)", "value": "dcf3bb4dc82e8e0cceff93f4a56b6ed7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495233, "uuid": "1441a523-178f-41a5-ab87-14e96d0fbe87", "comment": "Malware payload (Mirai)", "value": "53a3c38e0160fdfb5fad48908eb383b40edad0fec9c9a9a501802a43e2ac6262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495233, "uuid": "9764a0db-7443-42f9-bdd0-afcee89cc628", "comment": "Malware payload (Mirai)", "value": "ca34739f1b445c1ad1c9dc92627eb0740fd5c164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495233, "uuid": "05b98830-8354-42bf-bced-f24155cbb551", "comment": "Malware payload (Mirai)", "value": "0721517e21b84619171b91c7dfb72bbbe1948823b2281994efcb8d01b5469b607fe66ca257e76b0223b4b4306fff77e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495233, "uuid": "5e96e863-41c7-4a25-b2fe-f2bc0a1c3a30", "value": "T130362951F9CB44F6E9031E3055BBA23F57315D058B24EB97EA50BF2AF97B682093620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495233, "uuid": "1e890739-0bf1-456a-b5f5-5074e8b7bc9c", "value": "49152:AjUXefqzdPrCenobTpsU1nGY2zgMB5KZS0wxuT5iRbsDB2EY6VgfT+lCgy7E:TefSkpz1Gl1xuNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495233, "uuid": "23e99e4c-21ed-4d43-9735-6e5b4c478b60", "value": 5103768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495233, "uuid": "427b9ce3-385d-4bc1-8ce2-5018db261ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495233, "uuid": "6cd1cec2-7437-45b1-82dc-341c5c11dd1c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc884b6-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494393, "uuid": "7f87683c-3001-41bc-9cad-34e32d56ce5d", "comment": "Malware payload (Mirai)", "value": "6e33d1b08757aedb72b82ea5ff424e15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494393, "uuid": "f3ade2ab-8b71-4d76-bcbd-2ad2c817f632", "comment": "Malware payload (Mirai)", "value": "55751178338ad9301070bd41f6aaa12124bd9b6efeecfecf892c2a506f3b3f1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494393, "uuid": "a2cdd67c-8e62-466e-b66d-a126224672cc", "comment": "Malware payload (Mirai)", "value": "67d76e0aa0a426b0c0c8d0b34265edebb2f39360", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494393, "uuid": "5514f866-b40f-4ac5-8fbb-fda5d408314e", "comment": "Malware payload (Mirai)", "value": "d09609d395f774f73a57110e1244e072b7bad3b1edd35cd01b145c026903886211d5219bb3681b771142f8c605c84454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494393, "uuid": "eaec8a85-0ff7-4d7b-95d1-05d32798fcfd", "value": "T16F634BC9F983D4B6E857093010BBBF639DB3DABE3168DA43C3A855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494393, "uuid": "93a85d80-9552-44b2-80de-30d06110eb36", "value": "1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSYo:ltFyA0j4HWBJOvwfIyqso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494393, "uuid": "25f1c431-5043-4dae-a43f-1c41edfccfd1", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494393, "uuid": "784d4aa6-9e35-430b-9288-240efc09870c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494393, "uuid": "ae026cc8-dfb2-4060-b14b-db4c44f5dede", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f4af3c-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495266, "uuid": "3b859044-1c19-4b4a-95d0-f474e6eea520", "comment": "Malware payload (Mirai)", "value": "55f423149f83b85978da22079ab72c4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495266, "uuid": "7e25c281-8bbe-4556-84f0-e24ab0c6ea8b", "comment": "Malware payload (Mirai)", "value": "56143d7e81efff33c746bfb28820bbd9ca662a388e0185f49c3fbc5a96abb51d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495266, "uuid": "4a55f079-3382-4508-a213-eee1ea786443", "comment": "Malware payload (Mirai)", "value": "6f4d3b862bf01af51e4f9fe14348d85de781a6f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495266, "uuid": "55e40c0b-3c69-4d5c-ae5e-b5285ff525da", "comment": "Malware payload (Mirai)", "value": "c109f80cdee07d7512b182ae6af1cbe899d247299cd913c95dc662e8f1d41a070d9d5f01314bdf3bc96853d40e0f19e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495266, "uuid": "648aca3d-1513-4841-a7ad-5a93e0124cec", "value": "T1C54619536F28EB0FC229223469B1CED467391C4646DA9917B341F309A9F20BC9D6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495266, "uuid": "6935504a-1fa3-4d76-99d4-e40782f49454", "value": "49152:AJhoi7csuXOWJvXR1QOQjt5nYExz0vNiFbYw/59Elc0dcNrZutcD6rDwzMzs8WTZ:A2MzZs1X0r0nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495266, "uuid": "2433cc02-171e-46d9-9029-519f8df2ab9e", "value": 5832887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495266, "uuid": "21a2c0e8-24d1-4a33-a305-239b80dd7e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495266, "uuid": "9438f85f-d70a-4ba2-a2d0-ccac6bdf39b4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c7fcae-1f39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773446606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446606, "uuid": "c81372d5-f605-43fe-864d-0b95840b4539", "comment": "Malware payload", "value": "e7f9c14405a5104f0290343bc9035257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446606, "uuid": "3f97aad0-7a82-43d5-bb02-f1ac5796c0dc", "comment": "Malware payload", "value": "56d46ca82f574ece7c3f2abb24a555bb63176b5c30af4153a00509a17a4050d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446606, "uuid": "f2298c9e-7e1a-4a28-a3fa-10942757f628", "comment": "Malware payload", "value": "91bf37dd1d23b48b39d50ee4cb31d2fc1ea62983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446606, "uuid": "12db6e96-9a18-4ecf-bee9-47ef17ecb173", "comment": "Malware payload", "value": "80d7d64fbbd0b5dce17642d705651438952d140669e367c33dae19ca470779c17d303af27f17c2f1b655024af00c90f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446606, "uuid": "58d39d61-5000-4600-96da-3bea89f4cf6f", "value": "T19B07AE23A271DE0258A7EDB2EE87DACC0371E4EC586140C15546B9F9B5D2F886F7C329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446606, "uuid": "87a7093c-3d19-43c0-9755-c896d7d84d7e", "value": "b0b2688e142f75d254b8b8d0c9ac65fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446606, "uuid": "7bb45912-5942-41ed-a972-206f4d9b11d1", "value": "24576:3RN4OPJFYKT4ysgNMi4cVSN7f4o7MrQnULGtp5s1DrQw2A5oMX2uIjIxfj0m6tqE:nL5hPNoq04zjkkIJdQYHkFEZj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773446606, "uuid": "344f3a1f-1a3a-4a0d-a032-c140f0a9a50e", "value": 17853556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773446606, "uuid": "bcf92fff-7472-449e-828b-2f0a906bab98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446606, "uuid": "359c8113-bc9a-46cc-8aa0-222ed3a24db8", "value": "download2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744fecf8-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495238, "uuid": "41630fc0-692a-40ec-a3c2-eee35026a28b", "comment": "Malware payload (Mirai)", "value": "d7c58319628fb75e66c979317bd8b6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495238, "uuid": "db902169-51c5-497c-be80-ca6766954b98", "comment": "Malware payload (Mirai)", "value": "56d5f98f55e8a25c4cf34b9178c2aac7a531fe16b5cbda7dd9ff68faa7fbfe88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495238, "uuid": "f5833996-4208-4e8d-b6c2-06cd4e0f9cef", "comment": "Malware payload (Mirai)", "value": "faeab4753924b233bbdba031f231e0ff09980c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495238, "uuid": "65e3467c-1a96-4c0c-ab13-b9c17f6fad76", "comment": "Malware payload (Mirai)", "value": "e4f373193f7c7979753aaac70acffff9c680cc8080a776f90f3d8fb2dec9e0e2e2fc8a4f19c484b61fc731d1ea8e1ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495238, "uuid": "bf728fb7-54f8-47f6-b9ac-74856eb85cf6", "value": "T14A7329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495238, "uuid": "cb2ea1c5-beca-44ea-a761-423e06f42eb6", "value": "1536:z3OL3wr34Qu3EhvOy0sxomE2FH4ZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxom74cp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495238, "uuid": "9eda99a0-883c-499e-911e-c058da89dc56", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495238, "uuid": "8d01a40f-31d0-40bc-992e-715bc4531a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495238, "uuid": "1dd6ac2a-3056-4a1b-8f57-ce1770ffb0da", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925f4317-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773515045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515045, "uuid": "baa9e655-e3c5-49d9-aa62-19575425bb19", "comment": "Malware payload (RemcosRAT)", "value": "7b90c05119e26fdbfa1d7e43e8d20568", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515045, "uuid": "384c6e24-c6f5-4b04-9c74-12d8ddf484be", "comment": "Malware payload (RemcosRAT)", "value": "570693a6bd10e98ca7c67510f7da41e11ad6d055179c7a9f9bfdd9cf8a39ac78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515045, "uuid": "abc3eda8-1786-4d78-85ce-69dfeb9e2e8d", "comment": "Malware payload (RemcosRAT)", "value": "6a72dd39962561eef52010aa444cc9db4bc110ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515045, "uuid": "94d82a2e-715a-4a9b-b0e1-f0ffc4c855d9", "comment": "Malware payload (RemcosRAT)", "value": "38e0f4cde759d6abb357ff4d2cf7ae47f430a8681f07363546e5eedd3c16cdf526fa4e4415c1652eb24bd454d618120c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515045, "uuid": "3cdfc485-2918-45c1-90ad-cd08a8b2eb2b", "value": "T1B463EBF3474E3570936E498B262A85F824E3BDA55AADD8B4F5C3FC560B47ECAC12011B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515045, "uuid": "1e012247-8cbe-448a-9268-81cb5bfe4dea", "value": "384:G88888888888888888888888888888888888888888888888888888888888888Y:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515045, "uuid": "4b8d84f0-eb7c-450b-bbca-63445fcf631a", "value": 68711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515045, "uuid": "428c261d-122b-4a57-8ea7-0f07d5bbf474", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515045, "uuid": "60382a7a-7919-4283-b5c6-00ab3f57c8a1", "value": "7b90c05119e26fdbfa1d7e43e8d20568.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4632bd8a-1fc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773506757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506757, "uuid": "c97502b6-6d9c-44ab-b8ea-122ef26219ef", "comment": "Malware payload", "value": "5509116cbf4a40b1e1994f2ca2030295", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506757, "uuid": "247221ba-3f00-40ed-af80-53793e08ff44", "comment": "Malware payload", "value": "573fda1fd84bb5ba3fce19962a7da7a20c09cfae952c6c2c8340b9b352f943d1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506757, "uuid": "9485e7e1-400b-4a4b-92a9-5a5411a51f0f", "comment": "Malware payload", "value": "8b689da98f2acb6440703d8b3da74fc91064bbbf", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506757, "uuid": "e4a0f908-e05f-4d2b-83c6-0eae7eb168c4", "comment": "Malware payload", "value": "a46bc213190404ab845852e76ac12c3c66459e61dfd8a847e568ed28885b75da5a61ef99da2151ea94a8506ae6338f58", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506757, "uuid": "80a7d1ff-0138-4989-ae5a-f99a491860f6", "value": "T17915022DE895FDBADD12193983B5D0DE8670BC0BE65993470FDC3B091076AE8A2CD538", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506757, "uuid": "8c74554b-d055-476b-98bd-ccfe75717ae7", "value": "12288:vgBtc+wVrVw6ozu0YBqrEuhmUSegBtc+wVrVw6ozu0YBqrEuhmUSEzUUhyn8:SOVZw6oh5E2mUOOVZw6oh5E2mU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506757, "uuid": "2b6fa322-72e4-46d3-8be5-31b13cfb88b0", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506757, "uuid": "99b8d320-8cb2-4056-ac58-fa4260b94757", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506757, "uuid": "d2962a78-acdc-401b-897f-005f20ecb906", "value": "5509116cbf4a40b1e1994f2ca2030295.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd70ffa1-1f46-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773452411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452411, "uuid": "4cc7a22c-6337-47e4-886a-39007a99ee98", "comment": "Malware payload", "value": "4ddf16c392f6eb2aaaffa208be59e417", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452411, "uuid": "85fb6f60-0cd4-4a35-8f7f-634d0243ce7c", "comment": "Malware payload", "value": "57a87b2e8df046b42632dbe97bf4c0f3673c7f9d58b370aaa10d5e2c429f7004", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452411, "uuid": "7cf0f265-597e-45b0-aafc-283fa215097b", "comment": "Malware payload", "value": "f6bb40f0b43c226ea519e1c7d00418cf0667212a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773452411, "uuid": "d8b355c0-0ae0-4c5a-b52d-012acfa398d5", "comment": "Malware payload", "value": "29bf586426a4688e416102e7edb2b8fb839b2ea8f2438a76cefd8338e40c66802ea40c16bed26564fdf675186fa6a446", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773452411, "uuid": "940cc626-b834-48ae-a124-e99f2c80a327", "value": "T1B05733E9A8B0019FFE37D8349A7D49A8D1E63D7505434C233AC4B34925F77E432B6A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773452411, "uuid": "bfd59389-9f6d-4995-bca8-506725790231", "value": "786432:V2ICB0tryvjf8lK/7VVnNqrDyHZOb11ikH8yWxu:V100tryvAlEN/HZOb15H8yWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773452411, "uuid": "6f0bd277-be4c-4fc2-aa8c-93236a93b3f5", "value": 29302784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773452411, "uuid": "52409622-3a97-4fde-b38c-5aabf88c1f96", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773452411, "uuid": "036434e6-9bd0-4a16-ab4e-b32fc9e44207", "value": "Attack Sis ON.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef74951-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501913, "uuid": "73b03e1e-d99c-4092-9ba7-a20ce621455b", "comment": "Malware payload", "value": "d6884da28ead540238d5af21ed72a13d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501913, "uuid": "defd75c9-fda4-44aa-a1dd-7f227f8fdf8b", "comment": "Malware payload", "value": "57f5198b967f1176ce97f30e38204d7772102096a24b1d6c948f3cb8aca41bd9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501913, "uuid": "a4ec61d7-2bb4-481a-ab7c-5891c9d82373", "comment": "Malware payload", "value": "02452094680238a4e9ffc256914fc3a7161da4e2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501913, "uuid": "104c22c0-3cf0-48c8-a28b-935497dfed05", "comment": "Malware payload", "value": "262621b61d069fa830ad0eafbcb382806dd7cd62d71c845954aa0cf765f750a04dcdec7f1fdede60fe9f39b7cb428df3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501913, "uuid": "0ebed72b-ab98-4176-9299-ea7c2c6e601c", "value": "T18C6733CFC866462BE96E893644F18D898D10BE52C6725D37716972C67BFFAC0343A80C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501913, "uuid": "343bb8ba-d5e5-4479-8bf7-78096c28d884", "value": "786432:KypGSHeKaaA/YPR5GUpXqxH7aVB4XqUs9FgMcV3qr0:KzSoG5GM0baVBIs9FK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501913, "uuid": "55a5a089-c39a-4349-9493-58f004d5cc55", "value": 29786112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501913, "uuid": "d5cfd8f4-28bd-4e79-9da0-9c31e44dad44", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501913, "uuid": "10ee4c5b-24ce-436e-822d-1d70599fe962", "value": "Download_Movie_Maker_2_6_For_Windows_7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee93ea2-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773477458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477458, "uuid": "1fa491f8-3e8c-4dd5-abef-adc6680044a0", "comment": "Malware payload (Gh0stRAT)", "value": "d9c552dc9912c63d66501ff57e134817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477458, "uuid": "2de896a6-7bcf-4e25-9380-73eb7857e9ad", "comment": "Malware payload (Gh0stRAT)", "value": "58802bf282ec84421a1a1d64d676cf1c5b189843dc7bb11db3e449ed16d3da30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477458, "uuid": "76501c9b-959c-4851-b788-493373e6f442", "comment": "Malware payload (Gh0stRAT)", "value": "30c82cac1e1b8bd7b8e75311500945d929ef95bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477458, "uuid": "733dd1be-3998-4b6a-8201-dffecf2ad43d", "comment": "Malware payload (Gh0stRAT)", "value": "0e8dac9b7a14ea8b3b645b53ca81b312bd2b9419e555c17132c82c018e7f18e6ef75666e033a0ce8bec7a0ba43466fe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477458, "uuid": "bf82269a-9d71-458c-a2b2-4215b25f57bd", "value": "T130E422F12A64D42FE09841B2E74DE43276E0DCC278A10B3297E57A1DB3C940BFA79635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477458, "uuid": "0b28be6c-ea4f-4fa7-877b-2c609647ae5c", "value": "8d06ff0f301182c5ba233d45a52ee9ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477458, "uuid": "d3dec93a-7b91-4113-a760-3f8945ee859f", "value": "6144:PQJf3uMxrbLgEN6S7KzA5x3S5+y3D82oC0UdkgxgfOqG:4J130ENL7kArI+y3XipfOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477458, "uuid": "8c9d467a-fad8-4627-a28c-8a8574588bd2", "value": 657840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477458, "uuid": "a47942c4-0853-4845-baa0-d27c41ed9b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477458, "uuid": "5971d9d4-93f4-4b46-89b3-e84874ac66a9", "value": "wininet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c525ae-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773486538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "81576f5c-20fa-4e42-a02d-19895458e8b5", "comment": "Malware payload (QuasarRAT)", "value": "ba198835c37707d77ed34a5265ac958d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "e4f84d59-aab9-4163-9374-754c29029b2e", "comment": "Malware payload (QuasarRAT)", "value": "58a901e3e5abc71192df4ae0f8e2928de0a3c1f2ee438f39c75142967f6ffc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "f08fc295-ab6c-45ad-b902-27fae1f38878", "comment": "Malware payload (QuasarRAT)", "value": "9061a2bf539ab290b9bfdabafba82ea9849361e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "87e788cb-60fd-4397-9df4-fbc5687cd4ce", "comment": "Malware payload (QuasarRAT)", "value": "7f497ed7d1f9f844d81b121252513c8a8a98bba152a032a676048b40e0b759f118e26ecfd283db4b59fb91510ba2c361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "e45cb61c-9457-478a-9808-156bea434659", "value": "T192F55B1477F85E32E17FD673D5B0501263F0E82AF363EB0B61826A7E1C63B5099426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "80815816-b34a-4c22-bb82-409da6d9e938", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "ba2474bb-ed58-48a1-aa3c-e88b5d48d559", "value": "49152:vvFt62XlaSFNWPjljiFa2RoUYIOM6DWD7XaYoGdeTHHB72eh2NTK:vv362XlaSFNWPjljiFXRoUYIOfDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486538, "uuid": "d7166c71-561d-4a53-8aa3-d36ed61bdadb", "value": 3365376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486538, "uuid": "7aa1f01d-1e63-402c-b3a7-8e4fc8ab84c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "f2daa42e-a74f-4d96-8e24-60e926e805f7", "value": "DollRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84fb6e3-1fae-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1773497177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773497177, "uuid": "a6183391-1c4d-4550-82a8-d3b57a36236c", "comment": "Malware payload (WallStealer)", "value": "e62bad247c046f8f5a0c75ff52ec4bed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773497177, "uuid": "94683a86-4aa5-4551-a2fe-ba1d22374e1e", "comment": "Malware payload (WallStealer)", "value": "591902603acc284754bfbe0dfaf3522edc3f8372f1a8152c5a86465808d90bf9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773497177, "uuid": "84065076-baf7-4697-be81-e54c062ea833", "comment": "Malware payload (WallStealer)", "value": "cb04a0c814dd4391ddef5a49f23bd038d9c88c4e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773497177, "uuid": "37b79039-a741-42eb-b22d-f8ffcc91ad42", "comment": "Malware payload (WallStealer)", "value": "84f4ad18c328f573bae35f5693d943c35bcb05325e2ea30e5ddffbadd266213abb58330f28ee2cfebadf8639498a65a1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773497177, "uuid": "1ec78d6f-ad57-47ca-9471-bc939dc48df3", "value": "T1E5F35D17B7A570FAD2678974C8520901FB727C754790AE9F47A00ABA1E336D0DE3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773497177, "uuid": "d8e0c083-9816-4dd2-985a-fc86d61f755d", "value": "0cfb126608aeef99c535f68ce8e92581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773497177, "uuid": "2d0b6e31-5191-405e-b11f-5e37c3352c54", "value": "3072:+nDC20MasVgvF0T5j74wOPzOLqP3P6Ybx5DCeq:+G2gsVg6TVtO6Gh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773497177, "uuid": "29b93203-522c-4a3d-835b-dbc118b3877d", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773497177, "uuid": "6f718c34-9051-4080-9f1d-22017c2fbbfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773497177, "uuid": "7de83b24-f323-4d23-bedc-44736e14905b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8132a24b-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494400, "uuid": "6abf7d49-71be-4f50-8d74-078edf4104dd", "comment": "Malware payload (Mirai)", "value": "c7365008f02ed4081ba58b306a065376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494400, "uuid": "3796d51d-701f-434a-a8ab-fb18a5c3a28c", "comment": "Malware payload (Mirai)", "value": "59bb0e447f2530b1cf41f20d8c592006d9ed8a6f8b6e0cdc289f8f0a502153a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494400, "uuid": "f32aa52f-7646-41b5-8ee6-97079f3f8ae0", "comment": "Malware payload (Mirai)", "value": "6f0e91626860a140f737b667c3559e0494baf583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494400, "uuid": "342c59f7-64f5-4c65-b39e-4a030eb86692", "comment": "Malware payload (Mirai)", "value": "17bf50d87e43cd0f32b986d582adf5b4f4641c9a0d89f322617ead4328f9039c04c36786e42e1d20ee54f0ae47e869a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494400, "uuid": "396d02ba-fa1b-4ba4-8668-6f00a15d33f2", "value": "T1D9733A57BA4080FEC499C03843BEBA36D87274FE1379729A23D4FE366D46E601E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494400, "uuid": "c64dd556-dbd9-47d7-9fd2-a81e0acda4b4", "value": "1536:BzIDxEwvZ8bouGctIb/+w4HnC+8l8AnzcU3:BUxEyZCXtIf4HT8l8AzcU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494400, "uuid": "15b47d32-d026-436f-ab7d-38edcd176e71", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494400, "uuid": "77615e49-a4a6-46a7-8753-10e0d8f471fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494400, "uuid": "43132ace-5ce1-4e44-ab9d-942acd845285", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada7ba66-1f7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773476007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476007, "uuid": "5824ae21-8e4b-46dc-be64-48ac6d0af174", "comment": "Malware payload", "value": "5e282f31200af69d1a349dee2e11ba56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476007, "uuid": "2ac19fa8-4c20-4f30-87c9-3e15d9031f38", "comment": "Malware payload", "value": "59e537f5ce8be429eb8f6ef2934702347608601e1a29b4fc49474e2e760324fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476007, "uuid": "1ab75bf0-dc0d-4046-8d14-350b07d1ad37", "comment": "Malware payload", "value": "19c39befbb4e12a1ccdd48e36b9a93f30bf5e739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476007, "uuid": "60fca24a-4866-4367-9fda-295899424965", "comment": "Malware payload", "value": "868c4c471e2604895dfe09adddd022b8b440cde93e86771253500b565e77dece74fa566b17090441e98e93447c64d87e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476007, "uuid": "082ad23d-ce60-4119-92f1-8804cccdbe61", "value": "T117447C197B640CF8E8AB8179CD424545EA727C5247B1EADB07904BD39E237E0BD3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476007, "uuid": "5b9b9aab-ca4e-4491-a076-fcd0b1577c05", "value": "fd1437e56dc3c8c631c1061ce50adfb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476007, "uuid": "32720d12-2257-46e8-ac5d-07ab1aeb7e6d", "value": "3072:syWfJjH2U8mqZlLwfI6Y4OBvKxOwegfyQ10LbJpdvp+uIYnBUs1hYEvRQKkYEYxh:syWpHalLz6Y4OvKYwVqvp+oDhY0EAmVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773476007, "uuid": "a7952cff-bb8d-470e-88fa-a1d27e2f6fbf", "value": 261384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773476007, "uuid": "9f6b3b7b-973b-420b-a7fb-e998ca930675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476007, "uuid": "5eb2038f-a3e9-4280-b7f3-f866a6eefb12", "value": "semgrsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfe6b22-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516298, "uuid": "2a52297b-d795-450b-9ced-331f17d30c87", "comment": "Malware payload", "value": "26af8743e2a48e9a09113210f68bdfda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516298, "uuid": "5b34efc2-1e15-4399-9968-92a536efdc6d", "comment": "Malware payload", "value": "5ae4891f9868482897e45b85b24f5e5f58d40bda0c3bdcbc51a66f4de009e536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516298, "uuid": "cbca31e8-52c4-4872-8dcd-d2483e0e0e25", "comment": "Malware payload", "value": "2bf6d8cba5df2c85d7acbae71c5ea20f09ffaf98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516298, "uuid": "4e546ee1-566e-4874-8989-360df373e93d", "comment": "Malware payload", "value": "cf88319594064bff28b7b70cd132bbb2cc635eea8aeab13e0049c92d6b322a5e2f4496fc3f3778dbfbd469ffef511461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516298, "uuid": "212e1670-27b9-4de9-91da-3ffad74a93c3", "value": "T177B42790926C8724D8A518B4AC63446A2F74BC3D4CE6955D7CDB38DB2775332EA3C22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516298, "uuid": "f21cef07-36e3-45de-b9fc-98484665e6df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516298, "uuid": "0a7ccd8b-086d-4d54-8f54-c067338a1e8f", "value": "6144:BjodSpIAQr1WnzDVZR+NpS+/D9SIAQr1WnsDVZR:BjodDjxWzDV4A+/DljxWsDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516298, "uuid": "71d200ff-9374-4393-9816-e7144b1248f6", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516298, "uuid": "d22597a4-48f9-45ae-bdd4-0980008348d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516298, "uuid": "3e0974bf-b2dd-49dd-9793-f4eef27ab750", "value": "SecuriteInfo.com.Trojan.Gozi.2124.24494.32319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d8dc33-1f82-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773477871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477871, "uuid": "8a7a4e6c-b495-407e-93fb-725be2cd276e", "comment": "Malware payload (Mirai)", "value": "cb0b2f970cd70fdb3616d177da905936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477871, "uuid": "4854b86e-070e-42cf-a6b0-35de27c46b41", "comment": "Malware payload (Mirai)", "value": "5b7bc05dbe971da27d120023429111726b05a2441491299a6ecac5f7bd2ca22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477871, "uuid": "ec572fdb-5ce5-4b5f-b8f9-990851aec812", "comment": "Malware payload (Mirai)", "value": "b05c0a1992f80429eb6d6bcd2025bbf5f16e7e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477871, "uuid": "4b5fc3d5-1c9d-4685-8b2b-7a2db0f494df", "comment": "Malware payload (Mirai)", "value": "c9fb11f68729a78264c96dc1977e7d262a9e830356d895e197de816224a03d5474e19d0f271c34b7f5c02afb9c3d4bbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477871, "uuid": "e91c5115-97b3-4563-b777-2d3dda6a6637", "value": "T159A2E840B9828D17C0C55272BB4F51EDBB16532CE7FB3303DA265FD92A9FAA24779840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477871, "uuid": "e4fd0707-cbde-4d54-ad08-17a01be97f7a", "value": "384:vE7SHfH/nwAXn1Ah21bVPNqDXnC1fYtfHtxoFKB6cjypZoFx4eF:vE7wHfwG1c21bVPoC1ooqLjy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477871, "uuid": "c31ef527-82cc-4ab7-8215-c75b3dbed270", "value": 23376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477871, "uuid": "875c2e47-9154-4937-ae0c-f2ec3efb8e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477871, "uuid": "38b68478-d5f6-4e94-a8f2-7c5e3f6f7695", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f63a824-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495229, "uuid": "8d836ad4-9c1e-47c2-b3f7-ec0408e6979d", "comment": "Malware payload (Mirai)", "value": "82dddc8d409784c8470bd89a3d4e0ad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495229, "uuid": "90a92a5b-ca08-45e4-9b28-e95a65743190", "comment": "Malware payload (Mirai)", "value": "5c2b0c3b192eb72d4a760c8ac84fc858a9139bed2d94655740ce6e81dc7d5d40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495229, "uuid": "1e14dc92-55c6-4219-840f-22f354230f7a", "comment": "Malware payload (Mirai)", "value": "e5d85acf5c2e135514155178ca851911a7a762e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495229, "uuid": "d71b9c7b-63e4-4375-9a9c-b5429f67a984", "comment": "Malware payload (Mirai)", "value": "7044d7349c2b95b07ea3262aa828e252f9f1daa217718fa266bd0525ae06803d7b4daf2a828764c0c4d05a651513623f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495229, "uuid": "c4077c28-76d8-466a-9f4e-166c85e6ab8d", "value": "T1F4933A237E361F27C0D274B622F30720F5B16BAB28A8865ABC712EC9AF195D03547775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495229, "uuid": "403db11a-6a12-4953-98ed-a9064127704d", "value": "1536:i/zP+cHfGSHgCp7HV8Y+tpBHPSkmtOAKYM5InkFnqkUretXTfo9VNN6n:i5Hxb2PfHPSPcAKY82aq2uqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495229, "uuid": "b0bb8d6e-6cc5-4db1-917f-382b1e1a8577", "value": 89772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495229, "uuid": "2e787715-bc33-400a-9f29-bea8bbf28d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495229, "uuid": "a6e7e8eb-5807-48c7-90af-ad7002daef12", "value": "xfr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e1086b-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773505151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505151, "uuid": "8cdc6053-c212-4faf-8c4a-2e2d6fe30a59", "comment": "Malware payload", "value": "559e6a232d8b38ec53ea67909943976b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505151, "uuid": "03450bb7-865f-4af3-87ff-697eb51faf24", "comment": "Malware payload", "value": "5d24bf1926537fe6c8d7f2b51175d03d51c151d669eba55540ff176cf1f55b10", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505151, "uuid": "2922165d-dd82-4401-b097-5590a954006b", "comment": "Malware payload", "value": "d6bfebffe0cc1c0d0f5382903700148ac2c9d712", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505151, "uuid": "0ae2779e-f7c5-41a1-b21e-aede5c56d86f", "comment": "Malware payload", "value": "0917b7e90fd112fc21cde45d4bb03bca021c96f5658293d421d628275d03934f1af1eeeb183e0d361570c572c376c6ec", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505151, "uuid": "70d86839-5c2f-44aa-9b2a-8ecc5dce7f0e", "value": "T1F0642344A338DB001BE8A676B67AB7801ED4CFC2195DE67BF944889F8317A97D247C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505151, "uuid": "1e368f80-5e5a-4ecb-9922-603f360cccdf", "value": "6144:fHGtZW78EYLw9uucrgDqEOqEpHMI0MfLcxMLPEw3lMZFJqPbj:+1Lw9PcMODuVbxsDMZFIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505151, "uuid": "a832c1cf-9ce9-4419-8fb8-4ae92b019921", "value": 321143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505151, "uuid": "63ee3b58-cb70-4ab2-b3b4-e4e81bb934b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505151, "uuid": "a2b561d1-13a7-4f2a-82de-01057fbada79", "value": "5d24bf1926537fe6c8d7f2b51175d03d51c151d669eba55540ff176cf1f55b10.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea64537-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493779, "uuid": "546bde4b-91f2-4f2a-be87-e226e08ff921", "comment": "Malware payload (Mirai)", "value": "a88ba263f535246b08f23a53b69ab2ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493779, "uuid": "8c052c79-30a5-4244-800d-4d9c2dedfbf2", "comment": "Malware payload (Mirai)", "value": "5e320d97c19c57d74e8a4a995afbaefdeb7e0dc9e6e4b96b385c07a92eeff953", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493779, "uuid": "d96eaa3e-1744-4f63-b682-22cd9f17ff8c", "comment": "Malware payload (Mirai)", "value": "5311d90e04d326c4579760886d31aee462691514", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493779, "uuid": "51b1d811-206f-4f64-a101-5014ceb547bf", "comment": "Malware payload (Mirai)", "value": "bd54b37aa7befa9b3db641f073a7712f6e5855bac78b001812b7b1ec306c307eb9e3680ef5edcdf7d70bd99df243665d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493779, "uuid": "f06e8d46-6fab-4fdd-b3f0-eec89d905b1a", "value": "T19BF47C06EF851FABC4AFCE34855EC31B05EDC48706D2A23961BCC96CBA8D6694FD3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493779, "uuid": "7318e1e9-7dd1-4207-a1d5-8a3a1bf79a6b", "value": "12288:OOlN+7znLMd8kOMNg9CnhZq95n4j7JLRKOEfFiB1TR1DJ/Cq7znPdlRqYf0Sk7jY:NVbMIBwxkpf18/ug/9Cz6IxaRyQb8bY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493779, "uuid": "3c82ea67-f1c0-4f68-91a1-91e5d5bd4321", "value": 724020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493779, "uuid": "a0992cf9-f191-4e8c-9cd9-cd1381d6c7b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493779, "uuid": "cec4670f-1ca5-4737-ae5b-eddab255d231", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eaf6fa9-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773516220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516220, "uuid": "e60eb331-6b66-4642-acab-1a1e8701a773", "comment": "Malware payload (QuasarRAT)", "value": "adb74c759ccca8a1267d4955fd33f888", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516220, "uuid": "4ff1a71a-d859-4b65-b054-353e5e808123", "comment": "Malware payload (QuasarRAT)", "value": "5e510b82cf1b2d9bac0e36097e210758ec2b872497eae5de38d51df23cb6ca94", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516220, "uuid": "fbd253cb-3e29-4000-af16-e91cda516412", "comment": "Malware payload (QuasarRAT)", "value": "b56ee24f978970973cb6a6ad8348ef1a27bb5936", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516220, "uuid": "1dae2e5b-cf47-4e56-bb19-d41caf7de373", "comment": "Malware payload (QuasarRAT)", "value": "77cfcc2ae93f731bdf03cd2cc35d19c350131b0d9dcc03e29afe28afd609d7ba13d80798561031bfed2940a38851cb36", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516220, "uuid": "b10c2d48-fc74-4b96-b1bc-44a34d38b33e", "value": "T190751231867ABD7E0A5D3F4950073EC55DBC6797019CD1B7EA85AAFBB2B21D0CE09820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516220, "uuid": "9189fc50-4712-4aef-9c86-8e19bf0dcca4", "value": "24576:zgttudbj88aoodaJDTxDAlSsaYQutTbk0l3+3DL2JIKoJ6U3g6:MCc8a8hduQutYztz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516220, "uuid": "06c01b4b-1e2d-46ca-83d8-48516521d4d6", "value": 1610917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516220, "uuid": "e15fd48c-d4b6-41b7-9012-f0911144f07b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516220, "uuid": "7b6a9125-6d10-491c-8f2f-788377ac5c85", "value": "adb74c759ccca8a1267d4955fd33f888.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d21335e-1f53-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773457698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457698, "uuid": "e393dbb4-b8ad-417b-8d27-00ae71958864", "comment": "Malware payload (CountLoader)", "value": "50711222d27a35ead9a223625aa4a14d", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457698, "uuid": "a8282ccb-f814-4aac-adf2-a53391e9ef17", "comment": "Malware payload (CountLoader)", "value": "5e54ce0c7611d0bcb72827e07020cb028c22cc1a1f2dbc960db513c08440c8ca", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457698, "uuid": "b0a8f674-82d1-4c75-b295-12c03c97fd3d", "comment": "Malware payload (CountLoader)", "value": "e3ebc343abbf7f0b8a72628af0cbad6af92f8b9a", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457698, "uuid": "3d62c130-66b0-4ede-8616-f91c1752a935", "comment": "Malware payload (CountLoader)", "value": "3ae8687a4b56c11bece2dd5c88be5436335ed4deb8a245536e52469f72232ab2e8eeadd9bf52df8f1bb00204cde3981f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457698, "uuid": "b22b75ca-b283-4d3b-ab5d-0b01457cf218", "value": "T1FFB3EB895E8E86B2CB5FF134461E1C27AB9DA166161EC48079CEAF483F118F471BEDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457698, "uuid": "d4a15fbc-aa0d-49c5-be49-af884960381b", "value": "768:Mygccv9LqbYXPaUzpQsqL6b6m6a6j6T8hZaQlomqxuKA/zAT65ckwi6E7MvF8WVz:MJ3rpaFVqS8/67VmV77v0MVWCxjGbb+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773457698, "uuid": "cd86ef32-f7a7-45dc-88e5-bc641de8a1e1", "value": 115455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773457698, "uuid": "9ddf0e15-02db-48a0-8d93-7129e4691b11", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457698, "uuid": "2885868b-aa1a-4a89-910d-a71911cd7fc5", "value": "Photos_Release_v9.9.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9895066f-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507324, "uuid": "334c6139-6d12-43c0-b160-1e16f37d630f", "comment": "Malware payload (ACRStealer)", "value": "0649b83ec18654457ad3ac99d0ea2a26", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507324, "uuid": "47223edb-d3ea-465e-845e-45ff615bc208", "comment": "Malware payload (ACRStealer)", "value": "5f470721561861981a571e79e56a1887e29ea53fd0968e44740a8340d5b87ebc", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507324, "uuid": "ba0d9e12-a9cb-4f0d-bd5f-7f83ddccd250", "comment": "Malware payload (ACRStealer)", "value": "86e1226d2e282daf65b4ad2281e1cae2dbe99b92", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507324, "uuid": "3b37e95a-aeb0-416d-9aa5-eaadf5bad06c", "comment": "Malware payload (ACRStealer)", "value": "c730966527d355fbda1f1289e4bcccf731d0df78cb4a46ce9100a0ef19937e8efeb8ef413bb6b9cd6c58ba3996b4dcbb", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507324, "uuid": "9c9c6b7c-9438-48cd-8389-4f81f6c033a8", "value": "T14AB5285562CB26FAF70B0936821A921FE75B6D4C2F14C5EBD2603D16EA3BFE1903C641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507324, "uuid": "041ee020-3b76-43d0-92aa-f8d921319391", "value": "d4359a3f50a9797101f50d3247735a02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507324, "uuid": "98377a39-5258-405a-943a-5c1cbdf1875c", "value": "24576:yAJZA1kQ4AzToIMTDrA02uCutKmtpxhb9QVFvtcVc6/LXjhD9DaVXRo0Idt:GeV/xUPV6/LXFD9DaVhPit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507324, "uuid": "962ebada-aba0-4db7-9055-52ba5c0b5c5c", "value": 2390528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507324, "uuid": "e424a0bc-d2a6-4bef-bf17-aa8c5a97e2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507324, "uuid": "99e34a52-172b-48d7-a615-80b4f729badd", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0223a70-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773516008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516008, "uuid": "45f28dd4-8471-4866-a539-d723d490e46f", "comment": "Malware payload (AgentTesla)", "value": "2f421c0043a37cb28d0f0126b9f6a818", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516008, "uuid": "06e5f930-4306-47a3-8b66-9f1a14506168", "comment": "Malware payload (AgentTesla)", "value": "5f7826443471ded5ac06c757ca42e7ff69718f525d8fb44c05a441ec3adc81f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516008, "uuid": "095f59b0-5954-4e64-88f3-a2b7c68b1356", "comment": "Malware payload (AgentTesla)", "value": "6256c4b9e2258baccbb5a5407e4008ad80bed45d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516008, "uuid": "ce99c025-773b-4d7d-9a9a-47362279450d", "comment": "Malware payload (AgentTesla)", "value": "d29dc133270567fe8f2b2538346b2fb3895ecdc66a00c7c6defa3afa3315b4ae156fee4b568fd8541aac9e55365d7d9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516008, "uuid": "38ee3050-7acf-4082-b838-9da72663cc21", "value": "T1683513A9193C09F0D52297538623315FDC14242E23736CE6FE549FAAB33B8B909F95B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516008, "uuid": "714b4d88-cbfb-44f1-8483-778fc9a8e430", "value": "768:+jhwv5YCNeCXk1IDfepztL5kLeI4Le4LeOLpztL5kLeIJoekpeeoC2zVC1uMJt1J:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516008, "uuid": "0ed56535-99ad-46e5-ac9f-a2115511bc45", "value": 1117428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516008, "uuid": "8c250585-4873-49ca-ab66-6840d4e6df81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516008, "uuid": "7843a798-5d99-40d6-9ebd-2a55df923a58", "value": "2f421c0043a37cb28d0f0126b9f6a818.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c970a7e-1fb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773498956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498956, "uuid": "0788b2a5-5702-4883-b15d-d63c132ceadf", "comment": "Malware payload (Mirai)", "value": "f3b983127bbf9b812992634562ff355b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498956, "uuid": "ba2a9191-f21f-44dd-a72a-795c3d507747", "comment": "Malware payload (Mirai)", "value": "5fb59eb6db2c7f5260e6c037341caae2a680b1f57d20ab7a2b6a702c9f333da6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498956, "uuid": "cc5d402c-4d01-4c7a-9e48-7fad45c09403", "comment": "Malware payload (Mirai)", "value": "7caea2018f69166139baae1233f6537dcc86ea17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498956, "uuid": "c3ef0b9a-ce4a-4f3d-87df-fbe385b8a510", "comment": "Malware payload (Mirai)", "value": "23c9ba1b833d6aedd3042d576720b57ab770ae6b66a7cfb84e894133feadd5cc1634d920445aaf0ef9d8432c42a6783e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498956, "uuid": "1f39bb41-a313-4e4b-864e-c821b7212aa8", "value": "T16D63F186099B16DFC83D8D3CB27E5A239B40B16B3219A364F7258CB4DF9514DA9CCC9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498956, "uuid": "a7b70ea7-d44a-4d6e-baf0-ac00fd8beba1", "value": "1536:9GuejZRjSzWlr1BrK+11llGwIPXGRYnT9+VACL:9GLRjSzgbK+1blGGReIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498956, "uuid": "52369a44-24e0-4515-a657-4145c8d1ec57", "value": 68516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498956, "uuid": "05c13925-0919-4a2f-919e-0cb242f1d378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498956, "uuid": "ba94f429-d759-43a8-aa1e-8b998d92ca4f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f13e8a5-1fd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773513295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513295, "uuid": "0faf0773-97f4-403b-947d-37e7cb83e842", "comment": "Malware payload", "value": "8f49468c1028a77bb5a5272ecd3f212d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513295, "uuid": "04b219c9-d202-49ea-8d8a-3f28eccc0e17", "comment": "Malware payload", "value": "5fcb32e1f7ed6c0419b687398b2856cb1f5f7040c3eb7585d986119a6c85472e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513295, "uuid": "f1bf3139-321b-4ea3-8c9e-ff75aae31c9b", "comment": "Malware payload", "value": "0363e38b238ccf5b6dcf377d1e6cc1ecacf64a1e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513295, "uuid": "0770a53b-c727-460c-bd7d-88d836fa443f", "comment": "Malware payload", "value": "3303afd55dcbe51b34aa2ebfbdab81e1f1d8d251c49316e245da1a9d7ccd2b598dedbfb8793626cdbebc4887aaaed079", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513295, "uuid": "574058ba-afb1-4a75-a459-911eda3dff71", "value": "T1F141BC2473E94310D331ED3B6878C60691BA3416ED33CB5D4BA1D58E246A604FE3AF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513295, "uuid": "677baa7d-70fe-45d3-a14d-a540acae8651", "value": "12:8UlDmIftmlvlwiGQmqY42mZU+XiGbVlDmo0qjaplDmIfc99ZTlDmo0q:8U4Ilm3xVpU+yQ4o08ap4I0tT4o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513295, "uuid": "cf056375-0a18-414e-803b-8803847ebdf2", "value": 2164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513295, "uuid": "bab0809b-1909-48ed-ab11-45da410ac6e2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513295, "uuid": "d74b0f16-14bf-460a-a445-3dd092079711", "value": "Completed Interior Design.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f1ea90-1fd5-11f1-a769-42010a9c0008", "comment": "Malware payload (AdaptixC2)", "timestamp": 1773513601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513601, "uuid": "ffd9f908-24d0-4124-8a36-c1ad119af9c4", "comment": "Malware payload (AdaptixC2)", "value": "874c88f6eb033e99c1ca7e09340eadc2", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513601, "uuid": "3455a558-84c9-41dd-a5c5-d7261f3b9ef2", "comment": "Malware payload (AdaptixC2)", "value": "606da9e8d627a1c95a90f876fcc465a741a1750a2c15cf4700f307f4ae108fe9", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513601, "uuid": "5de1d69e-15f6-4beb-aeee-14e6f91da269", "comment": "Malware payload (AdaptixC2)", "value": "70c86296f06a78e9104fdb1b8023df4ee919c8ad", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513601, "uuid": "a2e35df7-8d32-4799-8500-d1701871d922", "comment": "Malware payload (AdaptixC2)", "value": "2a265fa1b1e57f1035258fc6e03e2aef923f6077782a80bcdeefcc97ebccc9c9b0f105ca5dbb56f8fcdc701811be7df8", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "shellcodeloader", "colour": "#9FAE81", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513601, "uuid": "f465cd99-f474-4241-9689-6e4210e612e7", "value": "T1D4B31246FF6009E7D072D37A8415A05FF075F2A113B2D26F230C795A6CB652A8D97A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513601, "uuid": "407b1602-9019-4648-a4e0-0439789cd24c", "value": "0ef0eab3f5eae9564288716f38a34d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513601, "uuid": "5348d045-601f-4f76-9fd1-9b6a615ff33a", "value": "1536:wHP5sWNFmcnXxpyBYCw+fA9KgtKBIH166CqCM68O/0RhurEzGTqHJLkWRagy6Xw:KP5s8Fv37CGKk1658a0Rh8eCqREg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513601, "uuid": "60d19d97-4a38-41de-8622-82adf8de9615", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513601, "uuid": "4cec6e61-704d-40e5-bd14-476a0e6342ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513601, "uuid": "1f18b42a-a3a6-4b82-8973-7b800980c9f9", "value": "aes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6c768c-1fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1773512966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512966, "uuid": "2130969b-b973-4e5b-bad5-853255bb2f42", "comment": "Malware payload (WallStealer)", "value": "9c264500f54fd65a927dbe98287da4b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512966, "uuid": "d53c74fd-4655-46d8-a1c5-f1dc8bfce83f", "comment": "Malware payload (WallStealer)", "value": "6080aa379fe813634b16f7f395a2c8d16fe5540e003c8c773b8692756c74c55e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512966, "uuid": "7f5ec1f6-f1e9-40de-864c-5b9066ef6c96", "comment": "Malware payload (WallStealer)", "value": "fdf4c4069b869818d3d685cd17158cc55ef83b26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512966, "uuid": "4617d884-a4e8-4f66-9404-64c975864299", "comment": "Malware payload (WallStealer)", "value": "c7ad53ae7410b7cd543885ec9271d0de734957cc781d39c513c6937ca78daeba1a8c27b51be1efa63706582034362188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512966, "uuid": "cb192ce6-952b-4261-bf6d-068138071ea4", "value": "T13D85AF05E6964BEAC0BBD1F4C9116B6BF5BEB82107296E3F6AC00B947F1272017BD705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512966, "uuid": "81dc14d0-b2d4-4572-8c50-f61d00203299", "value": "2084ee74037f705e76983780bca05b8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512966, "uuid": "d7195d3f-4c27-49be-a144-b9665121342f", "value": "24576:lbFTGIponkrtYHiiKP2c1hyc9xTdWufJGYiCp5/WFEFVMOoSQJ+p+d:WxnNLq1R9xRlGhCp5EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773512966, "uuid": "7ed60623-25e8-4f5c-99cc-f4b103f001d9", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773512966, "uuid": "34d7c4e8-5b04-481c-8b5e-223bd8307208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512966, "uuid": "1fb249f0-5abd-4f4f-8bbb-2ae8e2386970", "value": "9c264500f54fd65a927dbe98287da4b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69291f3f-1fdd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773517123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517123, "uuid": "46fdda7c-6797-4241-a714-4b4e5cc50bbd", "comment": "Malware payload (RemcosRAT)", "value": "b50fa7dafed86fd0edff71cb4cf395d0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517123, "uuid": "20fdebc1-b6ad-4ccb-913a-9296f0690be0", "comment": "Malware payload (RemcosRAT)", "value": "60ca76c8721cac0b8fb9daac721242ae7ae708ca948d096d54c5cc18f31541b1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517123, "uuid": "e37a6c41-5ce1-40bd-9f98-7e39e82f62bd", "comment": "Malware payload (RemcosRAT)", "value": "e10a351b4a542d29c4e0d7b83139b4985c97cb2f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517123, "uuid": "3af9ccd5-11ea-45ce-b1f4-3fe91ea4cc4b", "comment": "Malware payload (RemcosRAT)", "value": "0fddaac21c8b8dc419309c90b8adbbbe32b8090ced32bd43df2eb7bd29441b73df81c6ebb5b4580712f220859806b0cb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517123, "uuid": "aadef3c7-83ba-4d4d-8047-1c1d8a28711f", "value": "T12223F72C4B735CEFA9DC3674FEA847C89A4A81FD5564C96A78FC5007BFBA114845C08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517123, "uuid": "fc83acd2-99fd-4e7e-855b-b1a694cf21d1", "value": "192:+s0w9mXphHa0laEmGVacQFkajJ0Nfqcih9b0b0w4:+68Z33VzkgfqcihQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773517123, "uuid": "b40b10b9-f850-49cb-ac47-1ee8f614bfe9", "value": 49080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773517123, "uuid": "d5cd1210-ea78-4018-abdc-366b381e2656", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517123, "uuid": "8e1f4595-dd80-422e-a2a9-298bfb1a9394", "value": "seethebestfeelingformybestpc.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a830f5-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506432, "uuid": "441887f2-4532-44e1-9dad-85997ade4d09", "comment": "Malware payload (Vidar)", "value": "8dda73fcbb2b520b9eed1f89258952bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506432, "uuid": "3fbdcbe7-aa48-4af9-9659-9950a3bbf199", "comment": "Malware payload (Vidar)", "value": "610ba069af057806d103683a68fd5627b2d3e4389011a72156294d3957c28710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506432, "uuid": "d309cb9e-358f-4950-b066-f716c1bee3ef", "comment": "Malware payload (Vidar)", "value": "a0c632bce1849a0233e91e0cfbc30667d348346d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506432, "uuid": "bea45dac-7826-46e1-8644-3a296fd9da63", "comment": "Malware payload (Vidar)", "value": "476d76c428bf5d9ff76fc54dc16497626d7767ee35852253802c81d276f2b9c66cb91f7e1e195ffa63558ceed402aaa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506432, "uuid": "f9523e08-cacf-48e3-a001-c763e48c17fd", "value": "T1D4E409BD9C60E326F70C90BAE242D752CF2139051236A6A319BED3241245972DF677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506432, "uuid": "f7eda283-df16-4a94-b1ab-754f117758a2", "value": "12288:caqyhmuIzDEXSVm2qg0SsRQwbV72HYuNbs/a/0xMVxEZKxb2O:cTyCDR/qgXsawJ6Y1MMZKxb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506432, "uuid": "73dd6424-53c3-4af7-a3d5-6e796c944f7d", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506432, "uuid": "69b31274-eaef-4551-80af-be7149eb6c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506432, "uuid": "c5322562-cb28-4dd8-989d-ef0ccb808bf5", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21eab3d2-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515715, "uuid": "4cbe5a76-9723-485d-acde-c62e04b3723e", "comment": "Malware payload", "value": "12f89c138a6102f0f2032736a50066da", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515715, "uuid": "ee10c4cd-da78-4744-8073-839bdc984dc2", "comment": "Malware payload", "value": "614e8c21bbb5cd0c128fa57f45910b2d76126aaa79046492115ff985fdbd8170", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515715, "uuid": "7e75a9fa-0a07-4330-81be-14d9fe85b317", "comment": "Malware payload", "value": "56fc91736e19b6d3d9454db8a49fc90410a3cd80", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515715, "uuid": "34dd95da-fcc2-4842-a7db-b3a5e9ba3934", "comment": "Malware payload", "value": "4fcafccd523a4c93c40dc91cf813eeda48e4283224d9917aa4612219690b3ac1060d5a146fc1188aad9167c4febc230e", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515715, "uuid": "4a656903-d56d-4caf-81e9-0b7e3f85c2b8", "value": "T1B4451A9F82335EB0326EEF383CFFAA24AD0257079A14DF35DA4ACCC565E6C1C6514A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515715, "uuid": "986cfdfa-0a23-4cc0-92bd-00e0398906ba", "value": "192:R11111111111111111111111111111111111111111111111111111111111111p:D/A0RjFzES5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515715, "uuid": "41dc9839-0d82-474c-b8dc-20310992dbae", "value": 1220395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515715, "uuid": "e79e0ce4-4c31-4e62-8994-fa6e1945079e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515715, "uuid": "d7bbd533-30e3-401a-9b7a-af9639649ec5", "value": "12f89c138a6102f0f2032736a50066da.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1040181d-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493781, "uuid": "bb77a834-2fb3-4cc8-b604-ed6c4fb4e96e", "comment": "Malware payload (Mirai)", "value": "8bff49b8e44e38a28362e394603de640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493781, "uuid": "63b6c498-89c8-4daa-b94e-e8570a020968", "comment": "Malware payload (Mirai)", "value": "61b760826845871c7f53ece3ad6642591b264cfa0ee7fb4aa8163fb01a026027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493781, "uuid": "d9d034b1-0524-421d-8ad9-259b8a6f753e", "comment": "Malware payload (Mirai)", "value": "07e3b97a89cc3f17ab6267bb20bedf0a44b761b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493781, "uuid": "89fc89e8-6725-4171-a074-d2fc668a0d7e", "comment": "Malware payload (Mirai)", "value": "dafc6428e8f9100354c2051d7cfbf88bf91e9e5b890b4f42809239171682a4af5b3883cf126c0d80a419e6a36cc8d3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493781, "uuid": "00ec70c8-4c4c-4c55-887b-e7f5356889b7", "value": "T19E259D2AB2B3B2BDD007C03047CBCAB15531F0755A312DBB36C4DA343E9ADA91759B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493781, "uuid": "2af03de3-b2e2-4b43-b09e-d79ae02871c7", "value": "24576:8tLkpqxa4e33znNgukYwOVKQPZpPBmzWFdkY:vjnNgu3XYQzPYCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493781, "uuid": "0530d6a4-c954-4de6-8827-4471ec13e659", "value": 976088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493781, "uuid": "d8a4d109-70e4-42a4-b0ae-f3018f82f118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493781, "uuid": "707c67ae-0983-48ea-b127-009719ae65eb", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14a3822-1f83-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1773478563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478563, "uuid": "6eb35f41-79f5-4221-b3b8-d835c995ae98", "comment": "Malware payload (BlankGrabber)", "value": "e5f43c994a9748472649056d87887c66", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478563, "uuid": "b31510e9-c8fc-4ddf-a051-3d57c31042c9", "comment": "Malware payload (BlankGrabber)", "value": "61dc3f731dd06ec4b3caa383eec2a00a08ade30a6c520db161d7f67ee9e34218", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478563, "uuid": "f3fae3e9-abac-4735-8af3-6ca058047c0c", "comment": "Malware payload (BlankGrabber)", "value": "126a829376aa6d7bd7991cf3dfa303b081e7d79c", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478563, "uuid": "e59c77fa-71f7-467c-be75-e2d22e6aa1f4", "comment": "Malware payload (BlankGrabber)", "value": "6bad2b070d8410e784fb3605663eff39b66b9631446b24b9c66ddc7154ab0426d2e4c5436d7c28d1eabc6284739ccd74", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478563, "uuid": "51683254-2540-4b0f-95ac-f62f9d719736", "value": "T168F63311BFCA940AD3C425BB3E93EB1E7E9A4D601F939B465D2E97114E8F845073F02A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478563, "uuid": "bca67f4f-1ebf-40a0-8266-b771b826223b", "value": "a413ffcb413e398d1f798a0daa527855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478563, "uuid": "5619b358-1879-4675-83b5-61262cbef28c", "value": "393216:Ox4IY6lhIr4BBG9IWhn5as/ksY6rbBEmRLdQxFIuPY6Hnllo:Cy6lhA4nG9bhn5aSHbBEmRLdu67kllo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773478563, "uuid": "b452941a-d12c-4ba5-9b28-1d1710d9d1e9", "value": 16257441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773478563, "uuid": "c3554470-cb9b-4a76-917e-92b6ba3af281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478563, "uuid": "786bbc57-921b-4f75-a8d1-cce7fdc58cd8", "value": "KeyAuth (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a074d06-1fd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773513286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513286, "uuid": "0a40bd58-f501-4f4a-a582-01b6da6daf78", "comment": "Malware payload", "value": "53d00df806c4435572703ad9701f8a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513286, "uuid": "50d33ffb-c38c-463c-9d2f-faaf79376791", "comment": "Malware payload", "value": "62edf6074c376c6f65c4b3140e344ff6d36d32df2d9ac3cfc1cb53bf8d325288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513286, "uuid": "8105ecff-7136-46cc-9d03-410dea332ead", "comment": "Malware payload", "value": "583972e3e3467c727e237f2bcda7eb39b07f453c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513286, "uuid": "8e8f2d2a-4454-495e-b3c8-e65fb3910027", "comment": "Malware payload", "value": "599da61b010fa2892a9e4efc4a110cec3b294ac2d49e59039d6cfe0fc252c3fc8d0d8074d2ecee16d2677234f4942e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513286, "uuid": "cb283ab1-b879-4517-8df7-0f7c340f8bfe", "value": "T194464A07EC9545E9C0EED2318A62D252BA717C484B3527D72B90F7382F77BD0AAB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513286, "uuid": "374f96ab-79a1-4573-a488-0ca76af4737c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513286, "uuid": "f1ff78d4-ea24-48cf-be8e-6a0a62509d1f", "value": "49152:nmpxbDXb+qBQX1Dd/fGIx31DZWfC/TZM+8vu9xV5EhSymbqngzoePhfwD:S21DpOfC/dR7EwypgzRRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513286, "uuid": "a0314084-e799-4e3f-9e4d-b7feb4a82932", "value": 5453824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513286, "uuid": "e0397ca8-5807-445f-af86-fb311d301900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513286, "uuid": "49a8e0d9-6b24-468f-ac9b-8aaf00d7d43f", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ea900c-1fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773505810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505810, "uuid": "5f26e165-46c7-440e-b709-3616e4205ea4", "comment": "Malware payload (PhantomStealer)", "value": "694397194930bd5b4d1d8a0682a40143", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505810, "uuid": "60322e4d-b7ef-4a45-8977-4982e430bfa2", "comment": "Malware payload (PhantomStealer)", "value": "642f8c0b33d47dceb61578ba4edf88f76dddd501a8bb3f9e7057d4fdb32f6365", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505810, "uuid": "416a038f-80dc-4865-afd9-4e1a84df4368", "comment": "Malware payload (PhantomStealer)", "value": "38638a876b8f0d840b4f611b0b3b01f6d883e722", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505810, "uuid": "04279170-d3f2-41dc-9c58-b8b4c03499c5", "comment": "Malware payload (PhantomStealer)", "value": "138b5b1699ff521626451b3257db2e1afabd6248703c65741dcbb133229786fd9d40e429522e9ca8759304ae23daf283", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505810, "uuid": "684f26ad-eff9-4241-a74b-d612182b2c74", "value": "T1EC3502108AC82FBDCFAC5A1850FE161D53F04E8F856AB58BEB23BD46AFE754446071D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505810, "uuid": "3b1a3b29-a30e-4a18-a844-95892b56880d", "value": "24576:Q4g2IMXw9l/AD/41QtiZ/BikrJODeyrHo:QFQI241CidNFiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505810, "uuid": "15842313-331b-4b23-99ef-09bf6fefef08", "value": 1150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505810, "uuid": "5e98f880-776a-4b87-8771-c41626f45ff2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505810, "uuid": "b8cce79e-d9e2-4e73-98ef-1f36faf8cfad", "value": "z1FedexShippingDocument.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39fb38e-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773505195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505195, "uuid": "d6efc9f5-fd0c-4cb0-866f-682333d3177a", "comment": "Malware payload (Vidar)", "value": "ce80dce32b0aea238cb83deec70b27a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505195, "uuid": "3a194eab-7d7e-451d-a2a4-7bd5f86a8374", "comment": "Malware payload (Vidar)", "value": "658a1513e1d72eff1defe0a3c41fec7888b9cac4c51b840155d55b38e60c9dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505195, "uuid": "d5fc58a1-f629-46f3-8a00-af73d29b7072", "comment": "Malware payload (Vidar)", "value": "f7cf92381eb0e75e6dcbac14b0d38321bb9a9a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505195, "uuid": "2c80d82c-2139-45ac-a137-74a759519d2c", "comment": "Malware payload (Vidar)", "value": "48b0ae4028aa61861393244715b15fb911075e66d1fae58131889e428d106b6d4393826851cc02dd67f46fb2157ae2bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505195, "uuid": "deea321e-5016-4ab7-b5b1-6af24e584e6b", "value": "T1BE8607AF6353826DD51DC13BC4928E04F4FBF0754732F5E7069107A9EA718E89E3A6A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505195, "uuid": "750e5ca7-dbd4-4753-8b49-7d70138f398f", "value": "4c0c021979edefefb6f1fdc1b57809a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505195, "uuid": "572a329e-456f-4841-885e-4768132f77fe", "value": "49152:ciNRNV9FtBZRupRW5UFfYxbWt8FU611SBqUYwUchA9qq8Wt5scJq55A35EwC3Zdi:cEPn4nTA3f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505195, "uuid": "772d419a-9a53-44b0-b9ca-862029206ae6", "value": 7835648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505195, "uuid": "23f323d9-7fa8-4b7f-a5eb-ea62880f7bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505195, "uuid": "04dc260d-1a6b-4c76-b4ac-1cf0ccc6088a", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3726868-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773515530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515530, "uuid": "3fda74bf-0e5f-41b1-ad13-3de74051ab76", "comment": "Malware payload (PhantomStealer)", "value": "896a72ad622700ac03e1e81f54af506a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515530, "uuid": "153a82ea-fb86-4536-b4d0-cc03569312c9", "comment": "Malware payload (PhantomStealer)", "value": "663c470421a43b880641026e8a36204f02249e669ca92c8f1b3fb216cd8306d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515530, "uuid": "7d0d8af8-8310-4b21-9d56-1c5111ba1660", "comment": "Malware payload (PhantomStealer)", "value": "69b25667069c7e42086bee33c05cd97ab66da0d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515530, "uuid": "ca71e128-0b90-4093-b79b-da14c0cf403b", "comment": "Malware payload (PhantomStealer)", "value": "9b60a0c16ab5f6703680e09019f5575490ecf110f426ab0605a82383d48c68630df85f864554270df3201e16ff17df79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515530, "uuid": "9c03b143-f261-4c90-85fd-5fe0d606ff49", "value": "T15126BF7966DAD71127ADAF4480DC55D4D1F0344EA3A6F7B9BF2BF8193CC0AC80990B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515530, "uuid": "5aba2f20-cbe7-4894-abc5-66604e0f66dd", "value": "49152:9N8Beahu7yFF0wpipOB//51d8Mx3am5yDg4SwZBzAVUdt5s/7xBeddMvxUgE3Bpr:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515530, "uuid": "b236652c-fe43-4f0d-b9da-c5b36772128f", "value": 4643019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515530, "uuid": "9562107a-4702-45b1-be1a-fb90a41e0f69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515530, "uuid": "c09766c9-7b3d-4557-96aa-36e630e8fe4a", "value": "896a72ad622700ac03e1e81f54af506a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc616e96-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495385, "uuid": "92adf514-97df-4176-a31c-dd93f004d8b3", "comment": "Malware payload (Mirai)", "value": "72a028142605b4961fb8ae45e8270bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495385, "uuid": "b7ed5450-53b1-4715-85da-017adf4bc69b", "comment": "Malware payload (Mirai)", "value": "66dfb5814a806523045f459bfb83f09d097bbfdf962c9c46dc6c452c8a2c50db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495385, "uuid": "a2d1e432-c13b-4822-b6d0-d2077fdfdde9", "comment": "Malware payload (Mirai)", "value": "73b28d83043514a575ee65c9217625bb93fe06ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495385, "uuid": "9d944b8b-6021-4894-8fc9-02513b7518f5", "comment": "Malware payload (Mirai)", "value": "45b7676f5e0a93648f88312f5865e6a946204069ebed436cddf9ae184337e835b3e07d2bf60fae86eeb8bc3600c6b17d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495385, "uuid": "04b3c404-6b2e-44bf-8a17-7eb94690787d", "value": "T12593D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3634C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495385, "uuid": "4e143306-0a77-428f-89af-a9932c1b0d9b", "value": "1536:lX1tMe0R/thinSZEvPgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//JEp5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495385, "uuid": "0782e710-6724-4cfd-a213-1dd02b41a144", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495385, "uuid": "8d39855d-bb63-4faa-ac1e-23cd4250004f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495385, "uuid": "1f2b3ccf-1714-4baf-8aa7-c405cc543daf", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d5df59-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491489, "uuid": "b6a49d29-f834-4bae-aab5-886cb76a8a60", "comment": "Malware payload (Mirai)", "value": "95ba37133b0865223b60422149df899a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491489, "uuid": "10e1eb70-742c-4866-9556-8fab7e25f2e5", "comment": "Malware payload (Mirai)", "value": "67a621ce6f4c5c55e98a5ddef433f65eb09e44ff9ba1fd6e1eaea64a6bff7414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491489, "uuid": "edc33875-cc22-4862-8d62-c0d759da8278", "comment": "Malware payload (Mirai)", "value": "a54ee74934f6cc383aac2b7a9bc26924d02fb555", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491489, "uuid": "8ce199f6-b6a2-4b3d-b094-0e328c86ea5f", "comment": "Malware payload (Mirai)", "value": "ed7615def17ca25622da8ecadab2cb759e9ff1f9ced0625abace98a613c5f92ddb5691792fdeb9a46828a33f2bc2352b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491489, "uuid": "61ee6aab-b5ce-4f49-8c4b-b22706f1963a", "value": "T152057DA1738A9A63DE584B724BE3C374B7F8795201F2855AE322132C1F711B96D1DEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491489, "uuid": "bbe05780-b2b0-48b4-9dbe-66cf812478b8", "value": "12288:z2H3SmQ34McrwS7q8z4XKaRq6G7dx6wzM+SjON5vEtkpvnSs5IN6ue5sxp:KH3SDIprwS7746AQC+ge+2nY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491489, "uuid": "a3a96540-4ab0-415e-b943-a41a561a9ba2", "value": 821880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491489, "uuid": "2c5fc093-7471-4f32-af7a-649212742b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491489, "uuid": "6a9e5a82-29d8-4ccf-9a6c-0b68e3d61c86", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840018de-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773516309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516309, "uuid": "0820c1e5-a0f7-414f-ae6b-6d023a934a6d", "comment": "Malware payload (QuasarRAT)", "value": "73d8e0d8e11a24fd077da2908da21a48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516309, "uuid": "5f32cd40-fdd3-4fef-9343-95c69baf6c29", "comment": "Malware payload (QuasarRAT)", "value": "67dc4775c7c3593825bc1f11d990032e3982f0064bde6bc30f52fc7f468e8acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516309, "uuid": "2a4d7d3a-51d7-400c-ad0a-6252f23e0c4d", "comment": "Malware payload (QuasarRAT)", "value": "4a344e3217d90488f1fe52071d9fb7072adc1013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516309, "uuid": "214f7d73-ef56-42e7-adb4-49d2d3e35ebe", "comment": "Malware payload (QuasarRAT)", "value": "63e3314c56f20f6755858bcc96e11ded213f4ca9e4a9e180810dc92ed74b0d84e9fa4cfb02030d20344740ac801de2c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516309, "uuid": "1267e574-71e7-432c-9fe5-2fe4e4b1204e", "value": "T1A4C5238537FC4909F6BF9B702CB6662486BDB8A35E25DB5E05C4309C1930BE5AD60F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516309, "uuid": "2297b13e-040c-468f-b213-c9e72f5ba49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516309, "uuid": "bb81da3a-b451-4316-a09e-89516c0ef1fa", "value": "49152:j7L+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcmi:/L+2upjBVGVl/lQrCSZ4183Dmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516309, "uuid": "095ba26b-e65d-4471-8637-3d3473cb28c7", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516309, "uuid": "71917156-020f-499b-bd22-84e8c034d000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516309, "uuid": "5da0f9d2-c051-423c-bba8-8b6a8388cb3c", "value": "SecuriteInfo.com.Trojan.PWS.Discord.614.26004.30128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c9aad2-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773514828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514828, "uuid": "d191afdb-c955-42bb-bd61-5f349a390f65", "comment": "Malware payload", "value": "b1bc96975145ba33777ccb8c39ce92ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514828, "uuid": "3034a849-7380-4a61-a6c5-d5da644e84ef", "comment": "Malware payload", "value": "67fda7c1fdcf08765ffd026e1832a2fd4deb07894acc65043a32b3b15f1e9225", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514828, "uuid": "39c22416-6ed7-4ba0-95e5-e55966507a3f", "comment": "Malware payload", "value": "bddd651123e74e0c3fb5af04c4917d375a318ce7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514828, "uuid": "87c5957f-9b7a-494f-8d8a-e4e27013334b", "comment": "Malware payload", "value": "acd47fbc0d6652bbe2a84102faacda87a83bddd2cff6943003b4d8d2cf3f699ee7b342775bbdf03329e4db4d0db3bf8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514828, "uuid": "b36c7f6e-31a6-45e3-a0d1-8f12b9f58f9c", "value": "T1CD715424EE1AC938A171A726D9DF841CED77D1733586D25DB4CC83A8AF310384279BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514828, "uuid": "a84573a2-8e1b-4c09-874d-cfacc7d9aabe", "value": "48:45ARe6jIdT6PN9azfIujNjqBjAgMABVz3czQdRREHx6jeqQf4BvHQm/afZhkVPJ+:VAYN9azwuxWB0gMABVROEeNfAaf3GP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514828, "uuid": "eba4e446-79c6-409d-b9fe-ef21f06a0b8f", "value": 3567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514828, "uuid": "56d2d8fe-e36f-4e17-a4c5-6460ebd83775", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514828, "uuid": "560d5d41-fd0a-4ffe-8383-480e03324c6f", "value": "Tranium.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c65f4d-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507326, "uuid": "c441e358-3fac-43a6-aaf8-fa8e85f47f67", "comment": "Malware payload (ACRStealer)", "value": "5af86aa4bd04ffaeccf718994e1f6016", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507326, "uuid": "017cbcfa-47b0-4e30-b6c1-f8904649eb53", "comment": "Malware payload (ACRStealer)", "value": "680abf327f61cfb48415e2ec9c2293cdee09cde4b30c4cefd3e3515262b59b5c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507326, "uuid": "eea1c341-8eb4-4c1e-b731-fc24fe34abfc", "comment": "Malware payload (ACRStealer)", "value": "dd1efb1e3c36c55b7af376fc5b0d8adf001849e9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507326, "uuid": "046e687e-f691-4ede-9939-02d00b91e3db", "comment": "Malware payload (ACRStealer)", "value": "7584a6a985515d972dd154ae5aeafbfbe963a9d38030349309ed9c316f2b1d8d6576c16f7990156624fb0cbf0fad0592", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507326, "uuid": "fd3ff2f0-3338-4732-867d-deab0b41933b", "value": "T1B8B5188836B359F3FF0F8632C147964FA7A9A4487B21C8F742725965EE336E36234614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507326, "uuid": "c5e45a2c-fb63-4de1-b8cd-63d01d04aae6", "value": "571d6db1c652d907721c779e73908eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507326, "uuid": "3c88f907-3409-4315-b26d-e3f9a3e1e782", "value": "24576:URIXss/hseJsImjquvLd7M++aqvImbh9rOXVVKTtnHtbzpVE/oDRqFcm34CNqpzN:Aoc9df+qVXQ5CSqD9S/c1ZksUmR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507326, "uuid": "de68bc05-4552-4e82-a48a-e8c2cdc10201", "value": 2382336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507326, "uuid": "899ebda5-591d-466d-a521-d28aed9d519c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507326, "uuid": "1a22758b-51ef-47b4-8f9d-481690bd1861", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3713e1a-1f56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773459239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459239, "uuid": "83c2a708-a49d-4d12-a5a3-030cf95df1e2", "comment": "Malware payload", "value": "a4bf3295216c9463ca1873abd382d352", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459239, "uuid": "0866238e-0582-4b54-a6de-03cd861be31b", "comment": "Malware payload", "value": "69d9013d2756b11c6b5b779d54722453857bc4f3670e2270b521ad97aef994e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459239, "uuid": "b1ae3cbb-5540-4d78-95d8-78a6e58270ff", "comment": "Malware payload", "value": "edc664e00e2bd37aa5e3ffcf6182c6fda23fe2d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773459239, "uuid": "45c216e3-9925-403b-b797-db23ed4f3eb3", "comment": "Malware payload", "value": "0e9dba4d20e7953a440aa976a50f7c76f3d766f6a394966accd9e62dd92c89fddba2004bc5c1db41508469a38b9037df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459239, "uuid": "a79192bd-4e5f-469b-8515-22622f918d93", "value": "T17AA3EADB1556522545B1A3B9EF239019FB26E163224345A8BEFC83983F7582082F5FFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459239, "uuid": "1866e649-1e94-4e06-8113-19c8a8c1d7b5", "value": "768:1SHhpdXZN0Ygp95iS9kILWIIhSaCJh7Rv/N0z6RMUTWNtt1hu7E5gY8TrtHISQAh:1oXZN0YgpXBSIPpIN1hEEj8PtoSQAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773459239, "uuid": "5aec28a5-0860-4fed-a5b3-d3e508f01d71", "value": 101540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773459239, "uuid": "e36c0c23-e7dd-4905-b78d-06ddf4da25d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773459239, "uuid": "78691989-7e7a-47fb-9679-59564be82926", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0cdcf5-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507330, "uuid": "13ccfc80-f370-4703-b491-10037eb6ce2f", "comment": "Malware payload", "value": "55346a83de0654f11115387f77a5c7bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507330, "uuid": "71233215-fd69-4064-860d-03a662e378c3", "comment": "Malware payload", "value": "6a4891b6b3b8558d7dc1cd4b49358b64f38636decf48d9d97305dd16911f5665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507330, "uuid": "c89f04ee-3aec-464d-b904-6ea3ec5042e8", "comment": "Malware payload", "value": "86ffaca97032b51c0640a8ff6a971dd01518c58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507330, "uuid": "d5bc5b1b-fd9c-4dd9-b1c2-e681604298da", "comment": "Malware payload", "value": "6a7a6cf18ffb87b6ed34f02843b06ed6caf4208dc828475f497322c4ed11f470e94a193e877dca7e6a82d98d4e86da44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507330, "uuid": "b5e2b9db-200e-4870-97a6-790adc240b3b", "value": "T1C1C533137AE530FAD02EC9B1C9A15E80DB7174629790F2EF57848A622D12ED0DF3AF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507330, "uuid": "2a17c575-87f4-4d46-bad0-4643d9691f95", "value": "6d37d8d211e2046ee417febe92e137de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507330, "uuid": "cb14eafb-fbd6-4c7e-b1f9-35ef47ac8838", "value": "49152:TgCSKS7dJq4Tmval3L8Hfl+zppm/EDL5FSzWKMGKDP+IjamLfPX94r2gAJnctPL9:TXSL7doCka9q6pmK5MzWKMRZPfWr2gAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507330, "uuid": "66ab8897-6068-41a5-b8ad-3a4eb73ee3f9", "value": 2697216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507330, "uuid": "ed2c15b3-fd1e-427e-8469-1295c23b6bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507330, "uuid": "503b513e-3788-4208-a264-bb32be3f2346", "value": "AcjqUEy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c65382-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494383, "uuid": "26b0c49c-93fa-4c57-aea9-7ce3c3a10179", "comment": "Malware payload (Mirai)", "value": "0a82563091653c0c5a1d7beafce1c57d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494383, "uuid": "7109b095-fdae-40e2-b64b-18241f9c56cb", "comment": "Malware payload (Mirai)", "value": "6b1e79c0baceee4dd4472236e595640406ba9b8f81dbe45365af16eef87cdb7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494383, "uuid": "c37590c6-2eff-4c39-9d3f-5e91a7d260fe", "comment": "Malware payload (Mirai)", "value": "44f5dc754dc0515a440369d2af1c730d6520a9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494383, "uuid": "b088dc15-b8a3-4397-8349-4f503b66dd0a", "comment": "Malware payload (Mirai)", "value": "a1bc0f7c00e3ec0eb4443b313b2e3d2b2b264d7ec5bf37abeb124590381ba43389c9e1f2da66aaaf93c546e941e39be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494383, "uuid": "76712313-a69c-420e-9bda-3fc3f91666ab", "value": "T184A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494383, "uuid": "247ba981-a250-41b0-87b3-77dd91b6fdcc", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj6tNYK:5ZzjJa1rZ62yqPy/ULWzj6tN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494383, "uuid": "168de092-f626-40d7-9a26-50b6d8f4894e", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494383, "uuid": "dcc0d096-d75b-4459-8a94-abf59070696a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494383, "uuid": "011395e9-c496-4130-b431-e3e099075f65", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d45fb74-1fea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773522740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773522740, "uuid": "416ac999-30f7-4995-bb1c-b99b8a3336c4", "comment": "Malware payload", "value": "9b281a5f256ac3d05bfbcc5ff760ba6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773522740, "uuid": "36e00af2-d1de-4000-ad54-fec3fc42d62b", "comment": "Malware payload", "value": "6ba8cad8cbd71ddcbf2708fa838f566985a8976d680886d89da949b0c29141d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773522740, "uuid": "b5bfd637-0b75-40a9-8913-9499e31f36a6", "comment": "Malware payload", "value": "15be98007a1d56f7687ebee07679699867195053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773522740, "uuid": "e283b8a2-d1d4-4ef5-be4f-470f5ebfbffe", "comment": "Malware payload", "value": "b886aa51485824e9e91dd1cece86d35f196031901f24cbd16cb76b23e7e971a6b5ed8ab780d2fb78a85428b02c4ef500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773522740, "uuid": "671720e0-f451-4ff9-9395-f4e24f914ba3", "value": "T1D1083347140D94B6DBE2E0BE11D433A1E37B3970159AB359452FA2FB45F6CE0A3AE087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773522740, "uuid": "22fb132a-78c6-4e63-b859-74b7fd3dd739", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773522740, "uuid": "7dd31e0c-2fe3-4c36-bcb7-507e61fc185a", "value": "1572864:IejOt7ysRZqjJKk7HGFVmiHoEp/x1Nf3MaqOnxyZ0NK3Dy27:IN/RZqjN7mFV37KOQ4K3Dy27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773522740, "uuid": "5dea9029-0bd0-46b1-8e14-d88c426e021b", "value": 80872468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773522740, "uuid": "52487d2b-994a-4870-ac87-3ced13f820e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773522740, "uuid": "3a8b5188-495f-4fa3-94a2-5aedf5e09432", "value": "YuboAPP (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2de958-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503760, "uuid": "3ca9954d-607f-479a-99f2-898f4fa8e50f", "comment": "Malware payload", "value": "753c07a128d5d81b30b89ca00ecb3636", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503760, "uuid": "d5b9bcc3-445d-4dab-bc9a-d660dc0e9fcd", "comment": "Malware payload", "value": "6bd3effab4c06d94364be6bf10c841cec4412f367a59bc90e6748eee08afa9c1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503760, "uuid": "04925491-6e18-470a-96e7-fb4ce48321fd", "comment": "Malware payload", "value": "460798cd1430129003257536a14d467f41b0b42b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503760, "uuid": "b8fd5ef7-a1c4-4a9c-bac3-834cd83ca4a6", "comment": "Malware payload", "value": "b28e8a05987e1a4047d762f2c9e342b18f5bfe4b98e19533fe7c361bd94559e1b391a1b1a1c2e52fd9afd7402aa8408b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503760, "uuid": "4cce9322-93f2-4086-81ee-fda1a7c03281", "value": "T105826D6B8DC73F8753B05A0674ED2DD6041D47CB3482884ECA07DBC4C2E5B8A24D82ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503760, "uuid": "5fc7e16a-8f9a-4fcb-b688-8a21b7f12427", "value": "384:vEVhORmUhJKl8722GyZyZ6nFTx/Cmkn59HVsXOXQipItzyLyNv/qDvLMs:vyMVhJrGFZWT5Cmk59HVKOXQipItzyu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503760, "uuid": "78fa1281-c3c8-440c-b3ca-0cdff35919e7", "value": 18801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503760, "uuid": "a04cce68-2dde-4870-b5c0-22afe1cef1bf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503760, "uuid": "907bb24f-2592-414c-abf2-b4926c090cd5", "value": "primetimehost_iclickfix.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda06c2c-1f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773470074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470074, "uuid": "db7b4c6b-ead2-49b5-80ec-f71d82347fdc", "comment": "Malware payload", "value": "13a633a54c8a6056447498db153553d6", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470074, "uuid": "baad113b-b9dc-470c-ac15-fb50ed7c0d10", "comment": "Malware payload", "value": "6bfe4694853489c5ef573fc2c0b5a2e1f0adacfeecea82c1edea8f2057ffa494", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470074, "uuid": "0378f730-fc19-4790-bde6-5ae9f090e1bf", "comment": "Malware payload", "value": "fc06b470fa5e9a7f4ccebce8f823a4a33c553a0c", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470074, "uuid": "d43510e3-a160-4cd9-a147-214a89d2e0cf", "comment": "Malware payload", "value": "2d242aba9beea6725900191374dfe9f0b5cb95f575e30d5f00576af071b350d85a0d7cc297621e7c34be2b41b6488eef", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470074, "uuid": "85e24311-3cf7-4cc0-8937-0a7041d49bce", "value": "T189965C1D93B400B4D967C668CB46C233DAB0B5E6923AD54F0DAEC6421F73C635B6FA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470074, "uuid": "e778a820-81e4-413b-8466-4956b61cc28f", "value": "98304:PdlG5ll0ekHErIRFifqlk0Nq9r3wZX9+qL:OIf3lkmqt3wHhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773470074, "uuid": "507f5a47-bddf-45cb-a8b2-641360ec63d1", "value": 9453111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773470074, "uuid": "e6544a1d-0d56-46dc-adf1-97863c413d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470074, "uuid": "5fd95e48-f9d8-45fe-85d7-acf069804cfa", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b3c03-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503750, "uuid": "071850af-7159-47e5-ae70-5c101b45bfef", "comment": "Malware payload", "value": "59fa7ba38e915dc58a06f44ac309c3b7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503750, "uuid": "64a3a967-626d-414c-973e-ef740b001375", "comment": "Malware payload", "value": "6cd4c1be3f6ced0f4d542395b8f0fdaf29954b25931b66e1e7021d0a076360ed", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503750, "uuid": "588779c9-1b96-4467-9356-7d7c2635bed9", "comment": "Malware payload", "value": "4e4081fe4e8f245b36b5a7835bfa4b02d88b3bc8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503750, "uuid": "aaba6a9c-f8bb-4d17-a355-ab474c44c769", "comment": "Malware payload", "value": "9a431546aebd4c2e7b8a9d025b0936028e39235dc9204b4865461304aea2acb8bbfd86961538681945e740a9f21f3eda", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Emmenhtal", "colour": "#8840DF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTML-smuggling", "colour": "#F262F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503750, "uuid": "b5e2db09-3494-4518-8af9-c85a09fb150d", "value": "T180D3C8056EA6A9B692E3719BDC70C310607EB1BA5E649D84F7FD801C5BD0FED463222C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503750, "uuid": "65fac25f-a987-4157-bc7b-68c86ae6e7f5", "value": "3072:7jWU8lbCi3dDrOsESwYhDD68yQbRY3XzN9EQGPItMW+DsovtTCC5:IDNS0yY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503750, "uuid": "e710de30-25c3-4e51-a9a0-bdc3b09ed4e4", "value": 134580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503750, "uuid": "49235145-90b6-4e47-97c6-1766248bf814", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503750, "uuid": "099abd89-18c3-4aa8-8615-09013cfc7578", "value": "emmenhtal_nexxus.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197bec5-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494320, "uuid": "ff38d9b9-c07f-4dbc-90d3-63396be2289a", "comment": "Malware payload (Mirai)", "value": "19b39c991042ea06eeae7e0d04030156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494320, "uuid": "3aae0d10-cac3-4c2d-91bc-093456954dad", "comment": "Malware payload (Mirai)", "value": "6d85938a553a558a0348c72414533b7df380abfda07b9f34ebb629b0f8db89ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494320, "uuid": "c7636977-af67-42cf-98e7-9be3af2ac015", "comment": "Malware payload (Mirai)", "value": "3b1cd3578ce4705850aa60e168ece3712301775b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494320, "uuid": "56fc2bb8-5295-47a7-9279-54039aa12b73", "comment": "Malware payload (Mirai)", "value": "e39ffb4f5da0f4aad5eaae5d408d1d7a243b1a86561865b16e074df26ca3abee0b055720c4553bd94233c9eaff30bc7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494320, "uuid": "c784a93f-9f8d-4b68-83d3-28553ca0b892", "value": "T1ACF202B281604E18E33C82BE859E6E0D2C45985D9D0490F6DFC87D778A05F50BDB1BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494320, "uuid": "5f21ce30-44ef-4c29-9c70-4a7716e59c87", "value": "768:mW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okf2UOpkxnbcuyD7UHQRj8:L4B1E+TcAYC9owuiRUOpkxnouy8HyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494320, "uuid": "ebb40d72-de96-4b2c-881d-0469f46315fb", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494320, "uuid": "65d962b0-3785-4552-85ef-1e3e720feb15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494320, "uuid": "b9f1e61a-1c85-4e8c-a29f-94e4ff70b665", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27334d5-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491503, "uuid": "735c468b-f1d2-4900-b0c4-29adb61a9edd", "comment": "Malware payload (Mirai)", "value": "de7bae23268377fb884563fa554405b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491503, "uuid": "14fe1613-e178-4455-8f2f-3b68743c6a1b", "comment": "Malware payload (Mirai)", "value": "6d884ba3234fd9d823387f23fb9eec48b82371abc28c8497a6ad7ab7ac03d852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491503, "uuid": "eb79965a-9bc2-4c91-8031-50c3039e2b8b", "comment": "Malware payload (Mirai)", "value": "c78896ec256f7b489079887a25c591754d308b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491503, "uuid": "cbaebe98-5048-4b40-9e45-906b50ac88ab", "comment": "Malware payload (Mirai)", "value": "204f1d44121f1d41342053033e4945c83c8d62772806723c7aabd81b7237244ad92b28670676abee6d1c2834709295fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "spc", "colour": "#540676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491503, "uuid": "fa23678c-63aa-4365-97cf-93c53b370206", "value": "T1E1E4AE627BF22135D2405238C762D760B64BD7A9A4E8070FDFA0CEDBDF561641A82CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491503, "uuid": "cb802ede-5b4d-4124-bc81-d7c0d057b8d4", "value": "12288:3p//7+zvNeQSz5ozDuuUuZBpjsgAwIDZ2EWZws5NniEPW:w61ozDzzZ3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491503, "uuid": "b08eb389-ee5a-467e-8f33-7e669ecfb28d", "value": 684240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491503, "uuid": "e0827a0c-8adb-4418-958c-722b0332cb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491503, "uuid": "27649e5c-0f02-49ed-bae2-82f34cb3fac3", "value": "bot.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1aa552-1f84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773478873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478873, "uuid": "1ab128d8-3d9c-4bd7-95e0-a562bb19e39e", "comment": "Malware payload", "value": "87275f6110fd36ff646f2a19ccbefe73", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478873, "uuid": "c5f11646-2a47-4523-9faf-edffe9dc026c", "comment": "Malware payload", "value": "6ea5c0b812a85b9495af90143098ff2e4b55ae7b7312e64e57de41f58ce5e161", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478873, "uuid": "13df980c-8696-4975-af92-82d2dbc2d372", "comment": "Malware payload", "value": "adbe2b83013476bc0bf62ead1c2832937b0d82d1", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478873, "uuid": "5f466d33-e2f2-40cd-87c7-56caebb39d3f", "comment": "Malware payload", "value": "f13e881a7b4dfd2eb2cbf2c8a036ade14bfed94af37b42995c18fe5b772ca75dc4214cf89a506aff76be20be8d46e198", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478873, "uuid": "e3a40db4-00fe-4035-82af-657cd0a50bb6", "value": "T19B645B0AFBA514F6D5B7C138C952161AFA717C664370A7CB27904A972F237E0AE3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478873, "uuid": "cf7e55fd-c6fc-4dd9-ade4-dfa2ffe74d9c", "value": "61eeac6dc735349c9972fe6f71c11dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478873, "uuid": "73fee926-adf2-412f-a453-3375ff1f21cc", "value": "3072:HHDhniVQcyKVFDvq+DjgJOf/Wx2F+gkyf7NAjxJpM+UEw+dh4iwHlMOPlv4HmUYF:m1jK9gkyf7WjxJi+5w9NoGUHW9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773478873, "uuid": "046aa678-6580-4e3c-adb0-cbc77949d355", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773478873, "uuid": "3ad97df4-c6bf-4113-a5ba-937e8be63b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478873, "uuid": "7d05d59e-92ba-4086-b5ec-47f501e4f651", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1236af08-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773514830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514830, "uuid": "8adb2edd-3b3b-405a-a2cf-3445e8cd596d", "comment": "Malware payload", "value": "676352e4dd089d9329a1d054f81952a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514830, "uuid": "89e81d1a-3a44-406c-b529-55e79217cfc2", "comment": "Malware payload", "value": "6f718ca1091a8b79a4dfb66591082de848f60108d94a36768e5026c25e2b5c94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514830, "uuid": "68616c3b-3b3a-44fa-8711-9c7ddd9a780e", "comment": "Malware payload", "value": "a30e94517bfdab23f59a294c32cbac6d5d593df5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514830, "uuid": "007d998d-1324-4d79-acb1-c2199c26732f", "comment": "Malware payload", "value": "f5230c9119e080983011f84c3d75ebefc70bcbfb1660e19aa5627771b88fcea70386c202e5b9607152b47cd95794e5dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514830, "uuid": "a0905b3f-a4ee-426b-a4c3-06aad8d44e96", "value": "T109416610DEA9C9387371CF2ACAF8841DF427E0777067922CB18C82586F37029423A699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514830, "uuid": "90e03d9d-deac-453f-9ff5-c2e99b1ee992", "value": "48:VfpyhpPjj1jqRj1Ij+K8Nl85JZRA1o9I9g4AwWwRKIABhq:l8htjZWRJIazNl8ns1s4ACAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514830, "uuid": "5d3edc65-7e71-41a3-9a6c-372900e724c7", "value": 2242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514830, "uuid": "030f3b91-cb46-4927-a33b-e307a3bde302", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514830, "uuid": "fa50243e-cb60-4ab5-b432-4fb9846959dd", "value": "Tranium.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff741edf-1f80-11f1-a769-42010a9c0008", "comment": "Malware payload (BillGates)", "timestamp": 1773477432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477432, "uuid": "451adcd5-a6d6-4e75-9b62-8927062ce249", "comment": "Malware payload (BillGates)", "value": "fece4fd024cd968522e2450c1cc4420f", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477432, "uuid": "06da504d-fd99-4604-9336-c76ebf91f823", "comment": "Malware payload (BillGates)", "value": "6fddaa099096c0caee183e4bb95e9fe79003e6ae6dc41d6b1aa3b4aec221bd38", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477432, "uuid": "bda804cb-9447-4d9e-ae71-195803673527", "comment": "Malware payload (BillGates)", "value": "72137e0ed1aa66fb200a55d0404801549af58776", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477432, "uuid": "e41efe47-f0b8-4ee8-928b-c1df4c5713bd", "comment": "Malware payload (BillGates)", "value": "4dcb6035e6afa0fdfd310b606b3875613cce8a97ccebd00ae5c601d1060e2d6fd832f790e0317a659a4995db52411156", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477432, "uuid": "1742c88d-793f-48d6-921a-c59ab6fa87bf", "value": "T1DC456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477432, "uuid": "900deae7-cc3a-401e-beca-197ad20b8e99", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4Q2y1q2rJp0:745vRVJKGtSA0VWeonu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477432, "uuid": "a1160c40-abbd-429c-b8b7-c6f312661e5b", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477432, "uuid": "6645a2f5-7e79-4282-9d88-5f57493c201c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477432, "uuid": "3fa48e27-5647-421c-84eb-9f4b0072ad10", "value": "kswpad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22b9fce-1f94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773485893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485893, "uuid": "3f3d9694-8e90-411b-877a-1acdb788d2a6", "comment": "Malware payload", "value": "b7b4530d0eb2496bbff452ee5783df17", "object_relation": "md5", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485893, "uuid": "f2494845-95f5-4f07-aa91-5a423b0c6cc2", "comment": "Malware payload", "value": "6fea579685d2433cedb1c32ef704575dcbc1d0a623769e824023ffccd0dedaae", "object_relation": "sha256", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485893, "uuid": "a183deb8-bbf1-46b1-b82b-feec7b15be00", "comment": "Malware payload", "value": "1ca0b54705fccee21c1fe50784f80f77d875fba4", "object_relation": "sha1", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485893, "uuid": "ffb434c3-c747-48b1-b22a-1ee3740b8457", "comment": "Malware payload", "value": "9f85056dda47c932afa88754591a0ed87ca6ee62b3969cbe2aa75abce58655e5d3f594784fb1cb133b9fa03a061bcff2", "object_relation": "sha3-384", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485893, "uuid": "2cf44a9b-4194-4256-bbe7-2857d724dbb3", "value": "T12664B38177C2B88112875B77731B71F6E92ACDA8B189488EF404BC68F0FDD16E6E8571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485893, "uuid": "3e11e88d-3bd1-4680-85e4-28a780a8d7d9", "value": "6144:2L+mqR1qKP0I/F0LdXZ6UCwFPY7jwvJWIrhZrHgeJUWAK+PXObllrTDFt:2SmEkIQL1FPY7jGJdrHniOlNDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773485893, "uuid": "eb4da619-701e-4da5-aba3-5b4f785c9969", "value": 310907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773485893, "uuid": "9c2ecbbe-1705-40ec-a260-3afe07420e7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485893, "uuid": "fed23966-cfe8-4e7c-bd92-325b25adb2e4", "value": "b7b4530d0eb2496bbff452ee5783df17.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fab29f-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773514801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514801, "uuid": "1bac8e1d-1944-44ec-8a79-379bb618a82c", "comment": "Malware payload (AgentTesla)", "value": "1229b4c666d1ec8f19cb3693023daf39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514801, "uuid": "ef06324b-2e6f-44c4-8b87-064136467909", "comment": "Malware payload (AgentTesla)", "value": "70530aa73b1ecc545d13cfd5cfcfa292b74b0c90bd26c8a2f222ae74787f4ded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514801, "uuid": "ad0aefe5-47a6-466b-863c-df64e6e07238", "comment": "Malware payload (AgentTesla)", "value": "25d164e9c3f904f016bb50a971b616b2682e874c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514801, "uuid": "64938c65-4457-4838-b8cd-ad8bbe0f7db3", "comment": "Malware payload (AgentTesla)", "value": "b0993bf2728c35ded900770c923650fcd7274f7b476ded14d71af866e476d9c7df0e2ca06b6844bbe95d7910e87d9e06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514801, "uuid": "b119dc87-142b-42ac-9826-dd3640fa0670", "value": "T1453592E01F404CE41CD70A2DDEE87A90DA3A50D16282951F7290E1B6DB999ECFF3E578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514801, "uuid": "18667f1d-0bbf-4e76-9834-675ef202a0f8", "value": "96:3s0nlJj/TmRx4B03+7dw03bf860egQCwy9i0+40UL0+l/9On03ljc+wsZInsI+CT:dYF+p6ET6Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514801, "uuid": "d6159660-c1fe-4708-8b73-f156ff779cb0", "value": 1137424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514801, "uuid": "2b05b14d-1c07-46a0-bd66-d6230fd7e71c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514801, "uuid": "df229eb3-b82b-44d4-bbf1-06c694aa91de", "value": "1229b4c666d1ec8f19cb3693023daf39.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7027d586-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495231, "uuid": "2801b0a7-b6ee-4f26-985e-f6698cc2ffc5", "comment": "Malware payload (Mirai)", "value": "89101afdca5776ac7e2b74e8156e3619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495231, "uuid": "92f630ee-b40f-4036-b8e9-8e0102abb23a", "comment": "Malware payload (Mirai)", "value": "70bbbe3812702c555b359de0ab92c7c81344a0b9e21402f88400fb2e3f94b1eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495231, "uuid": "4accb945-cf21-4369-93ba-69a38787104c", "comment": "Malware payload (Mirai)", "value": "d3d5db0d1a3a44aa3b4e3d00cd52b18736da7c1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495231, "uuid": "3f59eb39-dc9e-4fae-a53c-c25ca73247ee", "comment": "Malware payload (Mirai)", "value": "36181ee9fadd91f3566560abb8e7052532740143aa5f6836baa0bfc30a17da571b5bd31e856d9bb423d2fa91977e4135", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495231, "uuid": "37521463-a623-40fd-a35b-8c22e616a0c1", "value": "T107E2D0D4E7770C95EFBEAEF80826F7EA37D18A49364ECA3335849D065067444B242A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495231, "uuid": "0fa1dc57-3506-4776-92fe-a9659f1da601", "value": "768:mVU0vqgi/0mba0aZUbiQxh/FYw6aHHqqbDTkgxblS/Mxl4uVcqgw09o:m9Dlx0xxHXKqbHAwl4u+qgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495231, "uuid": "b1f1fa66-654c-46bd-9a76-4c89107f42dd", "value": 33484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495231, "uuid": "56676d1b-c8b5-44fd-aedd-e6ef8bbaaf7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495231, "uuid": "5a10e559-46c8-420a-b6b1-96e0c97c7885", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9854f7-1f73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773471438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471438, "uuid": "e6ad5321-271d-425b-9a8d-e394d205bba7", "comment": "Malware payload", "value": "f1eb37f52bc1194bcada7fe592a9ff30", "object_relation": "md5", "Tag": [ { "name": "daiteobeziyanamtelok-lol", "colour": "#521F6B", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471438, "uuid": "3ca12cd8-c0d8-4548-80ff-9b3c5223b1fd", "comment": "Malware payload", "value": "70df873ba09a85e63401e1052aa67a316e3325b888ec8f66126535ecd55c503f", "object_relation": "sha256", "Tag": [ { "name": "daiteobeziyanamtelok-lol", "colour": "#521F6B", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471438, "uuid": "3e169d00-4849-41a7-9d2f-3b4e301f6b20", "comment": "Malware payload", "value": "17e75e16823b9945e1e7538f8ee782ba63236d8f", "object_relation": "sha1", "Tag": [ { "name": "daiteobeziyanamtelok-lol", "colour": "#521F6B", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471438, "uuid": "bedfa6b6-6fba-42cc-95e9-5808ee365e19", "comment": "Malware payload", "value": "efd013918e9b85b263f5816efa0f3f122be233c41298a52e566d6a8ecadbffbd845c66d4d2d02c53597d6ab0c2132691", "object_relation": "sha3-384", "Tag": [ { "name": "daiteobeziyanamtelok-lol", "colour": "#521F6B", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471438, "uuid": "628a758e-d5c3-4b18-92ad-b14dc5b839ff", "value": "T1FF25C5635008C4A1A29E3CD23CE05FB769D3F7209DAC49789D7FFA4087AA5A3D34569C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471438, "uuid": "53c38d48-9ee5-486c-8092-0ad52ddc5ac1", "value": "12288:FBAX0qsIcUX+H8fsd5y0RNmJAD2e5BbB5XIlPFZYLrVZ9Jpxu3zoL3iz2fXm67qI:Fb8fsd5y0RN7twh+o/L68I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773471438, "uuid": "8c7d4276-00d5-4e5a-b31c-44cb265cea84", "value": 1014790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773471438, "uuid": "82715301-00ae-4e8b-8eb4-7d56140135a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471438, "uuid": "5f0905c3-4070-44e6-95ce-717a8314c480", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc48cca-1fba-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1773502043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502043, "uuid": "ce427219-01b7-485e-84bc-8112e3e7a0dd", "comment": "Malware payload (Smoke Loader)", "value": "ea09d31e6b6981fc4abfbbf7901684ce", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5955", "colour": "#235391", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502043, "uuid": "620782b6-a4ee-41ef-afbd-97df4573234d", "comment": "Malware payload (Smoke Loader)", "value": "71fed9b7b7f18b5fc1c8ad6a81f0b1849141231cbdc1bd8f44739ff5c46aa6ef", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5955", "colour": "#235391", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502043, "uuid": "7aadfca6-e562-4bf2-b4eb-603f847951bd", "comment": "Malware payload (Smoke Loader)", "value": "6a1df43886b0f064037c91c61246a00a8396ba8e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5955", "colour": "#235391", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502043, "uuid": "d22478dc-6fed-4e3c-9312-2dfa44c38837", "comment": "Malware payload (Smoke Loader)", "value": "dd84ecd8695f26d393e44bb5a35d7c36167a5e7103b7bfaff3210ce9f09c51c32b0bf5837cc5965e7f7647b941203bdb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-5955", "colour": "#235391", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zadno-run", "colour": "#BE50B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502043, "uuid": "12606251-25c2-48b5-b392-1a60e5e32ee3", "value": "T16DE5337EADD91D0420DC83BB77A7A130AD678A8CC0DA76BDB9D9DB2229740D37344C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502043, "uuid": "03f0c620-1dac-4fb9-881a-ff4c5143d2e7", "value": "98304:07XV+BX4KC4AVrgm1eGfCKcLCoYy8IO4GYrI6YEOVjp:5XtC55bPiDhXvrI6YEEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502043, "uuid": "15caac96-a189-4679-9142-354e09492263", "value": 3298835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502043, "uuid": "401c9037-d4cd-4d9f-844a-088ba52216c6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502043, "uuid": "2271e508-996f-411e-82f2-4baba70e3d0b", "value": "downloadlink.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e48387e-1f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773469941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469941, "uuid": "bd1597a7-a4fa-4408-bd57-9f2b6e22f1e0", "comment": "Malware payload", "value": "a0200ef0dd0b3460acb181802bf89303", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469941, "uuid": "c914eba4-e101-41b3-83c0-01012620aacc", "comment": "Malware payload", "value": "720caf07d5ff1274912569ae4d137eac7f161350f68c15856d92a2e897d5e47c", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469941, "uuid": "4a66ab93-464b-4b92-bdc1-463b35540840", "comment": "Malware payload", "value": "0b6715b7d70775f59baf3f6439a3b2cae464960e", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469941, "uuid": "e9de02d1-5456-4623-97c0-aae2ce29b6c0", "comment": "Malware payload", "value": "6dbdee4baab206309c98ec768980742c16aa8c8794a30016b76b88cdfe94648077b63395373b01086240dcd69034efe1", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469941, "uuid": "029385c8-7184-4f15-b2f8-eea7678bb557", "value": "T1CC33F9F61A80CB1968EB401972F0D4BD0F1CE29DF5D927AD8D915008ADFBB82D9CC791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469941, "uuid": "3cb8ee51-bccc-4b71-a080-1aef1873702d", "value": "768:Y6zyufWhm2d3jh2XTCSWMwy8tR5yDq2/+y8BIf3fnQmFuwMmO6ugTAvXiAnWGo:Jz8mAh65nwfUm3w9ayLGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773469941, "uuid": "71f1fb70-f032-47f3-bf74-a8fdb912240d", "value": 53886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773469941, "uuid": "d709d778-b69f-4c11-a166-a16b5509c513", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469941, "uuid": "33d1cd47-9e46-43f8-bd56-c29581d8cde9", "value": "720caf07d5ff1274912569ae4d137eac7f161350f68c15856d92a2e897d5e47c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b3a25c-1f7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773476716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476716, "uuid": "7e9ad314-50ed-44de-ae94-ec53ed321f50", "comment": "Malware payload (Vidar)", "value": "bb106a2384335422c0718139bd23e07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476716, "uuid": "684c1c6b-b59a-4feb-b621-75d5e9fd446c", "comment": "Malware payload (Vidar)", "value": "72a0843ee69efa50461d1d79333379be4b12cf714f4ed7fa5e4017a3b1ccf8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476716, "uuid": "0eca50ab-29a8-4b7c-93e0-dd5d3bfdb53a", "comment": "Malware payload (Vidar)", "value": "7a301b4f92cc825e47b55f62b99462cee387eeeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476716, "uuid": "e51b0dd7-c3e7-4b45-a024-51ea6fa1d7f1", "comment": "Malware payload (Vidar)", "value": "b9aba770eb6a5df88e63ddf1cafe59cf62669a1e620b75dc3efed7ea68e4fe17993e97a4267eae932ca6d941fbe316fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476716, "uuid": "98eede96-95e5-43d2-b54d-839b1d5cd63f", "value": "T1BCB57B0BBCA508F6D46A93328DB662967B31FC580B3223D31F517A782E727D0AD79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476716, "uuid": "7464d596-dd6d-4090-ae40-049a0ae15edc", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476716, "uuid": "9a93b153-8ee6-49a9-a6ad-cfbbf285c4e2", "value": "24576:h9R9CuZtYCQiu8pHgWqSJiol8ILim84NLn42XInSQE8haWtPQcxs1lg:h9RQuZtYCQiupWq5olhLXJ42XISghap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773476716, "uuid": "69d35377-6b27-4436-989f-bda681fd9b23", "value": 2323456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773476716, "uuid": "acd59022-ffb9-4f11-86a5-a57f82d1b7d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476716, "uuid": "745755fd-32c7-453d-bfb4-b9e9ebec9024", "value": "excluding.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaf93f5-1fa3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773492054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492054, "uuid": "94ea73e9-0a4b-45e0-8bed-cafc856b1240", "comment": "Malware payload", "value": "b60ffad8f8f5f5e8d9ab2fbd2f15ea5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492054, "uuid": "79629823-8e60-4ab4-a049-160089722f9c", "comment": "Malware payload", "value": "73c733f4e60a06f18635c259f067d9aff438ee177dc487b7dab884647c6f0dc9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492054, "uuid": "49ece51d-8ca0-4bbd-8860-c1a2f805f15e", "comment": "Malware payload", "value": "99aa364170bd97a8860c513d490bf72fb7f93533", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773492054, "uuid": "f5089f98-af3b-4ff3-b9cb-8c23c2b5332f", "comment": "Malware payload", "value": "c17e54391bda3502b4c2265397148a56be14a4811bcfbb4d6f0eb49261d836ecd5bc70087821011345b49061ed1b0c21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492054, "uuid": "2363dfbc-9289-43f1-837a-65a6703579d3", "value": "T1E3133B09B39C4233E96F1B7C2831865B8771B1269DA1F6CF39CC595E2F623C29922357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492054, "uuid": "06095293-35c5-4730-abed-afe773a3d2cd", "value": "e13d6fde0a929d0b91b3f3f017e9badc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492054, "uuid": "3fee18ae-026e-4867-a6b1-100b2d3919cc", "value": "768:Evjck6cl4F+ZMqTvEEeoiSqMomEdElj1g3+VJeV6lc5tuYsxYho:EQk6caSMLhulxg3+P66zYsxmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773492054, "uuid": "2b314136-f729-4439-ba73-bcb937732c38", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773492054, "uuid": "2394d038-5909-45a1-88a5-39dc92c5a72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773492054, "uuid": "53f29f2d-e0c6-481b-a685-06e4f6c56969", "value": "DEVOBJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71ae691-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515160, "uuid": "44918742-7e60-4f65-a97a-17014a318842", "comment": "Malware payload", "value": "a46fa61b229857b24e0a5b818ae3bfe2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515160, "uuid": "4c6b8b19-63b0-4ef9-832c-e69e9abfed8b", "comment": "Malware payload", "value": "73da400607e13546a9126409f06bdf025d8094c040a61588ff3959d083463d09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515160, "uuid": "e6317148-ed00-40cf-8394-5d3e74042721", "comment": "Malware payload", "value": "d75dd40102d5fc99c4197f4286054dac00e842ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515160, "uuid": "fbf93e5d-6ebc-4596-941d-ebd7846643eb", "comment": "Malware payload", "value": "fb452d268b2ef7308c5439a4f40756b21e34137dacc871aa824086b2bea652b6173cd7ba0ab31fe5e8a91568d21a7bdb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515160, "uuid": "b2b99c55-f09a-405d-961c-66005f36bae7", "value": "T1DDF1F939C3644A78492F0EECB23E004E9114C3695267BCA0574F5C2BEFC5A55CE752B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515160, "uuid": "657cb5ad-dc6a-492c-ab7d-98e3330d0f19", "value": "192:h05vkXo8Du4os5V0y70mXLqrElUe9aFVEaS:65kxDJos5CQ0me9TEaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515160, "uuid": "17d0aeab-18da-45a1-8c56-62b5f8561c30", "value": 7487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515160, "uuid": "62cbde81-3e33-4511-bf5b-c78ad4bd2496", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515160, "uuid": "a174e86e-5be2-41a8-9025-1ac52af2f1cb", "value": "a46fa61b229857b24e0a5b818ae3bfe2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74d86ab-1f72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773471406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471406, "uuid": "f7700e81-2079-47c1-985c-fa40ab019768", "comment": "Malware payload", "value": "8cf6c96819896db611f62439f844ef5f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "temucoin-lat", "colour": "#85F749", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471406, "uuid": "313e7f39-68fb-473f-8b0f-0036f93c7e21", "comment": "Malware payload", "value": "73fcd9f17078b4214ca94b64e0cdc7020f2fb1f38aa4585d8d5f55cc96e4343f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "temucoin-lat", "colour": "#85F749", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471406, "uuid": "74cbe5c7-42eb-4a62-a042-0b578bbe816b", "comment": "Malware payload", "value": "a5bba024d3877b3ddaba6dfd80d6a96b11d90887", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "temucoin-lat", "colour": "#85F749", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471406, "uuid": "9d86489d-3c90-4333-8dbd-baf8aa7b8704", "comment": "Malware payload", "value": "dde08e3e9828fc41e5e4d1d8f6e2cd692b1da78755b567d0d21c758d9eb119dc78e181422f92bb73a52a2c138833d87b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "temucoin-lat", "colour": "#85F749", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471406, "uuid": "59bb9176-69af-4f6c-b3c1-e51c55284f35", "value": "T129E055794F3AF8C4830AB060A6254C8931A42616D7785AAEF821196969203889F0F18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471406, "uuid": "14158a2a-feca-4cb0-b3fb-b616335070f5", "value": "12:s8hZGrO6hWV9E1ChrdvRguua+ZgkzKq+P8p4:rZGrfcTmirIZhzKvEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773471406, "uuid": "129b36be-9d8b-4af3-ba99-e89d76337996", "value": 425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773471406, "uuid": "d6bd9617-fc22-4976-8388-69658d355e8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471406, "uuid": "1776c8b4-1f42-4660-ace8-680eed57e486", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997f2761-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495300, "uuid": "4fc054a6-7c6d-41d3-b7bc-463ed03db1d4", "comment": "Malware payload (Mirai)", "value": "405b160031110870d93c0d66ac1032e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495300, "uuid": "e583753f-3b52-4c61-9fd9-183198b15402", "comment": "Malware payload (Mirai)", "value": "74643421e75e2872b51abca8e7e295d678943a9e92105ffed2e32819bd99ae38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495300, "uuid": "20de8b66-74e4-4230-ad54-5b29d569bae1", "comment": "Malware payload (Mirai)", "value": "56eacfec9fb55b177166644151604831d51c7d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495300, "uuid": "fa8ec1c3-4bc7-4833-9259-a6256f5ffae1", "comment": "Malware payload (Mirai)", "value": "c41823a4daf90d60c1b5ee69b987a8fc5a4b2288a1dd3553c634c4edb02103ae7cbc2a9028ac28d56f36c420008048e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495300, "uuid": "2ebf7563-b9b2-4195-bc94-5dca649f3e48", "value": "T139730995B8818B22C9D512BEFA1E118D3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495300, "uuid": "ce7c0bc6-5525-4eb9-8006-7fff46fdcca7", "value": "1536:TAnYSDACyTQ8bE80RbavEwpDQQMgiR33ATHa387oL5oYMd:mMCHYp0Rbavg3ATHa38kLyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495300, "uuid": "ed71b7b2-e997-41ee-a748-1cdce842d192", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495300, "uuid": "8c128918-3a92-42e6-8133-175a09d9dc4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495300, "uuid": "e8f1c9aa-cf8e-40e4-8b68-49743f3b1590", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4739f665-1fc7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507617, "uuid": "7c0ef254-9535-4e63-8d60-7f1692e23903", "comment": "Malware payload", "value": "393c8940ebb33c0a664dc00d565c8b90", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507617, "uuid": "ad42c78e-d3a8-4a3f-a062-fbebf44adaa9", "comment": "Malware payload", "value": "74a2ad29d7ad99a8ee347498b0fb30e56abac165d5bfd02a2606488c39025b5c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507617, "uuid": "b3f8fde1-6400-45e0-a109-06170e0c0a13", "comment": "Malware payload", "value": "e490b657ee446abcabec46a49540bd7c64f2dc61", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507617, "uuid": "c64fc764-880c-4bfc-8189-a0fafbbdb131", "comment": "Malware payload", "value": "c0d3d1c195fb8c11de523b91a974f166eef1a8e5b98fd4e0aa0525c48e610917400d19d4cc627dc113f6dd1b0b2e2e73", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507617, "uuid": "b68708aa-bda3-434c-8c9f-a905c7c5046c", "value": "T1B16423617C5AD4B9866CCB3D10AFC23C27E19EEF984DF6277ACD59C6874A2C1443A81C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507617, "uuid": "4a5b18aa-fe56-4a7f-a23f-3e0100d8dcb6", "value": "6144:AMHdLk2k1PdjFO6+JAdpBTrBkod1X5Ng2bmp8hygLUGNKJ+fkdGe:NQPpFO6M4h+orL1bmQHNK4Mce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507617, "uuid": "12cd1fac-e6e9-4309-8de8-53b3fd20c7be", "value": 321143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507617, "uuid": "ea565bbd-cf1b-4411-9e96-70da863d1cc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507617, "uuid": "5806ffef-b3d8-4bd9-a554-89cb640a9a77", "value": "74a2ad29d7ad99a8ee347498b0fb30e56abac165d5bfd02a2606488c39025b5c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dc250c-1f4f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773456255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456255, "uuid": "171a502b-e7fb-4edc-b34a-8531692c6e28", "comment": "Malware payload", "value": "9f29901cb5d351c47726dcb59941770f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456255, "uuid": "9d7e9c5c-1ac5-4333-8319-b1eb35de2624", "comment": "Malware payload", "value": "751c9590219f90c83abcd37d32f8c3c24af2b634d83ed8f55f800d38e8a00c7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456255, "uuid": "6dbdbf1e-b07f-4493-87fd-6c7c7c4e2c1c", "comment": "Malware payload", "value": "2aad5c2614193773ca5216d3479f9d8350d164a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456255, "uuid": "c96a799f-a7a0-480e-b903-6d44c0f8b651", "comment": "Malware payload", "value": "cc48e4a2d7ce5c13a5955e2ed0f0b1521699d22d064cc1c76ca1f582c799c5b821d1961a11b8d5c613c823289fcea11f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456255, "uuid": "d4dbd783-e535-41c9-ab23-1ddc4657ef85", "value": "T185924CB512896C79FBD0CE399F3C6F4CADE8C2C42124A3ACBA4F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456255, "uuid": "1d1811c5-d203-4b9d-9d29-eaa0a5ff0d14", "value": "384:8wcuQpWx+BL0SWL0gizsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:8w8i+BL0SI0JzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773456255, "uuid": "f56ef9a3-f2f0-4cdc-b92c-23b26d50656c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773456255, "uuid": "c1f398fd-d7be-4051-a895-f1f848ee2c71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456255, "uuid": "b0795e61-f939-4ed6-af95-299dd0cc8949", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7ca90c-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515515, "uuid": "9f6162d1-ce5e-4f08-8a65-76950df36629", "comment": "Malware payload (AgentTesla)", "value": "68fc5d3ccb8dee8770711e25598cce08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515515, "uuid": "b26ae811-b68e-4497-a043-afa591f63843", "comment": "Malware payload (AgentTesla)", "value": "75cde163fd6961d96e6621ebf7d78e4f72b45fd553c6d35f34fc8ac655f72735", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515515, "uuid": "904f29fe-3e77-462d-86cf-d6c16ddb88ca", "comment": "Malware payload (AgentTesla)", "value": "a51278bfb17d30431288e259a5aa1d382a3e9cec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515515, "uuid": "761c40d0-51e9-43a7-a921-0d3e44e7ddf7", "comment": "Malware payload (AgentTesla)", "value": "1eca0575b8750d59314384f9cddd7f494592d8f18dc60bd2ac0c703868b2e08e4239d2c9d540e858a4ae2b399a90a38f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515515, "uuid": "4e171e4f-0da3-4592-b647-7b52972a0c3a", "value": "T1A9558E03CDDC2538A390EB17B1DE2366D5D8F6438A09E6AEE9A835C45CFF7008756B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515515, "uuid": "a4073d2f-8d63-4a93-9fde-2c489f1a9e55", "value": "24576:j9ooQ2M8+2U/4jgSDi7PQceuxprjyn+r7sjldy1Np5Aa2LiZqlKD5NeLhNjSAjOd:jTpm4ceuxpfzmG1rCaG9wD4jsZVria", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515515, "uuid": "38977a10-1421-4f47-86d0-5013e8224cd3", "value": 1378275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515515, "uuid": "604d7128-5b72-47cf-add9-f84225050d2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515515, "uuid": "294b972f-be44-485e-b4f9-e20ffc21e374", "value": "BLDOCUMENTODECONOCIMIENTODEEMBARQUE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c3e3f3-1f8a-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomStealer)", "timestamp": 1773481573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481573, "uuid": "420729e0-db27-4002-8ae7-ff29c3e73c70", "comment": "Malware payload (VenomStealer)", "value": "c31ebc969030bb0651201abb6d2bd4e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481573, "uuid": "3e4c693c-3c6c-404e-98a8-733420463c71", "comment": "Malware payload (VenomStealer)", "value": "7635dcadc6e2fb115a2d027739a863c37def467afca99179d3102518078f33ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481573, "uuid": "6fd9d63c-d507-4576-b0d0-a399e7ad551c", "comment": "Malware payload (VenomStealer)", "value": "e67c90cdd012a7b50945c368e232366081b4f525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481573, "uuid": "27a557c0-8a3d-4c00-9fc6-3035fc4b5c4a", "comment": "Malware payload (VenomStealer)", "value": "fd2844c8b1cd4c6bd42e2284d1dc5a70adedbaf4977759a3b5d8ff17d88c39f0e2cf468ce7fc5709c8516ce5c595ed27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomStealer", "colour": "#77E676", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481573, "uuid": "419d9193-97aa-480a-b2d5-e41f748f9821", "value": "T1B9A52377DAA971F9E09F8D3084955881EFA27C23AB11EEEB53544E392D166D0CF38B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481573, "uuid": "b7fed24e-842f-4cb8-893b-6b897e05ec78", "value": "6d37d8d211e2046ee417febe92e137de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481573, "uuid": "f8ff6290-053a-43c6-b909-e9073d7182e7", "value": "49152:m4eyfUeBaXsv2fft50iG5LP/Klhl/l/5zpxzqI6bOq/E:m+fUmyC2fF5ZsLP/kl/lh9BqI6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773481573, "uuid": "0bcd8fce-7886-41bb-b245-efb1f379fe7a", "value": 2100736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773481573, "uuid": "225f5d98-8627-4310-9779-a1f7e8824aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481573, "uuid": "ed448000-8e44-40a7-a7cc-fc92360cf8b0", "value": "AcjqUEy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e1e0b9-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493891, "uuid": "96b5de5c-8622-405e-8c34-76e20e959f9c", "comment": "Malware payload (Mirai)", "value": "d60ecce14ba46a13e10cd64045ef20ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493891, "uuid": "893b6a15-cb0c-4c54-8155-3ae966295b87", "comment": "Malware payload (Mirai)", "value": "767a08d7123e4af8ea56627600b3dc27c176bb8047536ace508c6caf6f84a4d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493891, "uuid": "a9875ea5-9ed7-4937-8274-55c51f0dea0e", "comment": "Malware payload (Mirai)", "value": "bc83345b1d32446225afed4568309ba8469460da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493891, "uuid": "bd88319c-b2f9-4af9-8b48-7cc1cff6ca7c", "comment": "Malware payload (Mirai)", "value": "7819a98607cacb95139456b97923369d52e50e8dff0774bfa8f478d016044a06db6cea25965ca52d0c76331249615722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493891, "uuid": "ccbe96c2-ec5c-4b16-9781-6dcc356b52e8", "value": "T18303F16B81115EB5C2731C3269FC1AC691E22FB8F0E670236958A2B956C5DC3137B6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493891, "uuid": "5a06b3e2-12bc-4022-bfc7-8a576601dc27", "value": "768:h04CCQup1yMKE18CZExF72sS7g8Hm4C2uiC6HQ/wc8z19q3UELo0:h0TupMMKbCZmEsL8Hm4C4Q/wbMLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493891, "uuid": "a008ae44-ca06-4e88-bce8-16a969d1364c", "value": 40040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493891, "uuid": "e40c4e66-d393-4221-b5da-397ef2be8c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493891, "uuid": "a05dc57e-b5be-4b51-9472-618763a48617", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e36629-1f94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773485905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485905, "uuid": "d1225afd-fbda-4668-89ba-f0ebadc4fc83", "comment": "Malware payload", "value": "3080e3341220ff532706dfb2d6b7e8eb", "object_relation": "md5", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485905, "uuid": "c8e2eaa3-1f70-4023-b78a-cda19750c616", "comment": "Malware payload", "value": "76eb713e38f145ee68b89f2febd8f9a28bbb2b464da61cb029d84433a0b2c746", "object_relation": "sha256", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485905, "uuid": "3eebf0f9-a1a4-4cd3-9959-e7655138cc90", "comment": "Malware payload", "value": "6135b621f7f8d1f32c7cc99bd4b99012d46bacbd", "object_relation": "sha1", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485905, "uuid": "c61bffea-7e04-4782-b42b-7f36c6b69d5b", "comment": "Malware payload", "value": "6dbef1583c221b0addfda75738031bb67219a93c90aa14e51a7ebaf35cbc022eea543a74f3af42bb200310166adcc533", "object_relation": "sha3-384", "Tag": [ { "name": "DRILLAPP", "colour": "#F9E31E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UAC-0190", "colour": "#D8FA4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485905, "uuid": "032b33fa-6c2e-4d75-bd37-6e727beafe83", "value": "T1C034948177C6BC8112475777371BB1F6E92EDDA8B088088EF404BCA8F1BD916EAE4571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485905, "uuid": "72cfa9f1-4405-4859-bb37-5a7bdd6a7cf0", "value": "3072:BVWl2NheSWAcvGJx7TvGpSBDnrmnj07RmdeVQ43ohPTkgu7:BVWl2NheSEGf7MSBDrmnQ1ynkWLkX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773485905, "uuid": "e10f1eed-4129-4e10-bf17-784cb8df2943", "value": 251281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773485905, "uuid": "4bc12234-eb0d-4a3a-b1e3-992c715220d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485905, "uuid": "3954e5ae-d7a7-4c9a-aa99-3f1c30263918", "value": "f69UjsFE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54119f99-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493895, "uuid": "421d61b0-88db-429d-a703-8ffeaef3fc57", "comment": "Malware payload (Mirai)", "value": "fa518727e16d5a343d1f19943ebbb02d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493895, "uuid": "62030d43-ccad-41ea-85e8-37f602cbe0ba", "comment": "Malware payload (Mirai)", "value": "777153bb64be996a92f6d0f7c8810a16b6739ebc7c083fdaad22e03709f1f4ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493895, "uuid": "451b2ba8-ee68-4d7d-9955-f9f2259ed0fc", "comment": "Malware payload (Mirai)", "value": "eba4a8af8255e447aba3baa1014047fe894a2f97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493895, "uuid": "6a077aea-081c-49ea-b47d-97cb6b046ec5", "comment": "Malware payload (Mirai)", "value": "39393fa5acf218342acc17efd245a3975944e0e3b324715deea4f9374f9ae7257b6ede5e303dbefd071e2ca5c3529f54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493895, "uuid": "5e85baab-6cd1-4cd1-957f-92494f9219a6", "value": "T1B5834BD7F410DDBDF80ED77B4463490AB131A39219831F3A639BB967BC321943966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493895, "uuid": "07bfafa7-8f1a-4d0c-b12c-0e0c0d51db61", "value": "1536:mEOAoGHPfo5HqZWaDX+aZ8oyCsFTNHFFaWonzs6N2uAQJSYh2a4rsvg:mEOAZHPWqcaDX+aTyCsFJiW6zsKAYh2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493895, "uuid": "4e5f2831-3011-4f87-82c4-8fadbb77de42", "value": 85804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493895, "uuid": "068f0986-7656-4cd0-9329-4c5716289f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493895, "uuid": "b2a35b52-c961-4976-b67c-192116f9f8cb", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92609a15-1fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501301, "uuid": "ffc14dfa-d298-4f75-996f-1964377216f3", "comment": "Malware payload", "value": "9d2a38b6bb73d2bd7dec3c9deb7ad15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501301, "uuid": "e251c957-58c9-4da5-aee9-19fd07260cf5", "comment": "Malware payload", "value": "7785d48cc964bdc333e08d1e9acfb640bbe9a8927fd47fa0001349d8ee20a527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501301, "uuid": "3be7340b-5eed-46a7-9658-380fed5fd6e2", "comment": "Malware payload", "value": "0fd354ceb13a2908d0e5e209ec83fd5b0520a71d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501301, "uuid": "6ddfbe56-33e8-499e-a1c0-95e3639aefde", "comment": "Malware payload", "value": "9e7744515f590c75909e20d7842ed1cda57b2c639b6c7fbd1ee75598dac16229818f3942e23410b162d5540fc0b97cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501301, "uuid": "eac0e7bb-bfa1-443a-b68e-da9e63043ee1", "value": "T1FCE633556F93F0D1C50F8A7B1BC20449D7B21E2DBA8E240B77093B9562BD6E7CF189A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501301, "uuid": "f2c20d72-e140-4f20-8ed8-936508626d71", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501301, "uuid": "63cc4777-994e-4030-b412-162b24d8f491", "value": "196608:MQWbvGzcyUETU0oaM3oD2srGTtLkPY8EmU+/1BEDORwEriGNY11hGKLU9PLyTn2L:SjzCjMeWLAxU+vEDsiGNW1h2PLQhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501301, "uuid": "f35432cc-7137-47bc-8d7f-8e9bda54df26", "value": 15220224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501301, "uuid": "3624b5e3-7aaf-4df5-aead-a12fd5558c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501301, "uuid": "dc2e10e2-2ba0-45bc-bb82-1056faf68472", "value": "Installer_v5435_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560cd0f5-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494328, "uuid": "cc736f60-ddfc-4516-9900-2fcf644379ba", "comment": "Malware payload (Mirai)", "value": "e93e62abc7c03dc96cd0e201b2ada85c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494328, "uuid": "99188cec-06ed-466d-8040-5e8cbd718252", "comment": "Malware payload (Mirai)", "value": "77ca36146f2992123fb48e61f3d1885abc530ec7c40fd61e56f9b19d90f54978", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494328, "uuid": "dfdcf080-a88a-478b-bbe7-fd1add963731", "comment": "Malware payload (Mirai)", "value": "cc5f2b6f52d535ab11363a2df3adcbb29dee35eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494328, "uuid": "1c11bb6e-c2d7-4cba-910e-ae8acae95f38", "comment": "Malware payload (Mirai)", "value": "559fd07d8f3cfbc7cb9c14a37c8ff910ce643ae69fe6c9472a1690e8e416ec32d0f1e6887e939c5db75982e30be1fcc2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494328, "uuid": "b067a34b-2fe1-46d9-a18f-a85adcfd1dec", "value": "T1F141D8DB22F044F38846DD42F75450E1F49866D3A562CFFCA06C5A6A68982B8F1F2F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494328, "uuid": "b866ada1-0e2d-4376-8fd6-c35f453aac24", "value": "48:TXCpdKfMXLuXBpDnDCiA/1KPDNKPiLGfV2v3N2v+ZxYHD4iH5u:TXCpdKfMXyXBpDDhA/cvafk3ZxYHD4iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494328, "uuid": "c3d718e4-2f43-40a5-b658-dec516c38c28", "value": 2260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494328, "uuid": "f3b4d1b6-eb71-4c36-ae37-0d582078e3d1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494328, "uuid": "566b62e3-0d59-4eea-93af-0bc875285831", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c118bc-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503756, "uuid": "ac8113c6-cfb2-46e5-ad96-4b0aeb50aa8b", "comment": "Malware payload", "value": "efb667f94d59a0d72dd78dfd2d6e68a4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503756, "uuid": "1e605eb1-32b1-46fe-b7b0-787fbd82910e", "comment": "Malware payload", "value": "77cfee64e0634bf8e0ccac9264f9915c1122619b86e3c18236224c4006ecf52f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503756, "uuid": "eb94ffd0-184d-47df-9726-e55c5d21cc1d", "comment": "Malware payload", "value": "5256ed94fe7bc2d7ec202abe77c8556fde43b331", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503756, "uuid": "874a973a-5531-4382-a3a0-6f931c94836f", "comment": "Malware payload", "value": "cec69c2b3c61e305c22e8eb79c21d4749f1d5fa16e994df30c05dac4f700d719d26f779aa2f4ed28fa65e6a23810850e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "russian", "colour": "#917D91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503756, "uuid": "3caf56ef-82fe-4db6-8d75-77bb0d7d4e0a", "value": "T13FC22C620ABB19B69003C3EB6F65B715376B20736616E87DBAAC06E0DF8105D54737CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503756, "uuid": "03854109-cbb4-43ac-b59d-6d6df4129673", "value": "768:nnfrFKFcFAFNFxIoTaZOx7RLJM8jtHdmal9IY:DcKGzXjpMQF7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503756, "uuid": "721b78bb-1f4c-41e0-b590-64a1204dbbae", "value": 27385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503756, "uuid": "025f7310-165f-4595-9f17-1b9142a5d19d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503756, "uuid": "e76f802e-6b54-42ff-b5ae-364585a8080b", "value": "ocherhydro_clickfix.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f734b0f5-1fe4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773520368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520368, "uuid": "55e1b890-2dc6-41df-be56-1444a9e35163", "comment": "Malware payload", "value": "05a819f8e860205bdeae9fd37f4cba7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520368, "uuid": "684e7dbe-f0ea-4efb-ad97-17c5e18e849e", "comment": "Malware payload", "value": "78639b2b09d043493565eefb538d174a7db78b2cf1b9bd9cdf5a81e63995594d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520368, "uuid": "168c0087-e4f4-4396-9429-3b7e08315f8f", "comment": "Malware payload", "value": "7b7232b27b6dfc2e1c3161f46013b85760db0fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520368, "uuid": "475fe3be-96d4-4dc5-9b72-3afa5c184e20", "comment": "Malware payload", "value": "985f607689e40dc987ed021f7943d819bf6e5faab55491a1a8e3fdeb147e9ff56b27ab1454e8e3eb3ea5122ba35abf00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520368, "uuid": "032a5f01-e3cc-460e-8808-5ef3c96e59f7", "value": "T15296758FB674861388E263B5B2063573BE2BD43547998336BCEDE435319F07E4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520368, "uuid": "b20c3827-1518-45f6-bba7-40f6099adcf5", "value": "3eb6c9caf7d443c05592ea4741193731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520368, "uuid": "cd54bfe4-bafc-4da4-a31f-5b757c37aad9", "value": "49152:pzeRG1VYTBcdpvbT22zoXtnFzNh/RPDbXRjLA2NmoL8d38CKTQWA6KXshHx+mTt1:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773520368, "uuid": "02efcb92-ac20-43c0-926d-699ef85db9e0", "value": 8945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773520368, "uuid": "064c4fa6-b9c3-4448-9ab0-bda6c0265ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520368, "uuid": "a5ba24bb-0c62-4794-954a-779a094b8d87", "value": "SecuriteInfo.com.Win64.MalwareX-gen.75331548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a26ac67-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495221, "uuid": "4e448172-423c-460e-95e1-94f57d09c1a3", "comment": "Malware payload (Mirai)", "value": "814dfbe89dc40230b55aa83c267b3b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495221, "uuid": "cc373652-ca05-4726-afa4-f3c24b474268", "comment": "Malware payload (Mirai)", "value": "78674d810118d774c48a50a6f4a15b597cd006635070903849c1543681dd5498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495221, "uuid": "99584913-95c3-4464-9bec-dce9c43d5f4e", "comment": "Malware payload (Mirai)", "value": "d46d552bc6b321b394873e734a56b346ab2f4c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495221, "uuid": "2fb8a273-fe99-4552-bc83-71f43ada7a78", "comment": "Malware payload (Mirai)", "value": "5a01d2f66b4f69fc5927928ee7b2ebc8ce71b78c99edfcca089a69956811853f6938cf683d2efda9cdab33474a3b2c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495221, "uuid": "e6b2a597-fe70-4b0b-b918-852f32607454", "value": "T142E2F18A88D8AE1ECA6553BC556AB780FA15A4A42F5F53016ED5CCC2A8033F5F131933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495221, "uuid": "33d669ee-63ed-4ef0-b03d-9a272907666b", "value": "768:WBbVkTrCrlU46JCSVO0smsL0AjDTK1xtltO0:KpZADsLjPK1xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495221, "uuid": "9556129c-8c29-4ab8-b121-6a5094dc62c1", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495221, "uuid": "9354a66e-e2ba-443f-a78e-90e65ead0fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495221, "uuid": "fad2ab7f-186b-4b57-882a-86dc0cea976d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda52f4e-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773515628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515628, "uuid": "506020dd-daa1-4624-96a3-c1fc4a5ffed4", "comment": "Malware payload (Formbook)", "value": "197164fb0a7b96aaaca092760f3ec419", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515628, "uuid": "b8f699d0-3c40-4ce4-9b9b-9023807b21ea", "comment": "Malware payload (Formbook)", "value": "79940efa2306d8d62d7ec4b8a30e708682e3fcd198896d508990df2546d6447c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515628, "uuid": "31e5af1b-9ef1-429e-8073-43486b16ea88", "comment": "Malware payload (Formbook)", "value": "74c2f159f4e73b0e0cf05d1ad631ff361a4e7a9a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515628, "uuid": "3e53cb21-0576-404e-a90a-ebd252c522b1", "comment": "Malware payload (Formbook)", "value": "07915e6460b7488271790545f1405f1921cca3748d9e1923c217a342102aa14774a2d0c68eae5fc1ad00dd063f453347", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515628, "uuid": "18389dfd-420c-4dd5-aa7c-c2ac4dd76661", "value": "T12653EDF6E174CF8846B7BA705FCA286E34AFE41B42176F5D9DB124D9A9C250C2C047B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515628, "uuid": "2af144ee-e58e-4880-9a0f-e873a74d6efa", "value": "384:vOS11mX131GeBk/rxAnB/hN4f/DyBdl9JFWPjsaS0mOwVzL5:vTA6eYiuGzgw7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515628, "uuid": "76e00641-a4e3-47c5-a7a6-51d3c51c8b0d", "value": 61515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515628, "uuid": "d303e6ee-18a8-4d3d-95ee-e1bdcf6ae011", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515628, "uuid": "1560d9f3-6955-4974-a353-6b9dda8eee44", "value": "197164fb0a7b96aaaca092760f3ec419.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aecda3-1f9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1773488319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773488319, "uuid": "ece8a395-3081-4983-9cb9-8b564c148d11", "comment": "Malware payload (Arechclient2)", "value": "0f1f8d21ca192f340b5a0dd6233fc9c7", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773488319, "uuid": "e6225940-ce93-41b5-b97d-b9131a2b877e", "comment": "Malware payload (Arechclient2)", "value": "79977839bc9b8e19d817967ac15d4986d7063e18d451d5cabd75b514d2b3bd41", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773488319, "uuid": "ff3ec441-6ae4-46ea-8c50-a34d97025f3c", "comment": "Malware payload (Arechclient2)", "value": "8d78cba157bc529722c58701a5dc1c3783ec5f46", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773488319, "uuid": "efd2f8ec-8514-42d3-8682-d2e5193c7212", "comment": "Malware payload (Arechclient2)", "value": "d9819fc079376bc7422086f43aa9129989a0b2f5ae9f3a8308865f5d8f0f2f56efd462f1e15b1c1dd068c0bd30de2ee5", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773488319, "uuid": "a0196e78-750e-456e-ae68-8aa4fcff99c9", "value": "T1DB36BF2276818172E5AF037098BE977E8539BD21373384C793C4692E1E32AD17B3A757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773488319, "uuid": "e0e81bbd-4d0a-4b33-8043-e3f9a21c4522", "value": "98304:mN0ZYZMV39oAH4veHjPMNakBEs4NKAMWZQLxkeXQN5Y/vURo7o21R1llrs:mGz8eH9kx4NKAMWZnNCH31Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773488319, "uuid": "a1d16795-1a8b-4590-ab93-8bc232ec7d30", "value": 5331968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773488319, "uuid": "7e08a195-44c5-4e80-ac31-4abd44b04189", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773488319, "uuid": "11e0df53-b32d-4349-8ad9-38ed00695473", "value": "POCO.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86515da9-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506435, "uuid": "5257ead8-362f-4aad-8734-16dc7648abea", "comment": "Malware payload (Vidar)", "value": "533243f6b4cb0c41412e1b53e3a57506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506435, "uuid": "8983be67-6346-4a4f-a069-8e35a5c679d8", "comment": "Malware payload (Vidar)", "value": "7aa72cba5dfcf4e3ec263538fec67a8fec1d1ca93431e0a21ca05b8b834af0c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506435, "uuid": "5b13622b-bf26-40c3-8930-f33085a37243", "comment": "Malware payload (Vidar)", "value": "94fd83bd3fa0c43b8174cb9898b67c44084ef63c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506435, "uuid": "5bbf3068-0ff5-449c-9967-fd0fb7efa8c9", "comment": "Malware payload (Vidar)", "value": "4b31ce48241cfe8a2814ac50878227804e914713212095f5ba28e6cd6ab96eac942422053f549f4da636a545e84e4515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506435, "uuid": "0e2586df-d970-48a4-ae8e-eaabce414739", "value": "T18FE409BD9C60E326F70C90BAE242D752CF2139051236A6A319BED3241245972DF677FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506435, "uuid": "a4c1c749-2bb6-4a08-98f8-ff2f6ec93497", "value": "12288:aaqyhmuIzDEXSVm2qg0SsRQwbV72HYuNbs/a/0xMVxEZKxb2O:aTyCDR/qgXsawJ6Y1MMZKxb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506435, "uuid": "a36f662e-f352-4b9b-946b-c43a0cace54a", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506435, "uuid": "f2d1ef14-c4e6-4c71-be5e-8b5510a51624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506435, "uuid": "c379ea60-031d-429a-9cc6-da8be98c02eb", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b59b26f-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773503732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503732, "uuid": "437eee4c-f4e6-4f2a-80bc-b75ad3e63397", "comment": "Malware payload (NetSupport)", "value": "631e5b6951e8b6b16e23220cbba0e1f1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503732, "uuid": "53dde091-d474-4981-b87f-04a08afb1a28", "comment": "Malware payload (NetSupport)", "value": "7c9d85c89949b43ef2fabcba580f8a308af3706db4d6b6ca1d8a626fc8a2149d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503732, "uuid": "22ef071b-c701-4df4-b31e-176737a20142", "comment": "Malware payload (NetSupport)", "value": "0bb7602a4a1ac9e7e4b72fac64ef51e78519ece0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503732, "uuid": "9b7b3d6c-4661-4d16-a25a-571b64d22e36", "comment": "Malware payload (NetSupport)", "value": "e7a1e965e1ff9e88152fa9cd18fb35766795c0bca611ec452d041428220b7cc16bb2f064505d15744076fee2b7b4e68d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503732, "uuid": "f6292f47-3ea2-46a4-a7f8-67e49282145d", "value": "T18B212B8F034F7A39D24106E5045F0A6EF8D3DD1F4ED28D38D5FCAA402C101CBB101844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503732, "uuid": "ff3561ab-1b72-46b2-bc62-801bce0ab674", "value": "24:mv5NovhlCwAKWUbH7Aw2yIDh/pq+hnOXYAFcvzMt7x63KRAV+1E+nbNJD9HlZEw:8ChltAPWUWIDhRq+hnyY/vI7c+e+bbnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503732, "uuid": "8796a863-d312-4be2-b19f-72062847a723", "value": 1375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503732, "uuid": "6e7daaea-d5df-4b04-ada0-c3f0f976f8c8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503732, "uuid": "bbec240b-767d-4651-b7ec-222bec98458d", "value": "cloflart_lnk.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb86416-1f80-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773477104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477104, "uuid": "0201b8b9-791d-4f7f-b610-a4fffb083092", "comment": "Malware payload (Mirai)", "value": "6f3c86e051f5cbe230b65613d90885eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477104, "uuid": "d0f46f82-d06d-4e78-953a-ac4ca35a6ac4", "comment": "Malware payload (Mirai)", "value": "7ca108c9ae91833c1bb9da9b6222d13dfe51760760dc545cb7d5dbd3a2028836", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477104, "uuid": "359b944a-c80b-464a-8973-d80c2fc10a5b", "comment": "Malware payload (Mirai)", "value": "e51c4fcc6a350c3fb4e5d4e63d1108c59329a92e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477104, "uuid": "e953c96e-3726-48f6-a5c8-9d27681a166c", "comment": "Malware payload (Mirai)", "value": "bc709ecd4c21a9a032a8d3a3f6db83f45d752b20f4d775d83b942e225e1b52caa40bc55b349e9dc2a5ed9f078dda1b4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477104, "uuid": "2ee64ff2-8345-4655-82c8-462db61fb866", "value": "T19D41EDF7FDB441393045C1B8E5EB4679D787082B04482C29789EA8386B7D418E22DF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477104, "uuid": "7fb01eef-c145-4d65-80b2-679f67da75e9", "value": "48:KipHa61taRpxYmXRHSvvJtlslVt1/he1O1ho:TprJ037pho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477104, "uuid": "029ebf28-f304-40b3-87f3-8be97fcb8015", "value": 2104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477104, "uuid": "0daa9cb7-22b8-41f8-b188-14cb83923aad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477104, "uuid": "8525cf47-043c-4ea6-bd9f-7860f52bd62c", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90af5ab3-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773505164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505164, "uuid": "e8c64e51-f442-4818-a2f2-7eae8231144b", "comment": "Malware payload (Vidar)", "value": "5b9b15a7edb50fe6154c2ba95bf320de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505164, "uuid": "64c1b646-a411-4a44-82ed-e18023a91e8f", "comment": "Malware payload (Vidar)", "value": "7cbb4a32615c7c30d065f1daaf222f208e682f6521f0823de7c566430c5b8f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505164, "uuid": "0ec2146e-e241-46d1-b92b-564b4cd3c74b", "comment": "Malware payload (Vidar)", "value": "dd8436da924ca6c4f0c91035a64311989f568744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505164, "uuid": "9c8a62a3-244a-4980-b17f-4f5cbc7ce805", "comment": "Malware payload (Vidar)", "value": "d0bbf3876d85679802bf0a638a36338690975c564e51cbaebe78e5b44674bf07ae2feb52b75c42b695bf10cf51346012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505164, "uuid": "a9da428f-1d21-439f-b654-0b66d3da98e4", "value": "T1AB7607BB626081A8D1DD823FC4928B85D8F371753B33F5E746A103697A425E4BF7E260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505164, "uuid": "ab1ad05c-5561-4c52-b1c1-89708d506c9e", "value": "4c0c021979edefefb6f1fdc1b57809a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505164, "uuid": "d944ecc3-d134-41b1-9a07-2444ca9e63a9", "value": "49152:9iNRNV9FtBZRupRW5UFfYxbWt8FU611SBqUYwUchA9qq8bt5scYlUeRgoEaOOQO:9EPy42oE4QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505164, "uuid": "e2e254e8-4fc7-4603-b428-25f29826a915", "value": 7426560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505164, "uuid": "25841d07-d8d8-4792-8094-c89d858293e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505164, "uuid": "3a94a981-a4f3-4730-b4a7-9abf88488bd9", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a50e7d8-1fb3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773499006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773499006, "uuid": "94dc2312-142a-451c-a417-00b019b25e11", "comment": "Malware payload", "value": "e0e254146412d4624f54f51be9ddc95e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773499006, "uuid": "d961e095-28f6-4f14-baa8-1a9ceff26242", "comment": "Malware payload", "value": "7d503778dd80a53cfe3121b893a56e9669aaf369ab040f01e836a6a39531e983", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773499006, "uuid": "3ad1e858-994f-4eef-9d19-5e3e60579be4", "comment": "Malware payload", "value": "c79c4210ba45f2d3ac73c1ca470680273bb2a553", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773499006, "uuid": "2ade33e2-3d25-44e4-ae7a-a2ad76c495d9", "comment": "Malware payload", "value": "4a15b7d27b294bb561ad8b34a5e44ee8d72e437f15e4f548e32a9cde09f81417fcca7ae7a1a91bf645968975b5932c18", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773499006, "uuid": "fdc9cd9c-59ac-4ab9-8753-75acc16013eb", "value": "T13B5733D9E046A54EE67FF83159B407D90A6A7D1A2F520D3B3178361AA8FF7D4263F800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773499006, "uuid": "3138af14-2def-4636-bae5-e6c01aac90b0", "value": "393216:LKKCzclToHywGg8lSwl5jEb/lgAoLnqbklLu13C8lrmo9bO9pZoTSMqa:WKuisSwcjk/WAoLnqbx19xH9bO/oSja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773499006, "uuid": "945e80ec-514e-45ae-863b-93afaad246c2", "value": 29458432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773499006, "uuid": "84ec5b14-262d-4f73-9936-469eb2fe06db", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773499006, "uuid": "8c6e01cc-213f-415f-a008-fab96a3e3f2b", "value": "CarmineLoader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccbed4f-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493963, "uuid": "b03de74e-6244-43f9-89a3-da963bc4ebd1", "comment": "Malware payload (Mirai)", "value": "ca6a46998f64b7689253eaa8c91d4d20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493963, "uuid": "e8d8d717-a421-4aa1-b73b-80040004f6f4", "comment": "Malware payload (Mirai)", "value": "7eeed319f27219bada8ce954d8960ffd21661edfddf48c7d7b4d391cb6ae2ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493963, "uuid": "57769c14-b4e5-4484-90d9-3f20a058aaf8", "comment": "Malware payload (Mirai)", "value": "e0e18c02062a4b3394f8445684f118a0affd03d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493963, "uuid": "214e7aaa-d678-4588-9090-13d496b9c5ed", "comment": "Malware payload (Mirai)", "value": "1c945e720ddb01efd26a39773187d5187b1cb8b9a69832aad70612a560d915c893cf26fd08ebefcde0408d98c5d0ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493963, "uuid": "a51ecc4d-ab9c-4389-a65c-2e18e9881880", "value": "T154536BC4A743D4F8F95605795133B3336B32E53611A9CE8BC3A8BA32BC52911EE1B25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493963, "uuid": "9023100d-3ae0-44be-ba8b-db8ed13ae27a", "value": "1536:iJ1cbpvrvokOkeu9MPQNqOr6d2lBvCBI9PyTCavNuMFVtKSSBdU:iJy1vrv9euuKqOvqC9SCwkMMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493963, "uuid": "4cc7e21f-2a36-4c2f-ace6-ef6aae1c9947", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493963, "uuid": "02085e35-91e4-4c3e-9df6-ad8c8a40e9ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493963, "uuid": "ed5c239b-20b2-4c92-8df2-3103a7e8264e", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5849ade2-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493902, "uuid": "20b27c1c-cf28-4865-92fc-a5713af4d07d", "comment": "Malware payload (Mirai)", "value": "96305f619a608d2cbf7ef524c8317d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493902, "uuid": "1f38a03d-2187-46b7-8ed0-3e1d9d04a5a9", "comment": "Malware payload (Mirai)", "value": "7f164ae47318163569e128309c881dd7c7cf3eae8792c3519d42b2aa495e9023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493902, "uuid": "f2550527-7a32-4844-8a7c-5e9f6b855242", "comment": "Malware payload (Mirai)", "value": "d972b5879413c13cf8ad6cdd457d90174c27a56d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493902, "uuid": "a79181bd-8022-4294-8da0-404eb6f7ba7d", "comment": "Malware payload (Mirai)", "value": "2370e2e9182c2b54001d9c5ee3ca5f565bb401576918a91fdf7767a57780a68182062dc2d3a6810f8cf857c53a0e5021", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493902, "uuid": "adf6e168-7be4-4838-89cc-a28020e517ec", "value": "T156530259704CA245C4A0FA3DD2BE47D1AD0213F8A8AB50E32A7AC71485DFBCEA57D4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493902, "uuid": "3dd8cf97-ac26-409d-bd60-4c7424f04333", "value": "1536:TaBl+sPHSOEInj/5W8LnYn9/3LNtcv64rZ:Tasm/kEn6LLcv6UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493902, "uuid": "94011a54-79e0-43df-9548-ebe5c5501270", "value": 61860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493902, "uuid": "b9c6d7ba-cd02-4d28-82b1-9336dc0b543b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493902, "uuid": "ef0d0c4f-6ef2-4acb-b317-507e43ee17d4", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80166f33-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504277, "uuid": "b30bea7d-fe92-418a-afa6-2b616c055c01", "comment": "Malware payload (Mirai)", "value": "2f6e09576a4eb0a307bb84a86ed1d358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504277, "uuid": "c91afe39-f8df-4009-a2b8-48b57c41982d", "comment": "Malware payload (Mirai)", "value": "7f802e260878810574f322fc3332a8801726e71fc87527f62afb6a26f80d90fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504277, "uuid": "0c0385cd-a46a-4ca4-912e-f8732784aef6", "comment": "Malware payload (Mirai)", "value": "10214efd8e6a39ce5693ecfee34ed0f4fdc5ce80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504277, "uuid": "e6ce44f0-2605-45c9-9285-d72b9d243c48", "comment": "Malware payload (Mirai)", "value": "d59172747e4f222bf8ad9bb804f4caffe89f0d48d1137509c935e4cd547275d40805b2a23c2303144f91fabe2d00a69c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504277, "uuid": "5af7e4c4-9a71-420b-b1fb-59eebd848e58", "value": "T12C334B36F6721927C8C2587921FB4B15B6F443CA21E88A1B3DB10E9DBF609417943EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504277, "uuid": "33d85145-070b-4fea-bcf9-9ad34ee38f9c", "value": "768:mH5F6GFl8AL0nslvUvjCwGGO+75RKOK5uCPOz1tIqwO8IR:UF6GH5L0slcrVx75Mt5IRtITO8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504277, "uuid": "38ffd55f-1499-40c2-b7a5-99ac5beaaaf6", "value": 50600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504277, "uuid": "9a258bfa-a7ba-4a04-be9c-9d9ba98423fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504277, "uuid": "027cff16-71aa-4be4-a3d1-a2ed1116864f", "value": "wlan.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830d8f05-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495262, "uuid": "3fc54598-e229-4039-89dd-f130eb52ca45", "comment": "Malware payload (Mirai)", "value": "c472a84d76642a8353cbd8c6440af285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495262, "uuid": "c52ee200-b03d-4e37-bad4-2185fe835e5c", "comment": "Malware payload (Mirai)", "value": "7fca7a5acbfcd5494423ebd1a53ccb353210707739cb32e533b12ab3b292da18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495262, "uuid": "7579a06d-5368-4544-a3aa-b9374ec07e2e", "comment": "Malware payload (Mirai)", "value": "3160c0b3894e69e75e845725b1040d97d0d9ee7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495262, "uuid": "595ba353-17da-4aef-b849-489b597e35eb", "comment": "Malware payload (Mirai)", "value": "4af269e918209c95f94effc18b6760ae114d22b86d5f83bdccc07f92b314c6bf8013288a1e458a09c73d303fa5d7759f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495262, "uuid": "446c6d88-8504-4f9a-a5bb-08958fa87fdf", "value": "T199362997B9D24A42C4E43637BCBD81C433A74EB99B9B12666D04FE3C3ABE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495262, "uuid": "8e23cbc2-e578-4a98-a829-901eb86cf271", "value": "24576:GNFG37MnLl+DfsNO4EFI/tQxiHau+S8h6dgzAJolqk+5NOLkxwOJUGWxWEUEEr8g:HMzjo7wBBx8w0kcxrOCKB+qxTUbi5U3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495262, "uuid": "78fd93bc-d085-4129-a1d6-84a5933dd16c", "value": 5177496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495262, "uuid": "815ccc69-a60f-487a-bd6a-e016623d6209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495262, "uuid": "8ce29d5f-ba27-41b8-a965-76b650541b30", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd2a760-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494311, "uuid": "122040b2-789d-4ac2-812d-3377e4b64972", "comment": "Malware payload (Mirai)", "value": "1b479b19ef5be3d56be06f5a0f22f125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494311, "uuid": "aafe1812-7a9c-4e61-b8ef-89a100791858", "comment": "Malware payload (Mirai)", "value": "81f6d40527ef98bba374bd650f4f8bc229d4ddb545b44fc4baf31e99fa9b5d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494311, "uuid": "08f0cf33-acad-4d64-a624-38cfdfbd7d9f", "comment": "Malware payload (Mirai)", "value": "7ee308c61bb3ed69b06a26ae3676eaf5d01d4e67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494311, "uuid": "16c7f91f-f4f8-4bef-9ff1-dc09227eac8d", "comment": "Malware payload (Mirai)", "value": "734f9e0e51cb56be3b3afabefdda083430c7dc6231a52c02fcd5bdf4efa1ec351284c0da91cf8cb19da34d4afb07004c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494311, "uuid": "e92bfc3a-d4db-4978-9223-d26c7c980e44", "value": "T18703E03D090510F4E57EC17F92E947A0653607AA6942CE163260F6E7A70E8BC78A37EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494311, "uuid": "15f9774e-ea57-42fa-ba74-dba2836cad09", "value": "768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5cZqT9MKSJgGlzDpbuR1J/:q9xJZZNKNFjBfRUMSqT/WVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494311, "uuid": "3e5e2d74-bb03-405d-82fb-987571609e43", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494311, "uuid": "88f3a8cd-e8a4-4b4a-af08-ad27f3cbbf38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494311, "uuid": "f1a511cb-b985-4411-ab4a-fb9a8ae6e61d", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5569c63c-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493897, "uuid": "0d7abc93-c8c0-4612-9744-8d300be14222", "comment": "Malware payload (Mirai)", "value": "7f7295163e85fb7ec9cd99895c81c76b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493897, "uuid": "bced348e-603b-4a64-ae99-30104a7b092c", "comment": "Malware payload (Mirai)", "value": "828e6ff0017ca483fdb768593dad97122d7a500b15f12450c35ec3deb6587469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493897, "uuid": "98dd313d-4453-4856-91b9-b82b931f9975", "comment": "Malware payload (Mirai)", "value": "9605f9599b9c11564688cc7e107432921a8436e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493897, "uuid": "615bc684-9c82-4ead-98d2-264ec406fcf5", "comment": "Malware payload (Mirai)", "value": "ed8fca990351a387350f850a25c83259f23bfc82f24730f1163610b0620d5af6e22b358ce52cf8981e6c716e3cdbf73d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493897, "uuid": "75fffe2c-8ec3-4f05-847e-75611d8853a9", "value": "T176F2F1AE6A93ADF5D4F2863DD5318481419B2AECD2F674342650E5184A872E3F0FE3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493897, "uuid": "91f619f6-6c30-41ce-bc9f-fd89ef92e010", "value": "768:dE0anU+dRP2QDd4VC3STDgRuAcN/LalyL2io7yL7MYZEs3Uoze:dE0aUSR9DksmwlctOUxhze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493897, "uuid": "84ef38ba-a9c7-4a7c-a570-e8510ec9aa78", "value": 37472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493897, "uuid": "d4fe570d-8760-4ff4-a287-85c8e255f44f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493897, "uuid": "1f0eb247-b380-422b-a23d-90c50a1bc698", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e5b101-1fe4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773520366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520366, "uuid": "a0344f53-a34a-4916-9118-a6e852e49d4a", "comment": "Malware payload", "value": "e8b718d265aae790dfc6b8e0c3ac0209", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520366, "uuid": "dccdac54-19d5-4535-8271-59207cccb82e", "comment": "Malware payload", "value": "82aaa56441fcb4ca4495c0f2e03eb8fe44df801abeb0aa0d4341d176fbd799ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520366, "uuid": "0e84a0c0-c750-4722-ac20-27691dcaf414", "comment": "Malware payload", "value": "01efc33d189f9ff6e8e4dcc6eac41dc47baaebdb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773520366, "uuid": "3db1c1f7-7e83-41f5-b67d-aa164adc2cd2", "comment": "Malware payload", "value": "5e04c58d59c9c217509939a7a9f5b24300b625d3d25dada967b238d2f637006e38cf144de9012ed68806cf398d1a3a2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520366, "uuid": "e79904e4-6fe0-449d-b053-98d5bb4e93a7", "value": "T117925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520366, "uuid": "4332ea41-1dc3-4aa8-ae04-209cfb6243cb", "value": "384:fkFcuQpWx+BL0SWL0gizsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:fkF8i+BL0SI0xzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773520366, "uuid": "b8063035-a3d5-49d2-aad2-4843c6d98fc1", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773520366, "uuid": "e2b58d5e-167b-4b66-b74b-f4eabc77078f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773520366, "uuid": "0b83333b-5867-476a-997a-5e96fd807db8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489ab2aa-1f89-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773480991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480991, "uuid": "e672b164-12cd-453d-85e6-ea9f26e0067e", "comment": "Malware payload (XWorm)", "value": "dd189ef86ad4736b618f348fa43341c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480991, "uuid": "6bb09dc8-f418-4aa4-b734-eaa8d76f1241", "comment": "Malware payload (XWorm)", "value": "834fa1d96b7cf40739c4209a422a0698e1fae4c98b7072f0f7422c412a1a7cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480991, "uuid": "1f0f34f6-cc30-4702-b505-9deecd471a8c", "comment": "Malware payload (XWorm)", "value": "f95925ebd8372979eb95c7c7bcd295e04031afec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480991, "uuid": "03b6da3f-1991-4aee-959d-579b2c2ce3f7", "comment": "Malware payload (XWorm)", "value": "6fd7ec2248f8f3f5897bd9a4710b9674a563401e2f5de86a32038cdfd7025758fcdca1585e7a734cc80f51f35e25fe98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480991, "uuid": "747b654f-8f9d-4db2-9c4a-e196edf9694a", "value": "T1B664011F0171430ECAB43D3AE347472372978643E76656880EABF4676B223EAC69745F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480991, "uuid": "0c85c2eb-aa51-4e1d-9a9d-1ee87b55a9b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480991, "uuid": "71b7c50c-cd58-4635-993a-09ddd328eadd", "value": "6144:vN0iEOQ4bC+RO50f5h6Bvq53euLeXbkCWmiuSi9HoOLcUmuOQpf8vSwxmsvnU/x:vNL/TJPhh6B+OkeXbkOiuSi9IOLcbuOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773480991, "uuid": "a8b50acf-ed17-4332-a196-eea7a4fadcea", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773480991, "uuid": "61656915-3ce1-4166-9c1d-dccefba593dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480991, "uuid": "8e84108e-4015-4126-8552-9dcc5f8bc861", "value": "spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fb7ddd-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494388, "uuid": "85307aa5-29be-46b0-ad61-ff060bc3b24d", "comment": "Malware payload (Mirai)", "value": "d49b29c718cb4f54592ec2d4bca69854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494388, "uuid": "9179995b-dae5-4812-b458-ed5a3d5bfab5", "comment": "Malware payload (Mirai)", "value": "837de34a96661e33bc20ddbf8f844a296f91c9d16a74c7f4b6c734d217975b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494388, "uuid": "d046111b-a89f-4472-b801-4170f3da61cd", "comment": "Malware payload (Mirai)", "value": "6dde2e9cf8f503445d8ad3f81080969af2754511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494388, "uuid": "f0fec647-529a-4666-9a85-4b898304f43c", "comment": "Malware payload (Mirai)", "value": "8233ec9bb1029b8c489756c53c82c7956b19381af3954f4f83e714e5c2ace7828c8650148d3e2198dbb545ce2da8f227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494388, "uuid": "7fdd9b5a-9b7f-45f8-95c9-d437cb0e5810", "value": "T17F83285AF9814B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494388, "uuid": "a367a505-6ad3-49a9-9731-1a4b79d222f0", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYta:BVE+2dmTEZCSHYMactW4Bi9gnS4V0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494388, "uuid": "800df2a3-41a0-4073-b814-f1550b2b8691", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494388, "uuid": "6c31f139-b6f9-4745-b875-40843e2d1568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494388, "uuid": "ec396a12-9a77-4390-9563-2cd526c30109", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be20c5ff-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491496, "uuid": "6986883a-d89a-49b0-9c87-63299d20bb9d", "comment": "Malware payload (Mirai)", "value": "e96059067225acd8047c2e8fd56acbe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc64", "colour": "#C4B38D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491496, "uuid": "7f0a57ec-a8a1-4db9-8e91-5f28a227e845", "comment": "Malware payload (Mirai)", "value": "846a4d25d2e06b8ef721aa93e3d5ab0010721aff6159efd862b9dd4caad7fdd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc64", "colour": "#C4B38D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491496, "uuid": "5f74aa4f-8014-4677-8da1-193193d0d260", "comment": "Malware payload (Mirai)", "value": "f76cb7b882f0d715bfd195c47b362abb275455b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc64", "colour": "#C4B38D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491496, "uuid": "7931734b-9c60-40df-8201-c934b3130f89", "comment": "Malware payload (Mirai)", "value": "b9d7c0fd1e0a297b4d25032fbc9982f90a54021cb62ed062103c187afff72db608546f5c41098730081b42f0a4495a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "ppc64", "colour": "#C4B38D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491496, "uuid": "e60d9cef-6a9d-4843-be27-60b7553d9093", "value": "T12B3529273288B796EF895C3B859AFE10339A70D506518552BF40124FFB65B2F8F0BA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491496, "uuid": "9025819a-9187-4c65-bd56-420cd41b944a", "value": "12288:giJz7chF8QNhTborY4r9ABl94/J9LyHHVpiJSHSFEOM9iVgmVP1rUU5F8a4Jb:hdivoHGV9mE9jmBSam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491496, "uuid": "c3a4055e-50e9-4173-8e54-8a90c4dc216b", "value": 1125096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491496, "uuid": "68614e3f-cc39-49ff-997c-f2616178e481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491496, "uuid": "b7a861d4-2c8c-41d3-be42-b1ae9c42763f", "value": "bot.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68753346-1fdd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773517122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517122, "uuid": "09aaab66-04f2-461d-b638-f35caa9f1028", "comment": "Malware payload (Mirai)", "value": "84521eccc35d9f7927807625eb7c47fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517122, "uuid": "f0306e61-db86-49be-a901-62de848ca66b", "comment": "Malware payload (Mirai)", "value": "847d5f434315ba60695793f10e296fee855b2f214ad106cb58655dab2b2c064d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517122, "uuid": "621d47a1-b315-4e0c-8c51-989702793083", "comment": "Malware payload (Mirai)", "value": "b307f5bd792e5e08c26fd7114636f1b14a55e8a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517122, "uuid": "9fab30c8-35b1-43d6-94c4-44e0a0b90cb8", "comment": "Malware payload (Mirai)", "value": "c5155eabadb280024eed323aec818782d8b19ebf2a669d0108d67e3d8a067e6da6b0483ec2dcdee7708e62b732abe626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517122, "uuid": "cad80be0-1179-4a7e-b49b-545b477f553b", "value": "T17933F1E2C4F9CD72D66821BFA6ACB3550852921FBD44D2BF760C3921E0D4B60579E2A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517122, "uuid": "1ad77103-af73-48f3-a7d2-eaef749ff80b", "value": "1536:fYxPhIOFFp5yN8PlRI9X1QrSX+xGw8nouy8Z:CR5yN8Plq9SSX+gwcoutZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773517122, "uuid": "3fc78948-9dda-4682-ba12-052d6fc41a61", "value": 53468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773517122, "uuid": "d6165573-0d71-4324-9014-39bcdda85b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517122, "uuid": "2908496b-909d-48c3-8c0e-95d3a18d1e19", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a58d483-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773514897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514897, "uuid": "2368d368-5781-4dbd-9023-30723acd94ea", "comment": "Malware payload", "value": "a0ccae31812478c1a291c9d835c656b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514897, "uuid": "a1133b45-20a5-40e9-bbc2-5f81f16f699d", "comment": "Malware payload", "value": "8527afaa07f56296bfd2274f13d8080aace43d58d8834b9b4f1f9da2c24cb7fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514897, "uuid": "9d4e9ab5-b24b-4809-8af0-d00f1fe4f9fd", "comment": "Malware payload", "value": "bf56ed92b21053a0e438e7824de8f6d4136b23ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514897, "uuid": "e52b75d8-539e-41c8-be74-3b50f8c2796f", "comment": "Malware payload", "value": "f795f84b365226c093be17873812c90829bc570ea2ef998ca10d7e399f9785f2edb0a471c7cb39f9c7036734291d8864", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514897, "uuid": "fe243961-7a46-4440-a0d5-b23fe439b35a", "value": "T177536C8A4F06A8B979857DA2DE0E0C8054C5CB75C4EE518AEF7D64BAFCF4307E197920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514897, "uuid": "7511c429-77ba-4e8a-b3e9-5b6c257d1ccc", "value": "768:2ttWcpJtotqnQEH2nKWhvLwyLsldmQyyBFmNaoIs8IuqWtu5vcxS3IUFao9SpL2:wxRH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514897, "uuid": "d25c4707-ed05-4ecc-9883-5ed7422ace05", "value": 61610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514897, "uuid": "351af18d-c997-466f-85f9-5f49f037e805", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514897, "uuid": "cb806267-4de2-43cc-94a9-bcc32b6fd1d7", "value": "a0ccae31812478c1a291c9d835c656b3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419eb005-1f39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773446619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446619, "uuid": "d8d4112d-f71e-4b38-b791-dba0e27785ad", "comment": "Malware payload", "value": "065beb5d9498a0012bc7448a1bfb4ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446619, "uuid": "81897b1f-bf10-4a1f-b966-eec8339d48da", "comment": "Malware payload", "value": "852a3929543ef8cf58b4c345bc3ad1f1beeba8f5cb8ab5d77882a05cafae574a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446619, "uuid": "ba52b9f6-c67d-4cc6-91e3-496d0b78d7a6", "comment": "Malware payload", "value": "f2860b17dc4353ef6352dacb9849695b896e7287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446619, "uuid": "5c2ffa4f-357f-4562-b0a7-5c9858b29a23", "comment": "Malware payload", "value": "abd4d344662d164e50171a0f0ca4fbe44bc647141b22f9da29c467bfc5c5e40ae3f60bbe557d01b61aa9f31c5d0e8bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446619, "uuid": "d0802dfd-ed64-4182-91b6-1c37cf9a1611", "value": "T1C2F59E564FBF88EA9D0D77FC963F0D1B3C5C8088881846E796527CA68E14B3351276EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446619, "uuid": "9f3176da-19a0-4384-9c19-4fb5b9c8d5d5", "value": "db16efeda0f47a9af2f883ff6a85d9bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446619, "uuid": "8f8e0674-f9e8-4357-8887-0038e8cd278b", "value": "24576:CqhzJhBwIBeiIdKoTFVsFg/E5mWfyNZJPKL7Q5DGaekWt7b2Ftq007cHy+C:rfxIXVsQ+LaNKmUith5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773446619, "uuid": "1e2d9850-4637-4f35-a387-7384b4324e53", "value": 3333044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773446619, "uuid": "8bf5d0cc-4c2c-4b11-9007-958b77673189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446619, "uuid": "f40da732-5d3d-41b9-a88f-e8ec50c25cd7", "value": "download1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e677d5-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494319, "uuid": "c8e43ddc-4c1e-43b0-86f7-e91a60a19f32", "comment": "Malware payload (Mirai)", "value": "92105077129c953b819d933bcaf07c23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494319, "uuid": "457b4f38-f407-42ca-a968-1ddd674f3d93", "comment": "Malware payload (Mirai)", "value": "854aca28acf15fc6c0962b71c459e0620bd5e55a5350cb54ad2e349257911a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494319, "uuid": "72523cab-4dd9-435c-a8db-5e043d509d23", "comment": "Malware payload (Mirai)", "value": "aad3cee6a55971ccc3b44e19cee5323821827492", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494319, "uuid": "8ce4827e-7de1-410d-9069-9f9942b935d3", "comment": "Malware payload (Mirai)", "value": "2a11c24b124cb17e9eb70c08f71ebbd827eeea8162e6fc451c52151f4793df5405cc2be18f74325005ec7021949709e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494319, "uuid": "cc3b4a55-14dc-4f59-b43d-d3cfee1f699c", "value": "T1EDF2E18714B94108D56F20790C63FD8D88A09659C2BDC9F28F98B517DA17EEC3D583AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494319, "uuid": "b136a5d3-7c5f-4bc7-8c25-3a7ee1a496f4", "value": "768:vCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIpqno/3snbcuyD7UHQRjT:vBGbyqhXrTBrQX4oECo/8nouy8Hy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494319, "uuid": "381041c4-db92-456d-ba89-0c6393d475b6", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494319, "uuid": "91ec35a9-8e48-45bd-984b-74c20f4de0b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494319, "uuid": "b24e0f11-fcc4-49fe-9126-952e4f55c170", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10ad375-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491501, "uuid": "4e4ca3a8-dce0-468f-a96a-709998c504e3", "comment": "Malware payload (Mirai)", "value": "2ace647aa8b3abfca6d2c64025a99a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491501, "uuid": "7b5a038a-fd15-41aa-a29c-97ef7619e70c", "comment": "Malware payload (Mirai)", "value": "858c44f35571449bac5796bc3d95c5466cb51ac61bb18a8401acf5b2d59f7825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491501, "uuid": "e24fd668-d822-4eab-a2fd-af168e6a6c4c", "comment": "Malware payload (Mirai)", "value": "48ea733814b51874e169869e189003eb4cb73232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491501, "uuid": "f7e2ea51-7fa0-4e2b-bbe6-d69d463e45c2", "comment": "Malware payload (Mirai)", "value": "397246b36bd31782e48f5b7bec1db2d6df42aaf14211f2f75c1efcfd930ec3ff67f336db960d15bf8f85b7d86be0042e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh4", "colour": "#7BD36F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491501, "uuid": "32e632c8-f14f-429d-b348-ece33ecdb1d4", "value": "T1ACC4BF53F2619EC7D1268AB40039E330874BE9A217337280F63AD3652D736A6FE5C765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491501, "uuid": "8ce974ed-7c0a-483b-81cb-9f3005bf26f0", "value": "12288:2JygghGx25sK6JMarpiPkLR/k7MUXJX+z8pnYpmRj:2Ju96OL8LRWJudp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491501, "uuid": "1e346134-da81-46bd-874a-45440414ce8d", "value": 575920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491501, "uuid": "643ec7dd-47d4-48ab-b940-39cef736b52d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491501, "uuid": "ae1025e6-b85d-4c9e-a68c-755070fd23f4", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefb97a1-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516059, "uuid": "211eaff0-9b66-4718-b4c5-9d4d5fca95e1", "comment": "Malware payload", "value": "26c5e19ae970ffab3d46610b7deb202e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516059, "uuid": "7afc1794-2ce2-4e9a-ae7d-133584e0f826", "comment": "Malware payload", "value": "861cd0a2cf1381db7a8c559169dd9dbc2a7186dae24b272b6f771d01ad89c1d6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516059, "uuid": "0f999725-669a-47ae-8652-c07d3d1f1849", "comment": "Malware payload", "value": "9779948b0ee4c5028b81915e5bcc2592d77c878d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516059, "uuid": "fb4581e2-ea13-4aeb-96bb-16e64a6429e1", "comment": "Malware payload", "value": "655abfa1d752163c1d3703d4899105865adf910943118cf3e76cbcc9f8085791d1599da6990e9df922e4008d2d3e20d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516059, "uuid": "e86bb5a9-ad3b-4657-b70c-a52759328ad8", "value": "T15AD2614A3EC6F1A703426473191BF48FE5BEFDC2754CC0A5C6694C68F860368E5B6DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516059, "uuid": "84874f50-20ba-4d05-acc5-7aae091d8608", "value": "384:8bX1HNer7A9tCihsar+FYjZe4yZQ9V3ly3DrqXZ3L0DTdqeypQVo96ZfLexRz80F:vCNgY3wD7ypQV6If6AniJAFXUhky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516059, "uuid": "78e4841b-69dc-48fd-9554-076032cba2f1", "value": 28376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516059, "uuid": "495b3475-409e-4211-aab6-95f929ee93fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516059, "uuid": "d5161993-f065-4493-b675-976a8d2a6f13", "value": "26c5e19ae970ffab3d46610b7deb202e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7c5fac-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486475, "uuid": "7ef31e4e-6235-4d26-b3eb-1041df29756f", "comment": "Malware payload", "value": "799030cab147369f4a3e3809af7a26a1", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486475, "uuid": "c9ad337e-9b92-42c6-a173-006dacff990e", "comment": "Malware payload", "value": "86866dfbe2ed006531a358853e23e26c9205b250d13526faa50aaa7a9b2d2e09", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486475, "uuid": "2093dd6c-032a-4e5d-98be-e367d1a3add2", "comment": "Malware payload", "value": "325ad225936d278b136df3c5ba79a8bb06427520", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486475, "uuid": "9895ab9d-331b-49a9-945a-bbd56d4c6080", "comment": "Malware payload", "value": "53bc891deac302cf524bb3a725473ad27c26ddd31755735f1d974960136c57c4f65af2f30249e5f43235e3242aedd276", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486475, "uuid": "0a5ac86d-aff8-4906-bbec-8e246014424b", "value": "T1D1E0A375D930F8C0433DB11084353D1910909E53F7799FD8E2210CA66D18554DF0966C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486475, "uuid": "afb9071a-b99d-46ef-8a97-05c8cb85a203", "value": "6:s8bloOVsukO6hxegdYMkqCcackk5t0h++XPHZkTkM7hTalYWs6qa+sXkSqZTn:s8hZGrO6hxegCcPtP0RihqYvLAk1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486475, "uuid": "f0de3a7d-99ca-42cc-91ef-16e4f20097f2", "value": 417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486475, "uuid": "9aa2dbf6-5c99-47e3-93ad-91985b5f1869", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486475, "uuid": "0d6cf0e6-5120-4e51-ab53-cedd7cb8ad3d", "value": "13ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2867a9f-1fba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773502241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502241, "uuid": "591f28f7-bff1-45ac-86eb-0faa8d6dd187", "comment": "Malware payload", "value": "08f245cc4ab30ed310ea1e281e344492", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502241, "uuid": "c0fd7a88-8b81-4270-a38b-e5d90bc149cd", "comment": "Malware payload", "value": "86aecdda9b78671cf19c3498a838c1c20572b1cc75579056e4ec4342a0805d2b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502241, "uuid": "fb38f9f4-02d0-4aeb-860b-5856dc17d089", "comment": "Malware payload", "value": "fec8447175f008dcb45474391f55e29cf57f897e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502241, "uuid": "339097d9-13a7-4689-936c-1852ea814e3b", "comment": "Malware payload", "value": "b6673d55e292b09a4838475cd0fd4c9cd9103f70410acb39aaee6ae3208edebd2297b8431aa9c51c336fc80d8f247220", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502241, "uuid": "dc747ac5-657b-485d-a7ee-4c2ada1da6db", "value": "T1E0925DB512896C75FBD1CE399F3C6F4DADE8C2C42124A3ACBA4F39205A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502241, "uuid": "2b48c302-4955-498a-a19f-ce54aaa25d67", "value": "384:TScuQpWx+BL0SWL0gnzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:TS8i+BL0SI0czsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502241, "uuid": "e6b89ce8-e678-4721-9ec7-786acbca99c9", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502241, "uuid": "2fa244da-1a00-4a8a-834b-2cc4a0db2125", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502241, "uuid": "8a82a126-b05c-4ebb-80a0-eac932b90530", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028a69d7-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773504925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504925, "uuid": "fc49f5c5-2448-4e81-8e73-da05381870c2", "comment": "Malware payload", "value": "2091b12661864523cadbe360a8b37f96", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504925, "uuid": "8e4de95b-3294-41f7-8183-79aa1a5d5a3f", "comment": "Malware payload", "value": "86fbce191248bcc124b1259a178d84216d713f4acd516f578c5f3fdccb01fa4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504925, "uuid": "bfd42ce1-54d0-4832-bfd1-05d9037d5cd8", "comment": "Malware payload", "value": "f9cc9e794cb8dcb075e01269f170b30cb62e908e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504925, "uuid": "f14a1100-18b4-4611-9789-70ac779aefc0", "comment": "Malware payload", "value": "207bfe978952bf73fbe54dcd931df4be39130f1cba1e1b2cc45f396b8c80c948a67ebcad74a832cfc7df1e8faeef9057", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504925, "uuid": "3c7a042f-6f1d-472c-a1cd-1effda5968da", "value": "T1F6A633E0F5C4AFC2E121C97143F480B5EEDE28A170D3DD62B8121B5D65926F7B6AF488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504925, "uuid": "4d90f473-799b-494d-a738-c626a7b73f46", "value": "196608:wsIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9O85+uWL63x+mb2ZYYLfPZ8WIr:JhOnn7FUNyhGprLz0gBL63Mmb21Th8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504925, "uuid": "701b46c5-fa94-4566-beeb-a46176abefc7", "value": 9551565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504925, "uuid": "27aa7cf7-53f5-4539-a0bd-c677eb9372ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504925, "uuid": "8d4b2880-086c-45b6-9991-aa5a88f6db4c", "value": "vk_swiftshader_icd.dat.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c367a79-1fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773504673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504673, "uuid": "194d88e9-f4a9-48fb-a385-12b53c2ccd27", "comment": "Malware payload", "value": "7f58df1921d3aa9439d68a1ed7ef157f", "object_relation": "md5", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504673, "uuid": "ec6a75ef-48ee-4306-b71f-6ffd7dfe1a5e", "comment": "Malware payload", "value": "877724c87d685b5ed6d0931222250fccad860c07b6262d038eeca94b603c42ca", "object_relation": "sha256", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504673, "uuid": "601afb76-0a0d-476a-af01-a1dbfbae8b9b", "comment": "Malware payload", "value": "13c3065e2364d6b59467e9d4aeddd2b95a3522d4", "object_relation": "sha1", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504673, "uuid": "2f5ed29a-ed93-4efc-9f93-720758cb8261", "comment": "Malware payload", "value": "012e31041aa316485b174ef52592190243aeb196d4ce95ceef9e8cd1cda7b3bd872c270c84183fe824e4edc66967d115", "object_relation": "sha3-384", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504673, "uuid": "8f2db904-b8fb-4733-810b-1511fd126648", "value": "T1357633F41A971439ED827CB06BD164A80B7368225D32D8E9127DF2827ED97CA351FDE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504673, "uuid": "4615f094-8265-4daa-8342-d146deb556c4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504673, "uuid": "a4a80d76-9411-4052-8b5d-9be61d35a90d", "value": "98304:MIIQNRpqyQEcOKhUnhgufH/Y3IQWDT3IxKDVUxuRHEFgLtfMHacD6Y6nsZe:9RN2y/1nyDHmTeeUak7HHv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504673, "uuid": "073f2efd-4193-48e8-9bb5-57b48a97c92c", "value": 7479763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504673, "uuid": "404d0706-bf8e-422d-9b62-735aaea03497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504673, "uuid": "65d90d8f-093b-4af3-a01a-fda29eee0218", "value": "nitama-external_LrhQc7yypg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f09e93-1fb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773500555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500555, "uuid": "cf5232e8-f0fb-4e64-aff8-ee276a75d788", "comment": "Malware payload (Mirai)", "value": "afbdc5d9d10c3a3b984b7669cbb8084d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500555, "uuid": "dd6167f0-e0a7-446b-b3f8-ef4e8279474a", "comment": "Malware payload (Mirai)", "value": "88384364942335f7451484313565eb69edbcebe9b5fbe6c1da0bfc4afdefa0db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500555, "uuid": "1b2b91ce-229b-4e2f-acf4-9e57fecba5a6", "comment": "Malware payload (Mirai)", "value": "424a7736a1a89d2e53f9dbba0a597a762e1bbac1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500555, "uuid": "cee1f48a-304e-464b-a52a-c359f3f794ce", "comment": "Malware payload (Mirai)", "value": "f0d5c0e9a50b721f64da8047471e6b705af8cbe2f335deb582346ed19f478e79319dc5c4665a7ffaf4a956f27e9c4aff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500555, "uuid": "26016f69-f602-4eeb-ad47-82d8fc004979", "value": "T11911B9E8B59351A6CF455E089C1110C55004B0CCEB370EFCDC8B9279C5EEF886631DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500555, "uuid": "b2815d71-4091-47cb-9fe0-62805141dc7b", "value": "12:ywQwJlPu8Yh3UlL39NIl56vCa0LKKuNgOFe2JM2UO7tjnpSOZw4Ntl82Df2G9LMo:EwPb/lxNI7DKqI/X5plnNteeO0of8jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773500555, "uuid": "a245ee27-1a3e-467d-b7f0-9fa8aeebfdf4", "value": 930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773500555, "uuid": "21b63b2b-4e15-44cb-ab7b-54a4e6c5e699", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500555, "uuid": "81e31f69-d0ea-4de7-aa1f-7e0e17a345f0", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007ed49d-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477434, "uuid": "a2c1d9c8-0d91-43ef-866e-9641c287292d", "comment": "Malware payload", "value": "cae86d1e3a089f869ea041b9bd18ea43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477434, "uuid": "42978afe-17a4-4271-afb1-3280db49df08", "comment": "Malware payload", "value": "887b850633811e0d2d8dcb2ac40495068916ca63bd6d2a5bb90e4642ba0c05e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477434, "uuid": "a54ee555-1a0b-4a0e-8afc-32540660ca8c", "comment": "Malware payload", "value": "8ae87ef8049d3f5f88cc36f7b137214af875a060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477434, "uuid": "e6a277f1-6a9f-4516-b29c-b8068610686e", "comment": "Malware payload", "value": "c05ad55a960000d1e1673122afcce46010428b8f23f0890e2db783474ce3886d5e2ac8e3c482bd9962a2496d8d3b05b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477434, "uuid": "cd8b39eb-f651-4c37-9c0f-67ddb7c0c57c", "value": "T1314619527F94EE1BE29421358AF6C23433D53E0582E421339612F71D2EBB2B49D5BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477434, "uuid": "a3e6418d-3848-432c-9d8b-289fc0bb1297", "value": "49152:Pfk83jR7cfBf/xpkV3+xqaSmXqzrm36ivHH:PfkbE9Vzrm36ivn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477434, "uuid": "2ea09e5f-1e49-4a56-a7d1-94154ceb9aee", "value": 5832704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477434, "uuid": "ef50d209-f10a-4372-b4a6-fd0e407913d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477434, "uuid": "bd346eaf-7171-4078-920a-9797cdd0a824", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529ab925-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493893, "uuid": "c69483c6-d30d-498f-b26f-eff6c6bee503", "comment": "Malware payload (Mirai)", "value": "e5a725ccdb1def830e8428894ef4d91b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493893, "uuid": "eb560554-0595-490e-8279-81e12a15b684", "comment": "Malware payload (Mirai)", "value": "8a95c7f1b75409c5a19322ead860d84d76b2d494d1c13e5353fb1d298b00c6e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493893, "uuid": "65a8d38b-df4e-4c59-811b-a48594404463", "comment": "Malware payload (Mirai)", "value": "043780df2d6ca813ca6d3b3d3ad260f9dea49b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493893, "uuid": "0f3cba1d-c877-4841-ac26-5bcf09ec27b6", "comment": "Malware payload (Mirai)", "value": "230dbff50cc728f3d9679544b29111dbf01d86ca4a5cf1e7b1b3121404840220646b311b0dae5e94eba60b594221ee21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493893, "uuid": "bbb51cdf-2964-47f7-a74f-e3e99ff2dc25", "value": "T13F03E15AFA94B4ABDB9E2EB6757D23B21E1410D4358563D683320CCDCB68D13B74A82C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493893, "uuid": "9286c408-36b3-4153-9667-d80bc81f8f71", "value": "768:eYbMN2q8qb06Ds/jWzCVO4CYPiOCnIBqBJ8bTtI16QNymVA5aV+xy5Wz:eYgzPb0yzsO4CYCnI4BsqUQJVF+xyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493893, "uuid": "33fe4ed1-2ca9-45b9-b94b-c3b2841e8374", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493893, "uuid": "4ba95176-9b8b-4b98-84b7-39b3be32a3b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493893, "uuid": "b6838d79-e720-494a-8736-1179aea2471b", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc677f3-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773505184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505184, "uuid": "edd456a8-793b-4859-9a9f-bef9cb02df42", "comment": "Malware payload (Vidar)", "value": "cc1aa4edd380ac268d5439c29493b6c0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505184, "uuid": "2d638dc6-a6cd-42a3-a6f2-d43778125a48", "comment": "Malware payload (Vidar)", "value": "8abef663b8d957cb09791b37bfc740a6c9783d8abd5a2a1b11a30c079bbdec67", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505184, "uuid": "e0ba879c-cf2a-49c8-8c23-923e2cf64c75", "comment": "Malware payload (Vidar)", "value": "18c9369cb9792d97ba5620960681dfce9d5ac09a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505184, "uuid": "01332694-1842-49f8-8385-c65db6c60886", "comment": "Malware payload (Vidar)", "value": "3829f2ac1d57245687507e89f051ea2bf8fb39794799099f4c5265e1ca26e4ac39c5c3be96c7d97ea9c8905848945e19", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505184, "uuid": "71804c29-3c12-43cf-92f2-0ecaf709a161", "value": "T153B56C0BBC9819EAC06E877198B746967B30FC590B3223D31A90BA787F727E45D79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505184, "uuid": "60219613-d4d0-4f25-a057-72d89273b415", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505184, "uuid": "890cc7a4-ebae-4b2e-aa7e-45ec4a372eb8", "value": "49152:jtbTmUurtlw6b9caz5dUrrl3D+/sPDFU3:jte7LS24JDd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505184, "uuid": "e995d581-abda-4d03-a576-82fbb52a203b", "value": 2429952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505184, "uuid": "3908bdd0-4e63-43df-a503-ee6cdb7f6ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505184, "uuid": "2b40ac6a-4369-4358-8dc0-1263addabc1b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ebd772-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494324, "uuid": "47cfd1b6-fce0-44e6-aaf5-d7ffb1bc0a6b", "comment": "Malware payload (Mirai)", "value": "47208f74f76fab15f6a3fe8cc216af48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494324, "uuid": "1f5745d7-cfb3-4828-9f8b-a5327f0d76d6", "comment": "Malware payload (Mirai)", "value": "8b01729da819be4de7ce725849194e56ae2154a4db0a60de91911c1ebe3bf2e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494324, "uuid": "3c64be34-f9b3-4c27-b818-7ae9a906a73e", "comment": "Malware payload (Mirai)", "value": "044ed2e2218d1c77d1295c83cc522eb2d088d84d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494324, "uuid": "2a554a5a-dc8d-4ec3-8eba-8919b11dc942", "comment": "Malware payload (Mirai)", "value": "7653f3665f299565c824fc50aa08e10f0512a4a50176f836f33eefe2e11afa6ac60b90e564085ad8f8175b0155e24626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494324, "uuid": "eda9b50a-e1cc-45ae-8a5f-fd225e5bd3b0", "value": "T10692C0700137BCF2C7622832A63F8502895553FEC6F9327B235454A4DB9564F2EB558E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494324, "uuid": "fb8ca46a-2ad7-4f95-a3e5-7c1ea2ab30eb", "value": "384:k93CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8E8gFVX4J093hymdG+:QCyEPgoKRwZGx04nIns0t2nF6E3s3Uog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494324, "uuid": "5b2f26e9-5568-4940-9d5d-709ceeeaf14c", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494324, "uuid": "4c331af1-a3ef-43b1-8707-b918afb9c192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494324, "uuid": "dc14d022-0ac5-4c0c-9ae4-4e3dcf174309", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9065e25-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491514, "uuid": "20e8378a-3604-4494-829a-61b8989e5d96", "comment": "Malware payload (Mirai)", "value": "97894e98df6fbab5a84feb37ff657690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491514, "uuid": "5dcf2d4c-2bb2-4a12-8dba-c02a0714bfb1", "comment": "Malware payload (Mirai)", "value": "8b67c837c2fa9f59d6442e85546fe9e962f3ab48bd703da40797410410371d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491514, "uuid": "ee1dabc5-5859-4ad8-a57d-07720c7a5a46", "comment": "Malware payload (Mirai)", "value": "6ed72163a873c59fa12a46a60f38c371346fe0d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491514, "uuid": "e7249e66-998b-4f95-bf9f-9a9232ab6313", "comment": "Malware payload (Mirai)", "value": "e31e27777d61919b09ae3adbaa8eb149abb9e7c4c1bb036ba6a97a204ee2bbeed575cace48094ef8f9b3290a34b682d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491514, "uuid": "57dcfeb9-6dee-4e7c-83fb-dc80d7ee631b", "value": "T1A9257C5AF2B370FCD027D03043ABDB62A839F47901216D7B65C4DA352D66DA01B29FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491514, "uuid": "6a1c5ad9-d18c-42fd-a031-9de9a794e224", "value": "12288:0Js9eECyGoIYJjh/YWsmMFCpW5GwW36my3SFkTCk5k:0Js9bXGoVjh/YWsm5pWANDFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491514, "uuid": "42acb8c1-7e01-46fc-a028-9608998f9db4", "value": 1037376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491514, "uuid": "7c2381d5-0fad-48a4-97dd-2e7568b16efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491514, "uuid": "a66e58ca-8ee5-4099-83f7-70903e5dbb17", "value": "bot_opt.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b989964-1f82-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773477989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477989, "uuid": "15af1de5-0ab8-4b81-9d64-77ae47ed6d77", "comment": "Malware payload (Mirai)", "value": "945e697ff8c1c213659b5b8afb996cc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477989, "uuid": "83962b5e-5d32-4854-9d36-93113ac3c7f6", "comment": "Malware payload (Mirai)", "value": "8bc3503b8329a35d63ef7a8c78b59e4e132e35e5c44b2b87498c97cb276a34fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477989, "uuid": "4484c865-9717-4136-b99a-cb725694b40d", "comment": "Malware payload (Mirai)", "value": "23d000a95a6aaa716a9a21be511260a17cc46e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477989, "uuid": "fee9a9dd-c86f-4209-b04b-21f8b5d7a295", "comment": "Malware payload (Mirai)", "value": "78a491500e3f4e93d4dac2bd1f09bb8d96bda14fcad997f348c4e6644e7a9ae9c750e18d402aeb823b92001f27bb54ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477989, "uuid": "578382d9-c609-4a20-81cc-4490a5fcbcd4", "value": "T161D2A24E2D22DFECF62C85368E778E20A7A523C623E1D640D79DD9005FA120E556FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477989, "uuid": "c5d48773-31e7-4909-adfd-5499ec96893f", "value": "384:3jHicbPjGJb1Lu4vadDZQLyqWcMgr6RTd8LGHjE9a8ORmWCm2DPxDcWfN2ATsiu6:OQbYbMfVeyq1MuGDYVQeGWDTVu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477989, "uuid": "6561140b-cd48-431e-8fba-3057fae6489f", "value": 28856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477989, "uuid": "6132a896-14ef-40ab-85bb-e3274a58b8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477989, "uuid": "08b12b44-ee5e-4bac-98bd-deb8f6a56e53", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f2107e-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491484, "uuid": "0dfd87cf-4854-4780-b0b7-36b40b097529", "comment": "Malware payload (Mirai)", "value": "f52c0f02d3135561c7ca68edc5126754", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491484, "uuid": "4ef5c49b-7e7d-4287-8330-76960c1b5385", "comment": "Malware payload (Mirai)", "value": "8bd9d0d3399e8ea98da550f6d293d82deed61b0792a594cb7304dd16ffc21301", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491484, "uuid": "ebc1d834-95f5-42b3-adfc-ab4a8ebccc01", "comment": "Malware payload (Mirai)", "value": "feb57f2bfc8959de4c576e6bcfc78a15ab17581f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491484, "uuid": "db6dfbf0-4302-4e0f-8f09-9ef58380da9a", "comment": "Malware payload (Mirai)", "value": "00e7aa98ff277e96010b4fd0e56e9072b4f0e55de418f38c8d4db9a4d4aa99ae9442334c36b9e4ba34e1ee899a6e5d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#3C3F0E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491484, "uuid": "6b586b2c-56ec-460c-bb1b-c6b2832afe21", "value": "T171C4D08677851E37F0B3593E44E24B12B638FBD0518367273028B669A9376BC2F71687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491484, "uuid": "73ccbe90-e5d3-499a-9375-37c1be1996b6", "value": "12288:cYq2XE9KM/E0v6ZvX9I9eHBEvOElZ+M6mgSgTewMNqOkLhVnkcW2w:cpWuE0v6ZvXevoTAklVkcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491484, "uuid": "2dfc2a53-7d6b-497d-988b-e8b94f4a61bd", "value": 568700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491484, "uuid": "f601153b-c984-4356-8e91-dbe36e29c09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491484, "uuid": "cbd9b156-8534-487a-8293-77aa34ae2965", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc7e564-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773505239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505239, "uuid": "a66a608e-7b89-4139-b854-51a03881d470", "comment": "Malware payload", "value": "ccf389044364d2f298dfaca04145c1b6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505239, "uuid": "6a211a11-8b1c-4126-9c49-eb7b92ad3319", "comment": "Malware payload", "value": "8bfd4756dbca39fe415afd3cd8e71fee46af9deec82c479862eef487e6027a54", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505239, "uuid": "cd2e4f9c-d33a-469f-bfad-a999e080cbb5", "comment": "Malware payload", "value": "f56af42f5ccbd78ab34408321445cbe9c89bd934", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505239, "uuid": "5141dcfa-bc43-475c-a669-6182583090f6", "comment": "Malware payload", "value": "7b9da6f82adbd1188b622c43435270e93a9a792d0c18a43b367f1d795f94c89bf58a36c38fd0b3a8b2aeeb8f96740a3a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505239, "uuid": "91b762a2-1e33-4da8-9c8d-d0a2f2aebbfb", "value": "T18B64228CE7C60EA04BC4E7B5898E466F78880C5A4082211673AC75585FFDB7BE793C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505239, "uuid": "7021cb42-0afb-4172-a5e9-65e4c31cf40e", "value": "6144:JYCNXI0gsI8V8FkeogsC4VMcptwf7qZ9/o5F5eDo9E:JYCNXJfI8VXH8IMcptwfxfcDo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505239, "uuid": "d779c331-ae67-4a9f-929c-8b98dc243abd", "value": 321149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505239, "uuid": "3983dc2e-cfbe-49c4-bc87-c87adc5979fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505239, "uuid": "daf686e0-e776-46b5-be9c-35ac1986f15f", "value": "8bfd4756dbca39fe415afd3cd8e71fee46af9deec82c479862eef487e6027a54.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28471bb-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507341, "uuid": "ebe89ba9-96d9-4915-9c21-4c49fc16e454", "comment": "Malware payload", "value": "f3c35193c4ca7fb7969b5224d2b7bd40", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507341, "uuid": "f08d05ca-e8b9-4659-b36f-d32388ef90b7", "comment": "Malware payload", "value": "8c39835f8e2b6915b7cefbac09a10e8d6414e08de09dbb7ffc51d28eaf8a68f2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507341, "uuid": "8efbbea6-1ea3-46a1-b2e8-dd40c7a63ed8", "comment": "Malware payload", "value": "244689ec4c5e07f460d099a8521a19210b554c3c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507341, "uuid": "a6444c77-068a-433f-806b-5e392b69327b", "comment": "Malware payload", "value": "00ddfa5c07edd37dae1c15eea3ae72398d826275501e954e4bc7670c9e9f4fe922150b329a2427183b2b01ddc618d1e2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507341, "uuid": "a7c09fbc-5965-4ad2-8a44-ae3b2079229e", "value": "T16E6423609E12BEEC0FC9576C407A661A226995A698C88471B3FDD093731FE04DBFF835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507341, "uuid": "38edba29-ce13-4c36-8008-5a7dce390846", "value": "6144:Wdzcj+9sdV15vX3dottp4nvFxPD5ihpD/Y6ergGskOH2lu1g:WlAhdrNdottAlDchpzY6jPkj+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507341, "uuid": "f417c3af-3c9f-42ed-a74d-1874bfdc6a2d", "value": 321239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507341, "uuid": "57e382a6-f10e-4c0a-9d83-ee6a549fb2b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507341, "uuid": "5d6e6bda-eb01-401d-bf9e-0226f58d09e6", "value": "8c39835f8e2b6915b7cefbac09a10e8d6414e08de09dbb7ffc51d28eaf8a68f2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa309fee-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773516078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516078, "uuid": "515f8908-cee0-4375-a092-57dc002c58f6", "comment": "Malware payload (RemcosRAT)", "value": "5b4f64dbc445c60e16b444f0cc922b8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516078, "uuid": "c76d446a-2bf3-42b0-9249-9118919d3167", "comment": "Malware payload (RemcosRAT)", "value": "8dcfc3264df4cb34f29f992dbcddb80813f6ca934fc817bab741554c5a347ad7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516078, "uuid": "464432a2-afd5-40b0-9d30-afeaa89dd109", "comment": "Malware payload (RemcosRAT)", "value": "0bb7006c48a7196494cd15d30f558479f15139da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516078, "uuid": "98e7fe6f-5717-4cd4-bd7d-e5bd5109fe24", "comment": "Malware payload (RemcosRAT)", "value": "326c50ab158e7e3a0503e2ed1b73267aa8dab899b09b58232775fadd705df10111bdb5757e8084784f88483e77fdb2f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516078, "uuid": "2fdc7176-13c7-4f9b-89c2-db1e176c6c17", "value": "T167E5C06649462B82476D3EE14051766FEB72A4EA9177624E7763F8CDC8FF6C06022C0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516078, "uuid": "4aa20c9e-7f8c-4207-8318-ad5e357c78df", "value": "49152:SJvDNmkhvKENXwFEYhN1BiSFetQx/sWaNVoTfMEc+U7Y9:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516078, "uuid": "032b54f2-58f4-44f3-bbf6-a7c2ea38d8db", "value": 3284782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516078, "uuid": "f10d8e5e-246b-4d74-bbab-72d11d8306d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516078, "uuid": "84a2cf23-cf86-4fd1-af02-87436c538c31", "value": "5b4f64dbc445c60e16b444f0cc922b8e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959f59f4-1fc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773508178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508178, "uuid": "980a0c49-dd4d-4443-a013-0504ea93698c", "comment": "Malware payload", "value": "60ae2d200fc860c2007078926a1788ba", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508178, "uuid": "4df1be0b-0f6d-4df4-8725-cca40c800ddc", "comment": "Malware payload", "value": "8e11bf7f1943aaf8bf4a674bc20a14720c95878e8912342bc923d40ee3082991", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508178, "uuid": "d8834abb-fa56-4a5f-8b8c-25e6f43a97c6", "comment": "Malware payload", "value": "8662f5d31d8dcc77d14499fb895f8792113ae8de", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508178, "uuid": "7c3170c0-9054-4d71-a4f4-1bc353ac78f8", "comment": "Malware payload", "value": "c93b4807fcca719b83b95c7eed1208695059f26090e79c581abafb226e8baff6110feb40d4c235cd19a8b91804f8ea75", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508178, "uuid": "5e5e6be1-96d5-4627-b179-6656511cb5c7", "value": "T15A641204D025513E4FAC642FE4FE373A6E9357A3C448658EF3DC96C72F32EA96196160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508178, "uuid": "2197503b-2e3b-4b5c-b900-d7126af5e7a8", "value": "6144:FivDDcyzas/PJwNabQjjyoa23BiOIm4fOl7FqpaFEjUTUFAAgo:Fi/cyGcJ8abc+i3PIm4flKDTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508178, "uuid": "13dc013e-5c87-40a0-9aea-c58a7dcfb0d8", "value": 321126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508178, "uuid": "7c9c1ddc-7f3d-4c46-8794-f4f375a77409", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508178, "uuid": "7c39e5ca-c8e6-4a1d-be97-f97016b94a79", "value": "8e11bf7f1943aaf8bf4a674bc20a14720c95878e8912342bc923d40ee3082991.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd8abc1-1fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773506766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506766, "uuid": "f7010710-8948-46c8-804b-28177b2a9f59", "comment": "Malware payload (RemcosRAT)", "value": "a3e71e6a68fa16583f75ab42bddcd598", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506766, "uuid": "b59f1b42-cbd1-42c9-bb99-4f736c0bd2aa", "comment": "Malware payload (RemcosRAT)", "value": "8e4630490803b2a94b44ccc85605eee1120274b7dc206d1b164d1a44484ce094", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506766, "uuid": "ae6595fa-3112-4ce2-82ac-b65c29f647f9", "comment": "Malware payload (RemcosRAT)", "value": "e4188bd8f74a7697fb384a8b27e8e6d424e22089", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506766, "uuid": "d48422a6-9a48-4893-9a47-66cd921e4d11", "comment": "Malware payload (RemcosRAT)", "value": "44adb67e709db10debe8fc445e3c0498979baaea1d24c580ea9c25c2263edd6fee78fac001f012991d669c9757833b05", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506766, "uuid": "7182372c-f10d-4315-8860-55059070d9f7", "value": "T1BDA402207116A16FC13D2E3021D84A9A5C23FD81A758FC5BD2AD7BAE0F706F55E1B2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506766, "uuid": "9601c94c-2a36-4c08-96f3-61f0068f1c9c", "value": "12288:2guryhZ1EqkhqsDpzguryhZ1EqkhqsDp4Gpp3OS8Kww/Kyjgzs:UyhZLsTyhZLsGGrO/qSKIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506766, "uuid": "0353aa89-dacf-478c-b0c8-5ff936339745", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506766, "uuid": "0afc0fc5-00bc-4635-9424-17fff02d76f0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506766, "uuid": "f31a7a09-bcd2-4e75-8191-29c07f5d885e", "value": "a3e71e6a68fa16583f75ab42bddcd598.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a447f9a-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495248, "uuid": "8626452a-a5c5-4872-8f22-d8a25931b884", "comment": "Malware payload (Mirai)", "value": "d3ce096c407764fa14de23bf8f0e7e63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495248, "uuid": "a5317385-6c3f-4c93-9367-9fca71cf1dfb", "comment": "Malware payload (Mirai)", "value": "8e684b3dff974354f0c4739b560572c10d3874124252600fbfedb61d8a5ae28f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495248, "uuid": "b1a9cf82-e2fc-4e12-b47b-05d565fbb5b9", "comment": "Malware payload (Mirai)", "value": "306854a949922a031bab3db018f1ca4b1f7ca22d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495248, "uuid": "e938cdb4-ba86-4f39-9509-952edd261684", "comment": "Malware payload (Mirai)", "value": "f9e391c893c91cecf5f806c728aec3a0b0b159c2694cff9513dff47e9a7c25e32dbbe68cbfd908dfdb8106b68939f36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495248, "uuid": "769b940d-2040-4472-8bcc-80dd48e29054", "value": "T18983F84277080F43E05319F02E7B1BE087AEFD6118F5B6C5A51ABEC69231EF22546F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495248, "uuid": "98e8fa04-c0cd-4611-8ac2-079641fb4e4d", "value": "1536:0RAAhe1B1JK+z5qiDNhZdx6P0IdCteXIYHLCmyZl61d6Rx:4sKW5J9ZIdOevLk4gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495248, "uuid": "1bb55f22-51e8-4b8f-a2ee-384369d943af", "value": 84472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495248, "uuid": "b77333ef-fe21-4354-812d-77408898c019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495248, "uuid": "a4604438-9e9d-4cd6-a4ee-e8cb45ce2ab2", "value": "xfr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df97d02-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494314, "uuid": "6fc675a8-94f0-478e-a370-86847d5df141", "comment": "Malware payload (Mirai)", "value": "c04e492b80205306137575e424de7c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494314, "uuid": "bd2c9499-c602-40c5-a569-3956a61082e9", "comment": "Malware payload (Mirai)", "value": "8e7eee3e589da1b5a4c83d9160614ae4276002df54c7343f8f363bc1ba79f664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494314, "uuid": "6da8eff5-51e0-438f-97a4-b77776983de6", "comment": "Malware payload (Mirai)", "value": "3e38d118c38191d2971a52595b18ab0cc6a1461a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494314, "uuid": "a57e2e87-f080-4fe3-bed7-7cf04084a782", "comment": "Malware payload (Mirai)", "value": "1565d962a07e1ab05b02525d57c38f61ded7c19024c4bddef1ca5814eea7c61b012ad54b62cfac06ca524352e18702e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494314, "uuid": "74d7e157-bda4-48a8-aa11-9c9164ada70c", "value": "T121F2E1953289707281F4ADB3C47047F13E7A0076D4E533A16FE9838CE649711997BEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494314, "uuid": "dbc67b79-49ce-49a4-983c-a86c679a8a86", "value": "768:prFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GYOjwtxbIs3UozM:p/eRSnQjMgVuP7qtqxgtAdSw39zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494314, "uuid": "5e6474dc-5331-4844-840a-4cb8dd3ed0fa", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494314, "uuid": "cc49e355-0be5-4b78-9591-e1983f359c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494314, "uuid": "7b7cd5c2-570f-4e53-8e2a-d75e6b5ce52f", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4f0c64-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504276, "uuid": "173e4f31-dad0-41f0-8680-859494d3f808", "comment": "Malware payload (Mirai)", "value": "9ac7d220b8dc28531933431364b7c0c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504276, "uuid": "41531371-95c7-4792-af2b-47325c7c9a96", "comment": "Malware payload (Mirai)", "value": "8eb7ee8fb3706ecb8fc1d78f3660698c6c51b73b98715453cd54bb50750eda56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504276, "uuid": "09b9b7b7-1a9d-4705-b50f-58e2cecb3944", "comment": "Malware payload (Mirai)", "value": "8bc45da75304ce90c2963429671282ce15cce57e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504276, "uuid": "9d18a03e-abcf-4a2e-8d29-7187e8d22596", "comment": "Malware payload (Mirai)", "value": "098dbfc0319f9c8f4ea1d11835a41a7a1cebf69dc139d3da9fc1e9a811f6e6c1d201c551a968a20b8a748a4fb4beffe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504276, "uuid": "0b4766c5-c572-4ee9-8d2b-c3601c3f9f9e", "value": "T14C43085AF8825B11D5C1127AFE4E168A732317E8E3DEB3139E24AB2077C75670E3AC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504276, "uuid": "56a43318-74a4-44b4-81c3-0ddd45717707", "value": "1536:EUnT/+9pm/cYWbaPAazYIbi52skgksC15cYl+Fws:Gm/cYGaU2skgksC1eQ+Fws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504276, "uuid": "3159906c-9e32-4ce8-b876-a3f8f5b9edfd", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504276, "uuid": "2fc692e5-7785-430e-b3a2-0ae742e5b9b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504276, "uuid": "f80b82d2-7173-4bdd-b9bd-96e325a13ae5", "value": "wlan.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aeaf20-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773515349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515349, "uuid": "68be9845-d5a1-4b7c-8a84-c970bc353201", "comment": "Malware payload (XWorm)", "value": "db85bebe8d0d7117e1427fff035771bf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515349, "uuid": "101b3e0e-f35c-4d0d-8b9d-35b853ada461", "comment": "Malware payload (XWorm)", "value": "8f1873c264e43ac1235ff884a405b875105a2fc14908140d960fbb7be28faba5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515349, "uuid": "7d9f79d4-fc55-4be1-a919-44c85606fd17", "comment": "Malware payload (XWorm)", "value": "21e219b32f37218f51d35c9abdb7457716aa30c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515349, "uuid": "e2c92814-0c5e-488b-899c-3cd1aa59078c", "comment": "Malware payload (XWorm)", "value": "30759ca8859eaacbef479c688e3fff0c463194d509a6906942d14408dcc5d1b4b897619c24dbd27ab7e3c8b52d1e7d4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515349, "uuid": "7bc5bca6-5845-4712-af65-410a5fc200aa", "value": "T19E3502259BC528A88288DE16099377E2DF5FCCA5230BBD3D36B5D5CB9D2122BD5DC0E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515349, "uuid": "de90ba3c-e585-4e0e-8b9d-7eab5cd276ce", "value": "192:dA1kUUADVDDzwnJzE4SSCy4iDiVRGIDJ4VJQABC4UnC3QnRTIX2jnAjR3G305U1h:O1HaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515349, "uuid": "bc8a4753-b0c0-414a-8609-78a8e1355135", "value": 1155475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515349, "uuid": "9ebd028b-07db-4526-b886-06d287517457", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515349, "uuid": "eba749e1-03ad-400c-886c-80c6759c4e25", "value": "db85bebe8d0d7117e1427fff035771bf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43606f14-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516201, "uuid": "720217c0-8d39-4174-a23c-3dbb9f2e0b0e", "comment": "Malware payload", "value": "e530622dd77b951ca54aa40e831f6020", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516201, "uuid": "7ac839b5-041c-4221-b439-5cdcf2fe4b16", "comment": "Malware payload", "value": "901d87af193a391a425bc2f001b0e98437f0761c80350046c89dd8ae1086cb42", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516201, "uuid": "96a1ae99-4531-4683-99d3-6463f1837256", "comment": "Malware payload", "value": "4f4fcd5cd7f53841d0be6ef03a3758285a819f28", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516201, "uuid": "b4f089d4-062f-407e-94af-63f13de87a12", "comment": "Malware payload", "value": "d390eb1d1799ee958b7746f816e2015ce3a04adea3a27d8628bf6d95ab2a2e4ccf8ba0e61297c6f90358167d9a8abf12", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516201, "uuid": "6a3ec494-ca12-4b55-b28f-c0a186195ab3", "value": "T1EE450DDB801EB698BC2413D9A8DCC249FFE4405727A230B5C74D3AA86516A177337FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516201, "uuid": "12c29726-f4e2-4859-91a5-80c26693c064", "value": "768:J00000000000000000000000000000000000000000000000000000000000000q:Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516201, "uuid": "4154668f-2e9e-4005-9f5e-39899e59e290", "value": 1202474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516201, "uuid": "7a119d4b-d525-49ad-b7be-e11824189a39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516201, "uuid": "4013ae26-5e6f-46e0-a2b5-e6cfd46946d1", "value": "e530622dd77b951ca54aa40e831f6020.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35abebc-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506537, "uuid": "5bdc333c-0fbf-41a0-887d-c561abab7ccf", "comment": "Malware payload (Vidar)", "value": "12c130da3e73e6455b32af094bbaa62f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506537, "uuid": "f2c26443-8753-4b3c-9034-9e01ad453ec4", "comment": "Malware payload (Vidar)", "value": "90252f369724fc90be3e55f5c1fdf6e39c0693c0061af8c3cf69b77d4f8ac2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506537, "uuid": "32881e16-5688-4440-b7b6-2529ce651b27", "comment": "Malware payload (Vidar)", "value": "0d6b2b5e6b9e5eb6ddad28ba899a0ed4056730d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506537, "uuid": "ed05a5d8-fec3-4bc3-a077-33e3d8b05ebc", "comment": "Malware payload (Vidar)", "value": "b7d1c74e4c5910e521f62a9ce4917411672078b027606f1d451e9f05df65e8193a9f94a3d6484432e91668bfcc6867a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506537, "uuid": "67d1c057-23af-45ed-bcfc-95a538880f8f", "value": "T18BB56B0BBCA849EAD4AE973189B651927B70BC190B3263D71F90B6787F727E06D34704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506537, "uuid": "03738262-aa1f-4d0d-b8c6-c95fa12b059a", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506537, "uuid": "3365ae33-801d-4c7f-826a-90e006e825b5", "value": "49152:2cWsUufEgfgapqc1b1Yu8nnnBb+r95Meonc4QnUJf:2cVsXoGC1YtQGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506537, "uuid": "05bb3968-5e71-4805-a27c-56f7bb61544a", "value": 2407424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506537, "uuid": "0b5c9ef6-ed5f-4d0d-9747-2fb7e68d23a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506537, "uuid": "fbb7470b-c5c1-45ac-a1b4-e59eeca07e3f", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774ad67c-1f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773479781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479781, "uuid": "0421af02-2ce9-45fa-8e77-364f76eea970", "comment": "Malware payload", "value": "c00ac56e7a5b49a82fce7f806c2f8a21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479781, "uuid": "ba710047-6dca-437a-aa90-40d521ad5ef1", "comment": "Malware payload", "value": "90d416c1785bc8ae326c40e8113863bace61f17755217bad7c3b059026937871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479781, "uuid": "998635cd-6f54-44da-bd26-d667c8b77daf", "comment": "Malware payload", "value": "5b5ede8e5d7108d360d69dc8fd76bbc52725796f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479781, "uuid": "2672080d-a27d-41b9-b4b4-dca2c53d8867", "comment": "Malware payload", "value": "e669f821a6bdced3e5d8cfe9a46319e2096ea2fedd6ef41ac573a21d816505fa5f633e9849b998a0af305c95dd4343b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479781, "uuid": "4d658354-1445-4b13-aec2-d41f66273e11", "value": "T11CB4235618654AFBE7C2763EC50860C5F7B0DFB84A3CE35D29FAC77452928A895E8C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479781, "uuid": "f2c3ad67-401d-41fd-8b7f-d00b63b79165", "value": "12288:jEKT2wcEt0JCgox5Kzme8GxVvUfvhGXYNrBO1F+540rXkJ:wKSc8CzOx8GxVvM3lQ+9XkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479781, "uuid": "f56a9ae3-a00c-450e-b235-f89ccec56e3b", "value": 540412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479781, "uuid": "1f8387e4-8905-41fa-ac4b-eaf2d50734c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479781, "uuid": "1f482322-a2ea-48a1-a4d2-d915dfd0185c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d113f66-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773503869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503869, "uuid": "90cdc75b-a400-4175-8922-485bc39cf84b", "comment": "Malware payload (CountLoader)", "value": "b91ba0dd08c4f7b98d023025503f2e28", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503869, "uuid": "577585b1-e05a-4cad-8284-1edf76e64ca5", "comment": "Malware payload (CountLoader)", "value": "90e2ed98a45a75b3a4f73d1a9bffb85d4020dc4a8d3658073ff35bd45885118a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503869, "uuid": "c6d53cd3-4b32-4533-ad22-365520df5a5f", "comment": "Malware payload (CountLoader)", "value": "278e479a1a20054a33e6cda5e046838d6eabca48", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503869, "uuid": "3bb27d72-1dae-4f6d-93f8-8058a4bac1ae", "comment": "Malware payload (CountLoader)", "value": "62c5ad9901c5545fb5fb9eb69af1069b387e0c19bac791cfb3c0fb2bed531da00ef5aa13f69ebefde19f251696a52f7f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503869, "uuid": "0db96e2b-7556-42f8-b71c-e09504e40b48", "value": "T1BCC3BB9F894AC9EB8F5F706C8A4B5D02C68F0103051DC951BB9EED853F92D7C72A9AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503869, "uuid": "4782e8ba-f21e-4927-91e4-61959a9fe786", "value": "768:prb78Q6wnJ7GDoidwQUNgJMWYIhZsATrcvBY0ZDUl3fQqSfV4eeeG21DUZZfn405:Zima0AT9QRV9B1DuxxCVQVOakk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503869, "uuid": "083ccd01-8aa7-44bb-913c-4b4a51c973c2", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503869, "uuid": "c3d2e3fa-bd7a-4ec7-847c-29bd499c938d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503869, "uuid": "68e71962-d265-47de-a2d9-cd6c31e1ce23", "value": "Release_Office__63.ini.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d816831-1f88-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773480650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480650, "uuid": "635f8834-663c-4df8-8f13-096f43f1991c", "comment": "Malware payload (Gafgyt)", "value": "91a1c3d410bd86bb52f961ac80a130ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480650, "uuid": "66b8fbf8-9ca6-400c-b2d4-ab2cccad97c2", "comment": "Malware payload (Gafgyt)", "value": "9117ed1aedcf1af415fd096959d17eb386e870429621148fcfe758c9dd48c5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480650, "uuid": "8e483558-6340-488c-9b7e-588b0ae0d5a3", "comment": "Malware payload (Gafgyt)", "value": "020d13069317c6c0adfe4918bcea093ec2639b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480650, "uuid": "da5f2ac1-da20-49f1-becf-e0430be413ab", "comment": "Malware payload (Gafgyt)", "value": "9fe872f7346a894559d24d608c9e7e77ea5486d92fa0ed5741f9c8e5475f38ac28c40bb57c05758ed22ce43484b60dec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480650, "uuid": "e3d9c58b-369d-48a0-8722-0a784f7bdfd1", "value": "T1DD924B528DA85E14E65DB5B4E0300B35A713FA26E7075FBE1D2645548083F8CFA9837F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480650, "uuid": "67105984-3ff5-4cba-bf91-3f08ca4e140d", "value": "384:c/tgCbSJPQOQDEMWFXg7r+Efnxdv0hnjoA+I/sqBQIm3z0:Wtg8SJUmyvpJyoA+wsTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773480650, "uuid": "4fbe2a25-3862-40ad-8c75-513f53fb65e3", "value": 20772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773480650, "uuid": "2cbf51d0-3a5c-4985-954d-ffbf4f73fbf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480650, "uuid": "7ef279e9-7349-4c0e-b971-6e826c1e7067", "value": "violetsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440f56b8-1fc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773506753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506753, "uuid": "e0473d63-308e-4d6b-badf-fa4c9ced7d79", "comment": "Malware payload", "value": "4c86f7fe70429c2e19f010ea2a5a81ff", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506753, "uuid": "08e000f5-2fdd-4607-a16b-127f775c8c16", "comment": "Malware payload", "value": "914aecb71480dd7203134558f3a8282e613e9686e69515cd39b7c2c3f75ee57e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506753, "uuid": "d0218a83-f9d9-4822-9ec1-fe899534816a", "comment": "Malware payload", "value": "a534f94fdc10cef6581962c033ee08ac1a1625e3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506753, "uuid": "7344d029-0886-42e9-a929-485fa4bea70e", "comment": "Malware payload", "value": "30ef87f93e6730db9a284f81590218db20ca9ba519e1001c4324b0f9ce1e5cc9e58e6f5abc0fc4c569389fc4bbb10885", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506753, "uuid": "0038c07e-0ef5-41be-8585-8152cb2c2731", "value": "T193451218E852FABEC9251439837690CD8630BC07E769D3875FDD3B496036AF8A38953D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506753, "uuid": "8190c8bd-0788-4a8b-8619-f788d52568a3", "value": "24576:Mv2lyVZw6oyw2myv2lyVZw6oyw2m7Tb3f9p37u:69PwDyn9PwDysffu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506753, "uuid": "fd7a62e1-2e83-42e6-8edf-c01cd93bd535", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506753, "uuid": "f4b81645-1f6c-4df4-835f-9df58d7db975", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506753, "uuid": "575e2e86-efd1-47f5-863e-3b624276a55d", "value": "4c86f7fe70429c2e19f010ea2a5a81ff.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e043e6-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515351, "uuid": "83af2f81-7f6e-483f-84f1-92c6f07a0b94", "comment": "Malware payload (AgentTesla)", "value": "5bb7c01b53fab482f35c6fd3bac57327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515351, "uuid": "712eda45-3fb5-44fe-b113-d29f121b4296", "comment": "Malware payload (AgentTesla)", "value": "915026e868b8251316c0fe1370acbd3c35f6b41cf956e184e9250cfd97fb2fd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515351, "uuid": "ef7ca008-eafc-488c-adb5-dce74eef1ec6", "comment": "Malware payload (AgentTesla)", "value": "b69e0fa69ae56fa0dce6606aea998b4a7ba15b8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515351, "uuid": "0ac1c5e1-47a3-4de5-8f66-8afbbc7cbdce", "comment": "Malware payload (AgentTesla)", "value": "2fab348645e2f8ae41108aa5d99fb918f10181f02b37ae76c9b4e7f9368182fb07c432288143418276b8a01c121cbae6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515351, "uuid": "3ba5e9c6-8ec3-46e9-83ab-56d511223245", "value": "T175532E5179288696C79B3E3D560DD442A075CCBF7F84582D970D88EB88E3C22F66D32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515351, "uuid": "c9fb12c5-71e8-4a1b-892f-ec854b37c37d", "value": "1536:3jziFaoj3gop/Sk9RgosZz6XJH+DxT3vO9pEOPkqfKvK2RfwM4gcD7bRhVksFIBI:3jziFaoj3gop/Sk9RgosZz6XJH+DxT3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515351, "uuid": "6c8077f7-ae31-4168-b0fb-5c066010bb3e", "value": 61610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515351, "uuid": "5376771d-a2a1-4d97-ba6a-3b4fa5206973", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515351, "uuid": "75778215-5012-4180-9de5-aa1509a46c6c", "value": "5bb7c01b53fab482f35c6fd3bac57327.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525e5f09-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494322, "uuid": "2ecfc1e1-4253-4a25-82e6-6541697e9b36", "comment": "Malware payload (Mirai)", "value": "0605351d7faceedbb014bbf6b2a02298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494322, "uuid": "45f849c0-6ae5-482d-80cf-e026257a83a9", "comment": "Malware payload (Mirai)", "value": "918738199deb74d276e65836536130b014dd5f20291eb460cdfe3ea9d3e1aaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494322, "uuid": "06524463-9633-44ec-9ef5-88503622e3bb", "comment": "Malware payload (Mirai)", "value": "a4295403cca8d8b3b08f4e27b98af149d659ed61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494322, "uuid": "7e101248-822f-4bb2-9197-50bcc96ac8dc", "comment": "Malware payload (Mirai)", "value": "52026d71290bef4324932d068c47b678871fb526f2325519fb077cacae2f3db5d7083a4a52f5cf433497f95aeaa476fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494322, "uuid": "91ef2f04-deef-43d6-b051-4cea5c0e6362", "value": "T1C8B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494322, "uuid": "928d4958-4a8b-4795-afd0-a4276c617570", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgD4/LWW:8YSZ3e8ZE3MYlphDgD4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494322, "uuid": "1480b336-4fb8-4d37-95a6-5e1f0e7992a0", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494322, "uuid": "83373661-b7a4-4b69-808c-099b7cc524ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494322, "uuid": "112ee206-c629-429b-b75d-84c730b7c175", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3dc47d-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494313, "uuid": "95f0974e-460a-4d93-8de4-e9911893ec28", "comment": "Malware payload (Mirai)", "value": "7662f214a7d242f8f7d22969d486341d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494313, "uuid": "769a7140-0f1f-4d42-9128-c07b90728e88", "comment": "Malware payload (Mirai)", "value": "9213a007aee2ae43ec57e9268fb2078cdca774c8cc2d2a5a188708f3e485fd58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494313, "uuid": "e877be62-b308-4218-b7f2-6f316f9aad7b", "comment": "Malware payload (Mirai)", "value": "95e806535752d2627249e655485c8a16a2a3bea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494313, "uuid": "a0fdc100-017f-4319-a3ec-1f85b5fa21b8", "comment": "Malware payload (Mirai)", "value": "c14c8a6bbeff9e21a9bd35cad073d3a5189ab7aebccee07bcaa93cf8a26602571e83e3efe50329e796503f9a79748158", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494313, "uuid": "3c29c81b-918e-4b4d-8816-def9732e40ac", "value": "T151734B21F9391927C0D5A17A21F74B23B5F643CE20A8861F3E710F9DBF615803A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494313, "uuid": "a2391dbc-754d-44cf-8014-482fe60e2218", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTsfT:7PQbrL7SYOBR2sfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494313, "uuid": "345b9b6c-f6bd-4a42-8a4b-801a2c01ffe7", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494313, "uuid": "8a30686f-9aa0-48cb-a132-d2ee64408093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494313, "uuid": "cd230d0e-f3af-40b2-9c66-b4d8c1ce4b22", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c607bf-1f44-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773451275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451275, "uuid": "22e713ff-5b85-4f66-82c0-8e498821c2ac", "comment": "Malware payload (XWorm)", "value": "0b36732cc40d5d15a80e7d3f8785ae01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451275, "uuid": "ce345484-711e-4371-a0fa-2f2a3bf7fb66", "comment": "Malware payload (XWorm)", "value": "9279fcb85f90aa6ae754e8749f82625ca0d5f51138759310690d7214eae77dd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451275, "uuid": "66ebc7f6-0b6a-4598-b472-87249f3cd7c7", "comment": "Malware payload (XWorm)", "value": "8c46e3d0bd891b4be4621ed734974b9c3965b3bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451275, "uuid": "62bbe69e-445e-4d7e-a332-0bbefb08cb42", "comment": "Malware payload (XWorm)", "value": "5aa4745e3f65de2cd431836420e20f55153d7a8e1cfaa351f9967a2ed72c9c458a87e097ba6cd6d8a26e0d2193feab85", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451275, "uuid": "dc93d2d9-394c-4e61-bdcb-25d867f3526b", "value": "T13C448E1EBF86B89AC4180E764967D1C1077CDFE6B0A7A7E930D46D3CAAD28B4C905F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451275, "uuid": "f87b2c0d-3706-4d0c-a483-eb625d11a6f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451275, "uuid": "4143cf74-aff7-45f4-94e8-403315cc7255", "value": "3072:Tuhn4sPcozFrwsivfBYenCpBcCJbZqZpZM9RUGKXs+S++7KFSbxeY+qDDrMQ:IPfDeUJbZqZ7xGqStKEbxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773451275, "uuid": "bc2b8a23-d4e4-4663-9494-c2d953782745", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773451275, "uuid": "3788a70a-60c9-43f9-a33b-ae2ef253bcb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451275, "uuid": "ce40f2ba-db02-4b81-b847-56025cf863c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68f6e4e-1fb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773501389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501389, "uuid": "2107b33a-0167-4b79-9c02-a19cdde26f89", "comment": "Malware payload (Vidar)", "value": "6aa925fd45796da22f091a05446e6da1", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501389, "uuid": "de4e17da-14aa-47c4-9a8c-812c588e1970", "comment": "Malware payload (Vidar)", "value": "92c6d578ed0d94deb77b93120f8fdba93eaf6e3265b563dbc4705519a6652587", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501389, "uuid": "cac21c48-cb12-44f1-aa2a-ff6a9d339269", "comment": "Malware payload (Vidar)", "value": "d101607e19978b5391883b8d25e9dd0592395ea4", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501389, "uuid": "f23cb062-e1f1-4b81-ae5a-3661bade201d", "comment": "Malware payload (Vidar)", "value": "b93ae01ccbc0384f8611ffa316f04801bb4cdd2902a9d1c3e36bf0ad40a9e6c3c2ab1eaa8e76a2fd8f91bf43c7e9ce12", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501389, "uuid": "bc9896c5-5f0a-4ad1-880d-fdf62b524460", "value": "T19095590BBC9449E6D46AA3368DB762927B31FC0D0B3263D71A50B97C2E727E0AD75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501389, "uuid": "caf7169b-ecf0-4107-a365-c3174aa2c778", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501389, "uuid": "c60d044b-28de-4032-b994-5ad4b13b7564", "value": "24576:vQMOeO/ErOGszTpH/SYKVFHDqqxTflCdwtQaWtP+RnAnx:vQM5O/ErOHzdSYKVZuqll8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501389, "uuid": "b141615f-50e1-4491-b02b-f76609287530", "value": 1936896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501389, "uuid": "15052020-9e5d-488e-866d-d38a7d2d19e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501389, "uuid": "ec1a06d4-1326-49ef-b5ce-aabc4e4b5cbd", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df8daf3-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773505159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505159, "uuid": "862f47f3-0e6c-4b15-88ba-9ff4194324ea", "comment": "Malware payload (Vidar)", "value": "a1808c50e990dea58362209760aa058d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505159, "uuid": "589ec4c2-3ce6-4a23-a4a4-5337b4ec57b2", "comment": "Malware payload (Vidar)", "value": "934cb373d8a10bebead22c77ca920397011c92e1c40eb2e7ad814e52da71dded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505159, "uuid": "6535a32e-6c99-44df-91d7-7cca482d1a4f", "comment": "Malware payload (Vidar)", "value": "794427f8fbfea3a39a57a1811185f6ee1afb51a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505159, "uuid": "7e58d9aa-5d7d-41ff-b945-fd4b08bea2b1", "comment": "Malware payload (Vidar)", "value": "f70ec28359fd3621835c41030df38a801cee5af9a63d7dc7505ed301962ea1fce1ecac57e1fbf1110350c5e7cf26cbd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505159, "uuid": "141c2a08-8f41-4095-af8a-25ded518ea2b", "value": "T10A7608AB6250C268C29E813BC89BCB01A5F7B1752B33C6D706BD036B7E455D46E7B270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505159, "uuid": "ebf45c5c-2bb0-4995-83cc-c3a8225690ae", "value": "4c0c021979edefefb6f1fdc1b57809a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505159, "uuid": "6d870b39-b32d-402f-b7d0-f8260b6d5129", "value": "49152:ziNRNV9FtBZRupRW5UFfYxbWt8FU611SBqUYwUchA9qq8Gt5scEXLL5hxWq3p6z:zEPj4DLVWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505159, "uuid": "60c75858-6620-4ff2-bdfc-3c8a4a7c6bd9", "value": 7369728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505159, "uuid": "a261dd50-7046-491e-9ca2-aeb2b9d0c81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505159, "uuid": "7150ae69-911e-4069-8d47-e7e9b4ecc7e7", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785ba8b1-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493956, "uuid": "1a57dcdf-8dcb-4d80-9692-bdddc28c90f6", "comment": "Malware payload (Mirai)", "value": "24299b38addf280298ac83ae3909fa0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493956, "uuid": "151a2f99-e463-449b-adb5-0cc9008c2868", "comment": "Malware payload (Mirai)", "value": "934d23d7e20365115d704029373e330c5c85879494264700eb3fe3a6426a67b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493956, "uuid": "3a4d3b84-5a8e-4425-8734-94f5a5f33d98", "comment": "Malware payload (Mirai)", "value": "cb9bb5e3eb80e52b773c7842074506b4d54ae037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493956, "uuid": "dbdd65ea-6a73-47dc-b23d-bb69237df88d", "comment": "Malware payload (Mirai)", "value": "cf9f2bdc4268d83c461816d5752222893a24eec60c38f95df9a1c0b426e58886b2e63b560c2ffa30b3f138ffa3cc8b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493956, "uuid": "ff726823-e11b-4760-8ce7-0805ad821045", "value": "T1C6734B42731C0B47D0A35DF42E3F27D093BEAA9120E4FA85651E9B4692B5E331196FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493956, "uuid": "08dbc95f-6959-427f-8774-66609494e43a", "value": "1536:fzAs6AEpRu5XGAkwYJzXah14IN7w+08WKF2Bs561d6ER:ftsRHk14I6+Rut9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493956, "uuid": "ad087cd6-0baf-405d-9bf3-6596ad4b6172", "value": 77412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493956, "uuid": "83ea3d42-8a18-4ff3-8033-eca2b452cd04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493956, "uuid": "9c7106aa-1af8-426f-abb8-5c0862fdd6c3", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc4988e-1fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1773504786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504786, "uuid": "14974179-2713-42f5-8d17-c630fda74956", "comment": "Malware payload (Adware.Techsnab)", "value": "3424edaa2031ee2421193f9fae2ed45a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504786, "uuid": "1d3739cc-cdaf-4904-93a4-71ed7d5a27ef", "comment": "Malware payload (Adware.Techsnab)", "value": "93830d73ddf9665ae4d5665f1cebabd093646ed54356662e1b2a925bc2df681b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504786, "uuid": "6da721e6-0b8a-421e-8973-2a90ee916c58", "comment": "Malware payload (Adware.Techsnab)", "value": "3b2a75ab7c56c44581694643d4fafb36ed89e0cf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504786, "uuid": "2abd5d50-3635-4219-8f8a-fce018f83742", "comment": "Malware payload (Adware.Techsnab)", "value": "491fe5e35a604ec41b0fe93bdf3d8734445e11ccb5481bf686433bfe3d29280fc38c2637da300e759c4fddcfebde0b33", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vn-hugo-lapp-co", "colour": "#DC32F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504786, "uuid": "bbf737e2-6043-420a-b518-6199dfb7a82a", "value": "T1E3255AE14AC38D63C32263E1C642B75FC4BC518747A1A286F158739C335E69A72E4E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504786, "uuid": "429c5722-d88e-4035-84f3-cd9776d5c214", "value": "12288:SKmAiIGAtB1f4PCl6wOsxOcUC5oUC/u4GrAtkWZAwuTBT:ze0Be6dVwe7C/q8fZITBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504786, "uuid": "1f9682e8-343f-424e-810c-b7f321925d30", "value": 970114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504786, "uuid": "701d6cdd-ac26-4ed2-b9ff-75c52a3227a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504786, "uuid": "04903e16-d9e9-4b6d-ae0b-326002d50a05", "value": "vk_swiftshader_icd.json.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60df5e35-1f51-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773456980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456980, "uuid": "f5cd5e6e-0318-428a-a0c4-49cf16a435e2", "comment": "Malware payload (CountLoader)", "value": "dffc69ef830bf5708fde9f3d867b17d4", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456980, "uuid": "e2aedbd1-6880-488c-b9ea-b61e2064c3a3", "comment": "Malware payload (CountLoader)", "value": "93c84af932e3df84b764492c1ce66dbbcc5dcf3fc15f5eff9fe824036c59ff80", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456980, "uuid": "723c652c-bb55-4761-b30d-a51ea2cfaae4", "comment": "Malware payload (CountLoader)", "value": "2fc9727032a1507c8768d5ea5b5ab2243e23df02", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456980, "uuid": "26c0ad4b-35af-4a71-bc15-47c7169a49e1", "comment": "Malware payload (CountLoader)", "value": "b51ffc5a32ae2c360f420e86c3063ca1fcf7b6453694d49e8cdff14ed0c32daff8da8753f05be7a2c7d9647506bca123", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456980, "uuid": "a29883f6-72ad-47cc-9f87-874f505216c8", "value": "T178B314884DDAD4718F5F3028695F1D0F9A9DE6230A5CC690BEDE9F843F11AF434A96E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456980, "uuid": "67f609be-5280-465f-8bd3-885def06efa3", "value": "1536:EJ3rpa2iXaNUxMqvnNNV/Np5J54OzaRKMQ5RjPbamSPX1:DU+DV/P5X4Ozn+PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773456980, "uuid": "578796ae-312c-4644-87d5-5ec47940c1c7", "value": 113354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773456980, "uuid": "3830f9bf-8359-4d74-8511-e80658345a1d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456980, "uuid": "3793570e-d9b2-420c-b670-abdeb811b398", "value": "X_Journal_London_308.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e20ca6-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507082, "uuid": "10c78922-c815-4163-9c65-3e3fbc9a4beb", "comment": "Malware payload (ACRStealer)", "value": "3a60c6d27418c95e0b8d15be7f77da5e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507082, "uuid": "4454e527-08b6-490b-beec-f14b4afd4726", "comment": "Malware payload (ACRStealer)", "value": "93e8407fca72ac108dd2724066ee81041f3dc5be640b21a474743eabfc5f0b6c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507082, "uuid": "1c50756d-aea1-4aa2-af83-b089fcdd1e59", "comment": "Malware payload (ACRStealer)", "value": "09b25aac3fa3ebd1bc082cae9d316a7697fd4cbb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507082, "uuid": "a77e09e4-4261-403b-b6bd-826cdee6daed", "comment": "Malware payload (ACRStealer)", "value": "ceb08211ae11dee9c555cecf4414557458b918f24abb4554674c380e3495c4a3c7d8dcdfb1636e6459a454af77ffccfc", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507082, "uuid": "13954c78-b173-4efb-961d-54da1f72a8b7", "value": "T1447595C151832EB5FB0FDF314A39E53F6F5852045B60CAA2966C5F7AE933983123B681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507082, "uuid": "b7fba0fe-e8b0-4076-89a9-0f76a33e2767", "value": "aa87a4a222f43add561b3c1d9e57f339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507082, "uuid": "deb580a7-5def-479e-8d0f-7f0e7fc11d34", "value": "24576:PuvZPZN3uKO35Y8wWweHRwiSc3XQmdsm2G2SA:kNUxkf3SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507082, "uuid": "ac915b42-0c5d-43cc-97db-d5832055cbcc", "value": 1612288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507082, "uuid": "bba53634-c6c6-40c2-85e7-22a25f736d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507082, "uuid": "c91fa9df-709f-40b3-be38-49603a20e55b", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504a14ae-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503767, "uuid": "1850492a-42c2-477d-8d14-136e4303a0ca", "comment": "Malware payload", "value": "4f38bac7efe687f998f1528fd19c06df", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503767, "uuid": "0a497c58-b5ab-454a-98ab-c9b266d77cce", "comment": "Malware payload", "value": "95049d9a69337bb0bc92d7b2e70b7a4a046791a616993e5dbf73a94fcddb6018", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503767, "uuid": "0f1807f0-d914-4532-bfec-a05a755eb994", "comment": "Malware payload", "value": "2c9c0b6debbe0696c0fb64d511b8774bb4d54fa7", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503767, "uuid": "35007ebd-fbda-4491-bfbc-31420ff7febd", "comment": "Malware payload", "value": "1b4f1fece9d9ef98b99176f63f5db238226967263f89b787219f76b0f83ff0a0bcd685a1aa45b343d1cfe9965c5b4106", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503767, "uuid": "75270a94-9ee2-4d58-bc93-b185cb0fe6be", "value": "T1F7724B9670687A99C75337A3413E7FD9988265BA0011D3C7A3F301A9E5FCED24B43B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503767, "uuid": "30ffe17b-d62c-4503-b93d-c97295864831", "value": "384:5w1ljg+WtUx43hMG6UjVCksyyLKuUVSszgP8O23VC+ALT:5wLjgWqMUj3By2uUVlsjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503767, "uuid": "d91f88c3-47d7-4e7c-b8e9-274fa370356d", "value": 17500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503767, "uuid": "690604a3-1359-4bf5-b0f2-09db8e6722d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503767, "uuid": "d64468ab-39ee-461a-bc8c-390bc43e6c98", "value": "sil-api-js_clickfix.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3336d99d-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "cafa26b4-5bf0-4229-8a3c-5e0792b6f6c8", "comment": "Malware payload", "value": "34ac846e62097714f791c03b8994cb24", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "ee098425-be04-4a67-bcc6-fcf6180fe0ed", "comment": "Malware payload", "value": "95b97e91e16417f2d6a57f14a8f71e3a0de05467b63f3182398e3e378eefaa7a", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "b47d0706-f6bc-431c-bec1-8fba076243a6", "comment": "Malware payload", "value": "4528df8e3f664c84e37a4e041e3ef00a2bb315ba", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486538, "uuid": "35dd8010-fd8e-4b64-8865-29a8b9d4c4aa", "comment": "Malware payload", "value": "bde58464e4e1de0a1f8b654f0ec21dc951ee09e8f818df22b7049f588cc517ed5ad39c63e602773533e67482934b29ab", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "2c051587-a605-4099-81e7-a9c024674477", "value": "T1C1E05C299330F46007AD708041313F4B20D65E5197B24AA9D1221818BD91AC6FF1B20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "93747dbb-7643-4460-a086-be0f82cd6f1e", "value": "12:s8hZGrO6hMHc+lEMl7btpsCoMADXtQFjohognia9kM:rZGrfaLlEwbtpRoMAGF0hognZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486538, "uuid": "b61d3955-c8fa-497e-ab39-489ea83958c9", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486538, "uuid": "09afa255-53cb-416c-85ad-7b66220458ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486538, "uuid": "0711ce87-8012-4360-9340-dcbcba58896b", "value": "6ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7703a52-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491512, "uuid": "1ceb8000-df04-495b-add0-dec35ddc0e8b", "comment": "Malware payload (Mirai)", "value": "73cead5fd858232a17358f3ef229293c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491512, "uuid": "7dc54efe-ffe9-4646-a62d-5e360c06625f", "comment": "Malware payload (Mirai)", "value": "95e551b6c44e6b7130d71f84fbd69d58841d1d868ab92df16462e4e7dee6fe7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491512, "uuid": "cf93f339-f5af-4efb-843e-b5d3f44ae21e", "comment": "Malware payload (Mirai)", "value": "b75666df552b7566b9d7ec99d0b641782e7723c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491512, "uuid": "021322c9-a458-4d37-bff2-e956b9f30889", "comment": "Malware payload (Mirai)", "value": "2aa4c56a94830b7d70b9ccaa6e4093a6bb8025aca94e8fc195849d70fa5a2594fd8c2919aa18d4142cd7e508bde4f623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491512, "uuid": "241247f1-4789-4c70-b6d7-b8745801c980", "value": "T152F46C633711CFA4E315C27009F3C6659AD425A21AF250C9B2BCD318BE6162E7D5FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491512, "uuid": "e8c876b0-b418-4488-84d2-e840d70b5034", "value": "12288:84a4mXux1IMUeUGt+mlxIXXLWgYA1V6sdJpdhtUqG+KFIc8px8JZZj9VM:m4mX41IWhlCXXLWgpV6gJpXBG++vJZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491512, "uuid": "112c41d5-ffaa-42b1-94d2-e0507a81abdf", "value": 748880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491512, "uuid": "c28eb564-cf60-43ec-932a-2c44781f0ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491512, "uuid": "c391eeaf-c8d6-4d15-a643-1e857b6896c9", "value": "bot_opt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ac7ed9-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516064, "uuid": "b19b356f-1ecb-42b9-bc0e-b4260674a3e9", "comment": "Malware payload", "value": "31b47438541733d7e9ebf89074d8f9b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516064, "uuid": "6db5d49b-1b05-4ca8-b81b-0d0045b8544f", "comment": "Malware payload", "value": "963fa01f52ae4f66b40d01a87c76a73eb6bb3d56154f7707ba2d4bac9465ee1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516064, "uuid": "e848e4dc-32af-4d27-b5b7-4a89751b14e8", "comment": "Malware payload", "value": "b96f4a4e47571ce703f8c2f2e017bf40652a79e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516064, "uuid": "cc3bdcf0-b278-47d4-9e35-d4786c4adc23", "comment": "Malware payload", "value": "23982e2ca220f7631aa235da50735903cfdc580ee39e664bf32a752787d94d52e580e8baf25848518345a2455b9bf7f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516064, "uuid": "dacae2c1-8a3c-40a4-a10f-bbba52caa8d1", "value": "T168F11B72C0E09AA5826F08DC7338416F0024C7555B6BBF682B4B4C62AFC7520EF79986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516064, "uuid": "e00d9abc-8c98-4b7a-b181-505e39e8e289", "value": "96:+tGcbR44/SG/N2gkqKG/NKmyglg7GVgcU77hicUxGFoh+gCI9JZFmF0mtYC+9cSC:+X/S80GzdlgiAkr4GhI8bY0m+97elpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516064, "uuid": "78fae60c-da79-4a4e-a4e6-47a28c97d61a", "value": 7754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516064, "uuid": "5d78f095-cafc-4f6c-88b6-d835bc98a2b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516064, "uuid": "5caaf31b-05c8-4093-a8de-5d2b155e0833", "value": "31b47438541733d7e9ebf89074d8f9b3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9aa6015-1fba-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1773502280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502280, "uuid": "ab6edfdc-8250-4325-9d62-153d9667f5d5", "comment": "Malware payload (OffLoader)", "value": "bb54c42b50b48129ddc779fc5276b7d6", "object_relation": "md5", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502280, "uuid": "d39cad99-7f30-48e0-bb52-9772e45f52cd", "comment": "Malware payload (OffLoader)", "value": "9667540f87efe7f7e5f7afc233575d0b02a69aa0612d3a0978bb84e376d8b2a4", "object_relation": "sha256", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502280, "uuid": "d50930d2-1ecf-4808-a704-9cb3a06bb19d", "comment": "Malware payload (OffLoader)", "value": "dceb6295466f780df8a0b0351d75727bf3f8bb50", "object_relation": "sha1", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502280, "uuid": "0ecd205d-6557-4bdf-bfb0-049be671a7fe", "comment": "Malware payload (OffLoader)", "value": "afb018955938245643a1474aa8eb48be8abe2554c61f8e4a2fcd34bdbf104251b2ade123362ad751955298aa4374d582", "object_relation": "sha3-384", "Tag": [ { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502280, "uuid": "c91fb219-996e-4fcf-a695-99adc167f0e1", "value": "T122E71223724A533DF06A5B3755B692205D3B6E6064CA8CD696E47F8CCF3A0A01D3E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502280, "uuid": "955ef1d8-09de-4c91-ae30-05eda9ab2ecc", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502280, "uuid": "ffabb934-f0f5-477a-beb4-6767f33ca16b", "value": "196608:bqP5zJuVIYq15csr9yhYKU0d0+5WUMViMCd9Z8:bU59uVIj4qWdv5W7V11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502280, "uuid": "2b6851e0-5c2f-49cf-904c-41047585ac71", "value": 67899138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502280, "uuid": "6c37bae6-9775-4935-935f-70b45cc568cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502280, "uuid": "f817555d-062b-4f5d-a47f-bd9944468c56", "value": "eLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e0d643-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501862, "uuid": "2c0ed647-d7e5-4a3a-9a8b-9490f1cb46a8", "comment": "Malware payload", "value": "d0368670598968c87ebd2dde564cd0d5", "object_relation": "md5", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501862, "uuid": "0a5b0770-6493-4f69-b54c-2f4036186815", "comment": "Malware payload", "value": "967d69e6fc24fafdc6d0d4c419ebe04060c9521b8fc11484da5aa764a0aeb74b", "object_relation": "sha256", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501862, "uuid": "1d294919-1853-449d-acd8-73903dc64cc1", "comment": "Malware payload", "value": "086b845c4757525a832d0a2a6c938b45d0b81e8c", "object_relation": "sha1", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501862, "uuid": "b9e66c38-58fc-4ba4-9173-e96adcf64172", "comment": "Malware payload", "value": "abb5013c7de8f025930dc7727c1aaeaccbaf43ec467131a665bd3f94cba6dd7b4dbfe9cc18b23151e05d3f1b4a337e0b", "object_relation": "sha3-384", "Tag": [ { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501862, "uuid": "7c420ca5-a453-4b83-8b66-1fb6eb752ed7", "value": "T1317109AEF240EB9589E0849538BD3BC80375137FA9A016DC2C1933828674FE4E6CD735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501862, "uuid": "4fdc0fc4-e65e-4202-983b-0a73beab7f15", "value": "96:8DJ3Ec1Z+A7j/V9AyJVHq9OAHcUH+HrcSHHA4VRVQnED1GHnNAMATQ/:85h/jH/jPVKJxe/g2NMiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501862, "uuid": "bf1d5da2-8fce-4d0b-b0ba-e3de5e17f95f", "value": 3797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501862, "uuid": "b2f775e4-af49-425c-b86f-50cd8f37b318", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501862, "uuid": "f1fca697-be93-492f-a31d-f29014605e3f", "value": "aesthetdrama_macos_dropper.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bb2f48-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494381, "uuid": "4c0f79fd-9200-40f5-866f-2e3d93d9de46", "comment": "Malware payload (Mirai)", "value": "978b3f02c3f69894a072a579ce308865", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494381, "uuid": "89c43b49-1584-4503-9c92-24fb78cab2cd", "comment": "Malware payload (Mirai)", "value": "96fe597519e9623574754f76ea68fdbd36e90e6ed97df7fc4708492192b42261", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494381, "uuid": "bc50ef79-f0d1-4d19-99be-b633e9eb3377", "comment": "Malware payload (Mirai)", "value": "028a4330346afcfb0614ae056438060ed93476fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494381, "uuid": "9bde8f2c-bc63-40a8-92d1-5250746633a3", "comment": "Malware payload (Mirai)", "value": "c0e35e8e688e7d058130a0007ad6cb19537612624e7904887108f2da17f26020494e717c02d8a24fa220087867339634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494381, "uuid": "0456c39d-e864-466a-ad4b-4462a45e2c27", "value": "T1C7735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494381, "uuid": "16f838c4-afbb-4cfb-8cd7-81aac9f66d33", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f716t:uJE+5x8TTRkg7IF+7g1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494381, "uuid": "b4719291-d0b6-49b8-bbad-37ed9417b9fa", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494381, "uuid": "49778415-bc2e-4c11-a1c2-153109197070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494381, "uuid": "48159280-ae0d-4e4e-bf14-5089fe65bf8a", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016bdf1f-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773501487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501487, "uuid": "e71e8230-5c6d-4335-b69e-7ce41f670553", "comment": "Malware payload (ACRStealer)", "value": "650a68a00559e7ab4269c82508109fd0", "object_relation": "md5", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501487, "uuid": "88ae7e61-e1bf-4c35-90fe-e03398f35ec4", "comment": "Malware payload (ACRStealer)", "value": "983de8375334af843d1e9396c7f06365da0241903173d613927cee34c0247bf3", "object_relation": "sha256", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501487, "uuid": "62aa7724-6d4e-4b14-80e8-e969f3377cf0", "comment": "Malware payload (ACRStealer)", "value": "fcd606792e64086b54602642b41614ebcc0cb35d", "object_relation": "sha1", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501487, "uuid": "50ebd0c0-e325-46d5-a013-94f6fe2a0b57", "comment": "Malware payload (ACRStealer)", "value": "205ce2e9a294931a2b38bf62e12973c40ac6ae03c78aabb097d76ad5146536317329a05d3afb55096d8a77dbac9edf17", "object_relation": "sha3-384", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501487, "uuid": "300eaab6-0314-4589-9705-2226d07bb802", "value": "T17A6733D78F50A068CDA9A83970D459FFEF9E24D2D717220BFB5037C251D5389AE9A20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501487, "uuid": "fabd076a-de15-4693-8666-1245433d3404", "value": "786432:AVljg8fJ+dTmDETF65ZBbL8gOFNMiV3Yq0FOVQS1htJKOR1BfqI:ujgkgQZBbIvFNMieOFLX1fqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501487, "uuid": "28f5b9cc-568e-4fbe-af37-f5bf063f8f4c", "value": 32363724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501487, "uuid": "d07ebd7a-3b77-49d6-beee-ce1d432bf70d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501487, "uuid": "eb0966c1-b828-4d8e-bfc4-9d3c84ed0c64", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce0819b-1f80-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773477025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477025, "uuid": "1f5056db-d122-4eaa-ad93-2ba55065f067", "comment": "Malware payload (CountLoader)", "value": "f3744547de233e8eefcd102c89e7a9c0", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477025, "uuid": "97b48596-e69d-4974-9c3f-0247feba758c", "comment": "Malware payload (CountLoader)", "value": "989669d5bde906b2d5a6c5a756e22f46c71bd5aca78253d1d48151e09434aa73", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477025, "uuid": "38313674-6233-4ac9-8030-366fec3e4387", "comment": "Malware payload (CountLoader)", "value": "8eda4e5e76b232847b78cb8a09ea316e94581590", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477025, "uuid": "5f6663f3-200f-490a-8f6e-2f4938882182", "comment": "Malware payload (CountLoader)", "value": "69c803fe4a439953a7abf04e08aadb21d44b7e5ed8a486fc9d5dc08ffb699c1731f7d12c308be03066037d6e91acf4f3", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477025, "uuid": "d5d8d24c-a87d-45c1-ba0f-515482c04abf", "value": "T108B301884A9A85729B1F7064450F5D079ADD9533031CEC80BACEAF5A3F11AF1F9BB9D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477025, "uuid": "f986ac40-c5c1-4fff-967b-ebab4a2b3e1c", "value": "1536:yJ3rpa+M4MP65AESTApJBtMjB1qNsjQ+nmZX7n+D:5uAESTIJ5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477025, "uuid": "f5279c1b-39e1-44f3-b827-3007401d8f09", "value": 114059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477025, "uuid": "c443e2e7-ff0c-4a9e-812d-6c76713bc204", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477025, "uuid": "8f5f2862-f27d-4a4e-935c-3aa19d946d4c", "value": "Z_Invoice_London_9789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85605e6a-1f43-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773451028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451028, "uuid": "96dde0dd-b759-40cb-b670-bc400bd44e3e", "comment": "Malware payload (Mirai)", "value": "9d4349885a8934ceab0f834231e2bd55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451028, "uuid": "93ec8568-ae5f-4a34-9e3e-58847d1f18cd", "comment": "Malware payload (Mirai)", "value": "98fd7a12e8cae6c6f5c7954d0962c6fa4124698325686598cc61afd92a5730e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451028, "uuid": "e1a200c2-005a-4b89-bde4-f32b6dd970ea", "comment": "Malware payload (Mirai)", "value": "1dab6b425b71cc98952ec808c04a57649be142a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451028, "uuid": "b6dbfbd3-c772-433e-8448-fce009befd32", "comment": "Malware payload (Mirai)", "value": "d52c6897e133b5579d626f5da82863420a52bc55b417106f02ccf3b6e2774fa07273c7fc4d7e65360f6b74fe901775ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451028, "uuid": "3bb9ff14-7b23-4a15-ac51-fed89762347e", "value": "T168934B92BD829A12C6C41277FA6E418D371213E8D2EF3217CD256F2537CA96F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451028, "uuid": "38e9fcdc-613b-4997-95a8-657fd9dfae6f", "value": "1536:+kxAf3fgCHY7UKDF7HKdSfCxn1NnMy/tyaaORiwZAArdOcpX+BBaoPOgpHopVwaa:+kK/fgeKlKUMv1yUkYAArEcN+BUdzSgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773451028, "uuid": "030d9d96-5788-4284-a3c7-467a3bfe4484", "value": 91276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773451028, "uuid": "179a8c66-0abf-4405-b6a7-db7e31ba8527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451028, "uuid": "35e95d0f-c422-4adb-9781-268f6dbdced4", "value": "SecuriteInfo.com.Linux.Mirai.9774.17803.31943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8a233d-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495251, "uuid": "3e420ff5-059c-4403-ade0-07b3753b2c57", "comment": "Malware payload (Mirai)", "value": "ffccfbebb10c5422bcbc3076beb8f9b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495251, "uuid": "d58a68d3-1907-4489-967a-865f6a5e8399", "comment": "Malware payload (Mirai)", "value": "994da36c2ed213e789e1719bb6ace87331f2a3d95a3bf705690e0d1ce471e270", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495251, "uuid": "fb74b3b8-fdaf-431b-92d1-b6786e71deb8", "comment": "Malware payload (Mirai)", "value": "16212517acd35f9b23061a0c9e1fe031bdb5f7d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495251, "uuid": "dee1176e-a66a-4127-801c-a592a68cc750", "comment": "Malware payload (Mirai)", "value": "8c925a369e036a7ad49d4afc03611d3dc5c581cdbd76aae34f4d8715f6ece36786da968b4138961208e1bb9424e5ef18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495251, "uuid": "fa9ccffa-da9b-474e-8731-862028daba13", "value": "T1CAD02BC614A200715EA48EBBA0B0C4D5B2C43083E8C0CA54F489F95F0DECF68F976711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495251, "uuid": "e7caeda1-fee9-403e-b6d8-7128fa2f267c", "value": "6:h9OnFfljMo/9AJ+pUtsAMr70X+XOYGxjVhFd/XOYGxjF3U:WDAJ+uA70AGpTFdpGpF3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495251, "uuid": "df819914-e20f-4988-a5a4-de536de30c56", "value": 290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495251, "uuid": "ff04c00b-95af-41f9-bdc9-3339509536cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495251, "uuid": "e9bd5c72-463d-44fb-b527-5f7bfab8189e", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79746a3e-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495246, "uuid": "acddd8a1-3305-4f8f-b836-ba10b3f82d7a", "comment": "Malware payload (Mirai)", "value": "26a26bfec9daa2154ade4f3aabce164e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495246, "uuid": "f4086aea-8b3b-4b07-813c-aeea2f88674d", "comment": "Malware payload (Mirai)", "value": "996278781064f99855801d9651575a5c329a52d88c4836eb0f7055d7e41c2c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495246, "uuid": "0e61740f-4c17-430c-81fd-c6af56a086cd", "comment": "Malware payload (Mirai)", "value": "6b5066d3d82bec2d8f5adb70bb66df38e1b7c0dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495246, "uuid": "7bd33e45-51ba-4971-ad89-61d7e30efd3c", "comment": "Malware payload (Mirai)", "value": "c660b76efcc1b8f864aa15a630d64e64677ee2d85a8c44bac169bba518734c0c7c8cc5908cb2cdfd5f4c263299c2ef22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495246, "uuid": "97a79fe1-212b-48f7-8b65-47a52a092908", "value": "T18D932A97F801DE7EF80BE3BA44A309157A30BB614D530B66A666FDD3AD320D4B912F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495246, "uuid": "6fbd746c-0a6c-4f95-aca9-183940907e38", "value": "1536:RoB2XnUrvjJbETUH3Zn8NBl5BfVYerf9RvjblND8wJqbsdeRo:mB2Xn+vVgYH3ZIVVNrlRD8wJqgdeRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495246, "uuid": "0aa1f961-6dd1-4a27-81f3-1b4b2748c5a0", "value": 92544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495246, "uuid": "08a3c3dc-9a8e-4e11-8ec1-17ed81c74980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495246, "uuid": "ed49a091-543b-4a02-a969-e0c38784be32", "value": "xfr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cc2519-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773505258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505258, "uuid": "521d97e6-e9d6-457e-a98f-ce8c84460cac", "comment": "Malware payload", "value": "b249838af7138d5716768d704410e0d8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505258, "uuid": "ead503a6-1cd6-4211-ae5b-dc3a856d4e47", "comment": "Malware payload", "value": "9a05ba3ffd6e1fff62812f72edc1b6b969022be5fcd29f67803f9319966f9d43", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505258, "uuid": "e928108c-b321-4b4a-9052-09793a4f1492", "comment": "Malware payload", "value": "08880d1bfd1d81cf4ff67c372aee96debb251d54", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505258, "uuid": "14d6ca16-2b15-49a6-824b-9c72afaab4d0", "comment": "Malware payload", "value": "ca5715c628124056540c8fc34dc06e371d7b188254b5ef7f4417246103a53b4206fc22644c6151d5222ccc59da3a3823", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505258, "uuid": "2146a406-66e9-4deb-8570-ba475969f37c", "value": "T1706422756FB77CA910FB11AC954DEA4AA2B4961300C87DE4737C89CB6784F64C36B42C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505258, "uuid": "0ec5da2c-9164-46f5-a9e3-5f4a551210e1", "value": "6144:Y2rRYss7J+sNv+KnFBAXR2uWmCJnp4Pr4DtZHhlAHpp0n0:R/ZsdFeCJnGPcZZH6w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505258, "uuid": "ecdf13d8-7649-47c4-9350-d62dc25824cb", "value": 321134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505258, "uuid": "2fada05c-1abc-4426-9d9d-eb1fe47c646b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505258, "uuid": "256fb86c-8037-4f08-bcfc-99402e9f4c78", "value": "9a05ba3ffd6e1fff62812f72edc1b6b969022be5fcd29f67803f9319966f9d43.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce26209f-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515145, "uuid": "e4aa09dd-0c6f-436b-a921-79eae9068467", "comment": "Malware payload", "value": "54392bc641d8a474961a836f7ae831e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515145, "uuid": "7be25faf-1b0d-4a26-b8bd-c0b7216d1ea9", "comment": "Malware payload", "value": "9a3915ee1e114333bd5bb354f7f304767160350cee80ab76108dd01a825b2872", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515145, "uuid": "17c498fe-58d4-477d-85b2-3ec46cb38085", "comment": "Malware payload", "value": "7f0f0ff7c7ef0ee0776ff73b0757a0ce835b30aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515145, "uuid": "c490a536-7394-4fee-ba7c-2bc17eb0f224", "comment": "Malware payload", "value": "98e0c71f8f231f727d252c746e92658e7ae289d1db08d27dda1db23519d9c5d9704a69274f91446afee559ac12b97665", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515145, "uuid": "72b84a7c-101c-402b-b82e-080b1166903d", "value": "T13506A001D6D17F7C86A1132D72E669C863AC4FCAC8DBB61C1112BEDDA5BE9CC516322C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515145, "uuid": "cebc1cde-98f3-4522-908b-7215955544c6", "value": "24576:kSPflbVyg1it5W7zGvaInfqF8iQ4X6+TQOYFnPkHnfDAZfvgCrpvlpYRXwB19ZH0:vhH0lZrXPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515145, "uuid": "a5839f38-c93e-4bff-9145-eb096d625b50", "value": 3889978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515145, "uuid": "52cf1a4b-a829-4932-87b2-e142bc6305ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515145, "uuid": "febc732c-6975-461f-9fe6-b306642b83e8", "value": "54392bc641d8a474961a836f7ae831e7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8701312b-1f43-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773451031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451031, "uuid": "f6a03ee9-c7f4-4b0f-a969-81c0bcca79d2", "comment": "Malware payload (ACRStealer)", "value": "ffd083782ba94dfc9f4d8f81792afdcb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451031, "uuid": "96e9989e-0ed5-428b-a6f4-ead48ae4d378", "comment": "Malware payload (ACRStealer)", "value": "9a7713402574ce6bf71f7ff98785207c63d7bf921b36b62a2e2c2221dd4fd84f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451031, "uuid": "e1bb2469-d7ad-44b5-9be8-b74664ae5f21", "comment": "Malware payload (ACRStealer)", "value": "9d7daa1349454c9cf89693ce9dcc12e19bc3112f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451031, "uuid": "200a4a09-1277-4bae-9a12-df91c2c81ecb", "comment": "Malware payload (ACRStealer)", "value": "13c27fd85cfafcc41f2df4662384b2ef569a31bb7e0ce64df3101a533cdb90960158013cc9ea8116cab483af4ae44ada", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451031, "uuid": "e4dcedc9-9ff4-4483-be5b-905d49f0d5db", "value": "T140C52985958705F2F61B6F31495AAF1FBB3E59144F20C6EB82A03EFA6D337D21439620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451031, "uuid": "fe4bbbbd-6ecd-4e12-beae-f9eb43a5a9d0", "value": "ea59783aa568b4d78d564651e646f2b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451031, "uuid": "9d52c330-1f4a-44e2-a04a-55fd3a4cb51a", "value": "24576:PjwHaXvd+/KL9A0YHs3I1ZAPxZhK8VVHtxpY0b/hygxGqBqjgwOcm+bqdhQflh6Q:r3I1ZUjP/HWINxmZn64iDxo0uY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773451031, "uuid": "cec9c28f-095f-4393-bb50-1f6bf42f450f", "value": 2626048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773451031, "uuid": "93f96bdb-28a3-4f80-86df-8eb8625e2318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451031, "uuid": "85b8f980-174f-49b4-a30b-6045e0352433", "value": "SecuriteInfo.com.Win32.MalwareX-gen.74838772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801f4961-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773501700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501700, "uuid": "368096df-9287-4390-9ec5-12140b60adc1", "comment": "Malware payload (ACRStealer)", "value": "3f55271688a012ae24eb2423c0aefb2a", "object_relation": "md5", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501700, "uuid": "8e3ab71f-7f1f-4c8b-8031-41da1abf4a68", "comment": "Malware payload (ACRStealer)", "value": "9a7fb7b97b9a26d8239ea4f883a7dd0858ed65a9f234c0b9e0b6cc9c78fabfc5", "object_relation": "sha256", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501700, "uuid": "81586c96-6cb0-4372-b15b-b885e280544a", "comment": "Malware payload (ACRStealer)", "value": "07b426cc356eda4999498cf2f2682631f258dab8", "object_relation": "sha1", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501700, "uuid": "aab638fe-d67a-4305-8883-066f94b865db", "comment": "Malware payload (ACRStealer)", "value": "c7eaf2adcb95567ad54857e6990f630f6fcf5f0653a74c31418530ef664ea152a0821d22877c6b10967e77454c9aeb20", "object_relation": "sha3-384", "Tag": [ { "name": "45-89-60-4", "colour": "#31423F", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501700, "uuid": "b44fe65c-b71f-45a5-9f33-67795fc6be28", "value": "T16CA6AE21B3A54469D9F980B5806B4A37E73E3C002331D9C390507D9D5E7B3E35AFABA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501700, "uuid": "5888f3dd-0da0-48e8-808b-0c9f45a746e2", "value": "bf3ffd977d02b78c1688e06aef113cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501700, "uuid": "d298e9ef-e96a-4d1d-bac3-44d0ffc5f995", "value": "98304:rgBaHwnTAQsSbh0+fSJcUEri5HdjL0V0HZMaJV9zUKq/wyU2HyyLm2RJu:WhTAQJCnyamKq/wViyn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501700, "uuid": "13235325-65a2-468f-9a8b-3b3894663443", "value": 9820160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501700, "uuid": "59631270-0112-44ff-ac5b-bc3d392e2f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501700, "uuid": "c9170841-05f6-43b6-b25a-abb0addf0a3f", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9295c7-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491498, "uuid": "293b7405-feb5-44e9-bf3d-90f3fa5f841a", "comment": "Malware payload (Mirai)", "value": "011bb83094063035c74afd590d7fd986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rv64", "colour": "#998A59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491498, "uuid": "ed660439-91cc-4492-891f-bb1cdeb7c742", "comment": "Malware payload (Mirai)", "value": "9a85d41a342c86f7db587d279eaded7170e275077934915ad5358dc1329313df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rv64", "colour": "#998A59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491498, "uuid": "d13c8c98-b2ee-447d-8192-fe565f7017ba", "comment": "Malware payload (Mirai)", "value": "2e3264f07ab14585a708a4545a5b8610dc62987e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rv64", "colour": "#998A59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491498, "uuid": "4a9ad0c4-a291-46bc-bc63-fa8f5ad33e11", "comment": "Malware payload (Mirai)", "value": "9b39341478508d605c97159cdb5be1d1e06394fb3af0bf0fa7eca0993515f7e6ccbe2ab654f3d82aab9f0a42b96a1555", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rv64", "colour": "#998A59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491498, "uuid": "00fd121b-445f-45a9-8980-4e3ff3771304", "value": "T1FCB4D069AA1A6B0AC05B86B080CAE5387367F4011B42B341B941FA7D7C55279CF3F7F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491498, "uuid": "fa7371ec-1768-4af8-b8f3-3a1cab023c99", "value": "12288:hr/Ake7wxS+ThsWUoqgZr0ZOhgDRss52QGca:hr//hsWTqg90ZOhgDRNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491498, "uuid": "64c71644-348c-401b-833a-fb906a4e4e92", "value": 519640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491498, "uuid": "73ad02e0-b237-4569-9cd4-87c68d6d1020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491498, "uuid": "2e06e241-3351-45c6-90c6-e95088d7cd96", "value": "bot.rv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd081f1-1fe2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773519383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773519383, "uuid": "9fbfdf7c-f6a5-4e5b-9cec-fc254ab9aee8", "comment": "Malware payload", "value": "6441aaa80cd62852eeb419c32ceb2fac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773519383, "uuid": "78fd6a59-c62b-47eb-a66e-56642d2946b0", "comment": "Malware payload", "value": "9aab893007c7dc97f98539b4a468bd978a6db7dff17a28fa9173e42252e8be55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773519383, "uuid": "c760ec1a-71ac-4d6f-8975-e80d022b43d6", "comment": "Malware payload", "value": "3812c167aa0e6763eb8570a5a7677b9daddc7a86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773519383, "uuid": "a8f5be1e-3686-402d-a5ff-e01247345139", "comment": "Malware payload", "value": "02b546411a9763051d2ee5258c34c027abebb1857a1ccaa9af67e1c4ebe255f96c4b8848e0fe0d76c13f3be83e2cfe04", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773519383, "uuid": "3884d9dd-b395-4492-9889-1bbd474fafc4", "value": "T138925CA916496C79BBC0DE7D9F3C7F0CADE4C1C02218A39CBA4F39714A2469DDA0635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773519383, "uuid": "c6041b5c-10f8-41cc-8d61-e75c658e6d40", "value": "384:ws0M3vgRjGlsaq7xzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:wWmjfNzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773519383, "uuid": "9e9dee80-544a-48eb-8d59-0de98c11280e", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773519383, "uuid": "bfe92e23-56f9-4fc7-8b3b-22e1ee5c4494", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773519383, "uuid": "e8f87045-867b-415a-a0b5-145ab6cd4034", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc211e1-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501880, "uuid": "d27b6c99-fc3c-4ea5-ac5f-72ddeef66fc2", "comment": "Malware payload", "value": "b57338d033d9e084c45f31d8769198f0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501880, "uuid": "c078ceb4-2af3-4b07-87b5-536f609fd214", "comment": "Malware payload", "value": "9bbb7f50c11bd0645a7faaf5c3ee66ccf45599b2120c91adbd2da22988dc417b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501880, "uuid": "9e411591-e783-462e-afa9-33f575a44c70", "comment": "Malware payload", "value": "91ad24c1be5cd2e0d6d04ead7737ab6b79d59377", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501880, "uuid": "7d3e3f89-17a1-4aef-9429-f690bc067f95", "comment": "Malware payload", "value": "1afc3d747213b8f0472da61bf05101e88dff14a0c23af47cf002f8073d8247383a8bf9c41bce20e10608cae37a44d9fd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Cloudflare", "colour": "#A5C9BF", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501880, "uuid": "aec23b0c-6900-4d86-a65a-ec8b50a4390d", "value": "T187A19A3084D5493742B3C0C86862BB99FAE28207C786572636FD57936FF7D96EE23148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501880, "uuid": "f3d58e76-fa4b-4bb6-95ce-0fd1a3ac9982", "value": "96:siM4888eW3vbDBFdVV888rhuCfG0UiEoN6bJKu/:svCf3UiEmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501880, "uuid": "5320591d-66f3-4817-8de8-8d08ee2c56c5", "value": 4716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501880, "uuid": "87973c1c-e00c-4055-ab1c-1d2604982971", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501880, "uuid": "a91c5acc-dabf-4f76-b1a6-444211ae5fa3", "value": "storagedev_clickfix.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c85e416-1fd5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773513720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513720, "uuid": "863c252d-ea41-4afd-8216-3026b219f480", "comment": "Malware payload (ValleyRAT)", "value": "cda87ef89094b80a2e2e569cee896aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513720, "uuid": "27dc8ec7-c3c4-4d3e-9554-31f071b9994c", "comment": "Malware payload (ValleyRAT)", "value": "9c36c34fb6c1bd7af0f8c75ce999cb36a46b90789aca21d0a23167c1db468883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513720, "uuid": "92064deb-b7dc-49fd-a6e1-aaed8cc309e8", "comment": "Malware payload (ValleyRAT)", "value": "9892f199ce598a6a97c76e21a17ade4ff36aa2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513720, "uuid": "489ef96c-4727-43bf-86d0-bbf51b4e2b9e", "comment": "Malware payload (ValleyRAT)", "value": "e773ae80c23339e4b0e45cb5af2f9c574b2bb3d0f5bd92cbd951892f91419ef2ed933e2f312f382173ebb489766dee2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513720, "uuid": "29b4ad08-5959-4137-b770-00f42a297ffe", "value": "T187145A5B76E524FAE4778238C9630A09D772B8311A619F6F03A4425A1F277E18D3EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513720, "uuid": "25014511-c902-4e74-8322-fbd7aff81bdf", "value": "a1a4641d6b4970187d1b8fe0458cc65b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513720, "uuid": "30c22e63-1209-432a-bf1e-0b970d853f17", "value": "3072:aQpMtCZJTSyr/8GfzXwHkRM2UFRvMHQSayWKQA7poduBdRF+QMi6v10zk:afIl/USzXdwRKQi+du/+041/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513720, "uuid": "edc3bc89-bf39-4b8e-b32e-9f5a71ce026c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513720, "uuid": "be8d89da-4cd6-4283-bfe3-b83863a6ec33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513720, "uuid": "737cc8ab-0a9d-455b-9d0c-d69e67f0178e", "value": "150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135e08ac-1f92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773484767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484767, "uuid": "ee8c0b3f-7d1b-4531-8a67-91c242ae473e", "comment": "Malware payload", "value": "000188e40eea847f583d685b601b55a6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484767, "uuid": "ef8cf234-b9de-44e7-9a50-c36d2a061777", "comment": "Malware payload", "value": "9c40590bbd54432d363dad79fc3e31bab5ef91cb0eab90c9cde12183699bc01d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484767, "uuid": "c3f173a9-1cd2-47c0-ae68-1b9c8b329703", "comment": "Malware payload", "value": "27e8d5815e68e2c630bc9d880984a0d298df0b49", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484767, "uuid": "12d89aa5-faa9-4ffd-b1af-e7b0b3ab8862", "comment": "Malware payload", "value": "48c4a49ecdf25c7a1cd2d49508372b0cab61046bc9256998623496b16852b937fcb80570440f0e555c874be998da919d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484767, "uuid": "01f25c85-a5a9-4f99-bdb3-add068ac2b9e", "value": "T17D77336CEDB6E84B64375536EDB085019BA544340A8BDF3E12F0DF36F1EB2CD98548A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484767, "uuid": "b3fd2cb0-5e0f-480e-a1ac-2c5ad8622339", "value": "786432:iUXnLIIIO8ezrDyd6SDguz0uH3VNqwuzQb8Xr11hJZ+:9A+DydTguguXVNqXcbAhJZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773484767, "uuid": "2587bb2d-f0e7-4546-9192-c92f7acc75ec", "value": 33753340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773484767, "uuid": "5a4f377d-8166-478e-8194-0dac8ea61aca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484767, "uuid": "7db301e5-288e-4b94-ab0f-b9f8d6fffe03", "value": "cherry111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fbe22e-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495261, "uuid": "3d6c0d29-8cb7-473d-94d2-6cea4811e4fd", "comment": "Malware payload (Mirai)", "value": "cbaca177a43aa52c8669819c1cbdf7f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495261, "uuid": "db06c792-341e-4c08-900a-fb505f75b282", "comment": "Malware payload (Mirai)", "value": "9c7a5d94fd9a84ba53e888b027da6aedc0b8c6dfeed2eee5ebcd9bbcf29d5874", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495261, "uuid": "a18fa051-22b3-4acf-8397-eefb7a4bf00b", "comment": "Malware payload (Mirai)", "value": "acfce61750bd28d49be94efd72b062eb36357a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495261, "uuid": "851720c7-1598-4b3a-8e0c-8c34b1aa8b2f", "comment": "Malware payload (Mirai)", "value": "78c8896f19826eaa7bc34d0a7283f1dc7c5c7325964b1ee8f32fdab4b79e3078052895efbda4865b4880e49f93e4a093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495261, "uuid": "7a10b3d7-cf1f-4ee9-b7e2-3254b9ac305e", "value": "T1DAA32A46B9419F02D4D621FAFAAE418933136BBCE3EE7111CD20AF5127CA99B0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495261, "uuid": "189fa1f3-3200-401e-8a9e-b771decc99dd", "value": "3072:1Q9YTsJbascZa2R1uZXx8YeDedrqBA4Tzqu:1eYqIZa2R1uZB8BeBqHGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495261, "uuid": "d1149068-b292-4b92-ae72-ac4a30c4a979", "value": 105092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495261, "uuid": "edee6e8b-18bb-4221-badb-6d97dd1dab7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495261, "uuid": "f0b6a996-176b-46ea-948e-44a201b9d029", "value": "byte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40de7a7-1f64-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773465280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465280, "uuid": "02cfde72-ea4f-40f6-b309-506ae0ede811", "comment": "Malware payload (Mirai)", "value": "5d026dbd04224d86a83e22845072cfcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465280, "uuid": "c3a76596-b358-4587-8649-ff9751c1d976", "comment": "Malware payload (Mirai)", "value": "9c9f9d632b2ef6b946ea84e52cb86431093372ab4699869db5f0941ec1fe93d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465280, "uuid": "ec4d7716-0f41-4da3-87f5-e09bb81ec360", "comment": "Malware payload (Mirai)", "value": "117f26d973cd6508c181a74e60744f9cfa4e766e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773465280, "uuid": "60fa1bae-107f-437c-a919-10385ff0bf0e", "comment": "Malware payload (Mirai)", "value": "6976f0ad21cf21d89c159c1fd95f787fac8dd5fb81537bae01fc89ee74bd9ebf53680c331525b48e8ca71f143e358bb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773465280, "uuid": "6edbdf4c-751d-44ea-8812-5125c570f149", "value": "T14A923B82E983D8F4E86249F11836EF66DA32E13D5444F647E3795672B5C3800C6B77AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773465280, "uuid": "ada77bda-ef00-4cbb-ba8f-b6fa5fec23d2", "value": "384:fU9gq6EzApfwHiMwrc1h9Lm7u79/LXpVli:i6QefdXrcFm709/LpVli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773465280, "uuid": "5f75ce63-e98c-4ead-adb2-cb8e94ef423a", "value": 19856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773465280, "uuid": "36bd83b9-be9c-4e3b-a20a-b9c75afda4d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773465280, "uuid": "08bdcdca-2e93-45fc-826b-cdd2f38fc069", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaefb14-1f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773479599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479599, "uuid": "02396ec6-fdca-4b4e-a95a-e767349b4638", "comment": "Malware payload", "value": "58e59a139bb92b3097890a4d0bf83de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479599, "uuid": "30263287-3c87-4877-b26b-1a983de535f6", "comment": "Malware payload", "value": "9cc8753d2058c1fb0e92b681caed05cbe404f64f5fd084fbed18763a27c96782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479599, "uuid": "b1335a1d-acfe-4974-bbf5-33b6b8fea2bf", "comment": "Malware payload", "value": "48f0e0cab76b888fb5cf6032661ddfc2d0dbce26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479599, "uuid": "b1e4df1f-70c5-4977-9010-5ade5230416b", "comment": "Malware payload", "value": "866ac1dc70431b24eeb1fa9db02a8760d9b703e5c905c0bfa53e5956aea310fc2de305790551393c2e911e435bda9b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479599, "uuid": "3cfa36eb-8b92-4250-b12a-224a5c4054a1", "value": "T181F2E646BA828E16C4C55575FE0E218D7713473CE3EE6322DE246FA9278F5B70B3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479599, "uuid": "9f73a8d3-d42e-426a-8f2a-fe831ab0447a", "value": "768:SRnZgZUsNW3XQjh1tnVVfSsoD7mboFIEVFGidNbiDKqEPSrVf2/A:SRnqZUlXQjhPnVQso2KIFidNODKqEn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479599, "uuid": "4bffc7bf-d0eb-4d44-9de1-bf6a52a177e0", "value": 36404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479599, "uuid": "a89944da-ef84-4bee-a662-a91e7d8a2cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479599, "uuid": "46788702-8bc6-4aa4-86f3-b57f4239725b", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce038a9-1f93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773485588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485588, "uuid": "16a418ac-f187-4346-8a8f-d935418cfe51", "comment": "Malware payload", "value": "fb02860dc69a5c45386c32d51a5b22a0", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485588, "uuid": "e68f1b10-2ad0-4474-9953-c68108dafa9d", "comment": "Malware payload", "value": "9e77fb4859148b5e850c283349f47353bff3dbf69d334a1bc09826ca76f8bcff", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485588, "uuid": "12c15a9c-fe0f-4970-b819-51ca72856364", "comment": "Malware payload", "value": "50b69f293a487c8bb29a6acf6e24b0aed92b6c33", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485588, "uuid": "291ca80a-0683-468b-b3bc-c37a1dbb48cc", "comment": "Malware payload", "value": "97f649e92fba4ee87ef82b4c29d7ae293037dd0146ee93c908487e77af69f00137dd107da620aa8ea16e8efc39259e0e", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485588, "uuid": "b7dcf93e-6c65-4712-a797-21c1fb318dc4", "value": "T13C083313ABB35091E018AFF65E4169391833614D9E396FCE23CF609ED81CA5FD182D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485588, "uuid": "ecd98326-3a72-4418-8760-c765eb303316", "value": "1572864:SZKUAOlTkVFd60xG/vJKwP9xkWhRxfKySCTPe2+5ng/446hkxjE+xK9GJk0AFO:SQUtNkTJG/vJtlxkcNTPe1+grojEeKwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773485588, "uuid": "92a0e1b6-b278-4c48-b922-9fe814a51104", "value": 79981336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773485588, "uuid": "50bd8561-915f-48ca-8a63-acc3ba5f3eed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485588, "uuid": "e19c5581-d22a-4381-b6ca-73912e411b4f", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbb0aee-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773501830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501830, "uuid": "51c4d252-fac7-40ad-8d4a-d6786757cf56", "comment": "Malware payload (ACRStealer)", "value": "43cfe8c8eb8dd91853d7e16b4b633aa4", "object_relation": "md5", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501830, "uuid": "64ceb813-e918-4971-bf9f-0ff38d13a6f2", "comment": "Malware payload (ACRStealer)", "value": "a093d65d2fa1ea4ed7c35fae7db8ea7d80a764c7e59b72480e7c77f041e6b5f6", "object_relation": "sha256", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501830, "uuid": "3ff6b29d-727e-44f4-af87-86b801852c94", "comment": "Malware payload (ACRStealer)", "value": "10e9ba5759a7b6d634131dcfaa82d1bc5166290b", "object_relation": "sha1", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501830, "uuid": "7d7d0ff9-1e1d-43b3-b0df-4b5135d1f797", "comment": "Malware payload (ACRStealer)", "value": "95c25166afcb854ad23314cc9fb806c29aedd6c35374cafd27d79b9e7285a5a638ffbf4902cc97438887cbb4944b62bb", "object_relation": "sha3-384", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501830, "uuid": "ca184b18-9ad6-4485-9460-98de535d2642", "value": "T121A5239E723605F4EBED84B92B95070B57D28734CE2E27554A7C14AE3E35A8A4C8DC0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501830, "uuid": "a21f4e44-1f24-4437-9855-7338035e9eeb", "value": "49152:zZVZwvojaFmlwXaLrRYkT0fZThLV/CgquxLHxH:HhaFomKL2nV/CWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501830, "uuid": "118440b3-9455-4a03-9c8f-79059a6f26cf", "value": 2167133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501830, "uuid": "aecc85aa-2cda-4574-8099-a7ae182bf299", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501830, "uuid": "0f481418-c38d-4ec1-adb1-cb4c86cbccb2", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af9d7fa-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493960, "uuid": "7036335f-10aa-42f8-8c7c-f8716d524814", "comment": "Malware payload (Mirai)", "value": "092cc521f93c0165e0a74da5b87b5f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493960, "uuid": "baa50369-5d30-4cd4-9988-b2c4388db94a", "comment": "Malware payload (Mirai)", "value": "a1027d3fc1ec9d9e73bb2fdedd53f105e00f2626f89ee2cebfaaa92c2beb589c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493960, "uuid": "3641a5bb-b65a-49dd-b74a-a99b1bb03cdd", "comment": "Malware payload (Mirai)", "value": "3d7cb37d8d8b1426be1d39be0e8e8df9bcb87a19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493960, "uuid": "bded80f0-bcd9-4b08-b4a6-bb40973f99ab", "comment": "Malware payload (Mirai)", "value": "83c22d87f3cbb083ad53e1d49a03052caae8c14ce2e96f29bd7972f52d0765ca2aebf581a9ee76ee3499d1d9e8b5412e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493960, "uuid": "854945de-88d5-4058-90dd-bd84a5cfc31d", "value": "T1541329D2B8C29B37C1E0127AE56E805D3325A7E8D2CFB717CA156B417A8A41F4D77B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493960, "uuid": "a5176e98-deab-43d2-9b95-761557405a99", "value": "768:fJlaRQ8XJe0q0QZWHsdzstNgMZeijbjz+yyYlMGWowq71dUx:fa/Xs09QWNgeRTbyY3w61d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493960, "uuid": "230b806c-3e01-4a58-89a6-7d3e6bb8e4d2", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493960, "uuid": "78416303-d7ee-4bd4-938e-036ddb1007e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493960, "uuid": "2d213332-82b5-478d-adee-ee1526d3eafb", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910b96de-1f97-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773487125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773487125, "uuid": "68a6930a-30be-4c2e-8a03-b489028a75b0", "comment": "Malware payload (XWorm)", "value": "ff5c611463af78b7855f8ab8726c1005", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773487125, "uuid": "da90ab63-c123-4f18-80fa-fe2677d82089", "comment": "Malware payload (XWorm)", "value": "a2706690a0d1edafb871e84f1018789f65a85c0423b9f895aa2e135136213769", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773487125, "uuid": "20aad400-707f-4f0b-b919-46376bc43765", "comment": "Malware payload (XWorm)", "value": "4cf8c9546035c62dd9eff43ebc531a92336d116c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773487125, "uuid": "076badad-c832-409d-a6bf-e65cb68a036c", "comment": "Malware payload (XWorm)", "value": "2782a2f6d629df1f55949f790789516be8e6aef1c9a1179320bb2404c7076a62552073d7073391c00b5a1ccf2bd8b5fc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773487125, "uuid": "9df7cf3a-bfb1-4391-a02b-2584ca538d27", "value": "T190F4499FFA505C93C778DA3EB167650F633CE6AAEF06D72701A837E4CE221444AC5846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773487125, "uuid": "51dc7627-f5aa-4dbf-82c5-3e7292032edc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773487125, "uuid": "ccbc58f0-e321-43fb-91e9-371184e7a5a1", "value": "12288:5exkxV+Ea4mDEQvUGOWxu5RXNAiUaCMM93VU4uGYAadpY:0E1l8RORPXezaCMMl+Fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773487125, "uuid": "539a65f3-c911-4b8a-a3e8-9e1425e11994", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773487125, "uuid": "c274d05d-8718-4bb1-bec2-dae1b02a5116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773487125, "uuid": "def8cef2-2877-4066-b172-7f7787ba7203", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b464aa5-1fbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773502497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502497, "uuid": "e47e7bdf-7e45-4b2c-b7b8-83b77eeb9e6f", "comment": "Malware payload (Vidar)", "value": "ddd64e52152e09be173a1a67822301d1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "pw-5741", "colour": "#0D3C5B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502497, "uuid": "5c32c2b7-6e5d-4a4b-a5c5-954e985d5a07", "comment": "Malware payload (Vidar)", "value": "a29d951f2f5a890151e324f43ac48068683e00e3e83c64da17522773a1c42696", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "pw-5741", "colour": "#0D3C5B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502497, "uuid": "d3ac4e29-4ed6-4f69-8826-65b2ab5d4f1c", "comment": "Malware payload (Vidar)", "value": "f37501128b2afa8e8d1675e794e9b6e71641cab2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "pw-5741", "colour": "#0D3C5B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502497, "uuid": "58e5b089-5a22-4845-a0be-20927b99e8b0", "comment": "Malware payload (Vidar)", "value": "a59095a7489fda2ebb349078fd0be1c53d15a5a50b023d42f72bf32501e86ab1294a597ba94429ef3d6d4cf87470a7f6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "pw-5741", "colour": "#0D3C5B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502497, "uuid": "1380b26a-b4b1-412a-832a-2385caaee2ea", "value": "T11A07339E55BD7E6995EA1A683FB5DD4BF932E1000C475C6E0E0C3A907B2C0E89771B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502497, "uuid": "25e716d9-4990-44df-ba5f-da9b906027fb", "value": "393216:8v+Ai7C6Aw2ETF8/Rtm3yLyztS12lrjZ0DE/OjRSxFieI:wRhw2ETF8/IyLV2rWjRSxFpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502497, "uuid": "f06407cd-4028-4908-a0e8-46d1a0dbf684", "value": 17335379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502497, "uuid": "eafb74b3-4236-4e76-8ff7-6d7fd69514f3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502497, "uuid": "c8690ccd-e67f-49b0-a043-e595f9f01636", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48ed91e-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491507, "uuid": "ebace761-1d4f-4479-9b9b-d74d36acfe78", "comment": "Malware payload (Mirai)", "value": "43476659257839cc1adf7287a68f82e3", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491507, "uuid": "f52bef84-9c0c-4612-abac-c1fae4d3b125", "comment": "Malware payload (Mirai)", "value": "a2a3300af126adc7eff255007f5c294488a25aef2d6cb2d9f0429ded3428eca5", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491507, "uuid": "737122ad-f45f-4712-bed5-c5b855a376d5", "comment": "Malware payload (Mirai)", "value": "478a02dd2883fa65bac7f5c0f8ac8dbc4f4556fa", "object_relation": "sha1", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491507, "uuid": "36f304cd-c9ca-4316-8845-4d765ac331a7", "comment": "Malware payload (Mirai)", "value": "4cd39fb9bc1ad686decad443a00ae3db38b23914c9a3fccedc77b3a6f88cddf8535926b6cee6255ef5a9e10ad726a501", "object_relation": "sha3-384", "Tag": [ { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491507, "uuid": "81a83568-7c7d-4299-843f-d468026f3dc3", "value": "T16AD43955F8809F61C6C539B6F75D42A873074B79D3EB72069A244B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491507, "uuid": "d561c24f-880c-4404-8fb4-432cace60ccc", "value": "12288:A1uqGAKhdZmLnyLEyX587vrFmkWHbKOH+kAYkx8pZuNj6:xqGAKQLKbXi7vrFTW7KtTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491507, "uuid": "dc7eee48-177d-4ae7-b875-5d3d079484eb", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491507, "uuid": "10c2726f-d7bd-424f-87e0-72bd6ea50ad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491507, "uuid": "7437075a-d8e7-4d54-a59f-5e4c5e7ec6dc", "value": "bot_opt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8412bd0f-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504284, "uuid": "93f82036-aad6-4f0e-98dd-e16b33f9412d", "comment": "Malware payload (Mirai)", "value": "ec8aa0f24f78133806ba30f679ec952c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504284, "uuid": "dcbf7111-91fa-4dbf-bf75-827a02adbd0e", "comment": "Malware payload (Mirai)", "value": "a2c2de4e3cd24dece7fae061225d51584195aa36e347f8e84ad2a42a7742b096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504284, "uuid": "6b49dc67-d18d-4e12-9b0c-81242ab9a719", "comment": "Malware payload (Mirai)", "value": "8cb9af2d8da281e88bb0cd9f67673fc156528996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504284, "uuid": "9d449690-2d5e-4496-8880-68ae30d8c147", "comment": "Malware payload (Mirai)", "value": "355348a8e0bfbf5227eaec69ebc1aaf3c22663c663c0d7ba570720f95c9dd22f1922eb1515f12094a560a22f32a448c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504284, "uuid": "e68e41cc-8595-4952-8ebe-f836981b983a", "value": "T159231A95B9419A17CAC20277FA4E47893F2663C8E3DE73039A266F2037D79270D6BD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504284, "uuid": "3e57beaf-44c6-4d3a-98eb-b6f0cdbece67", "value": "768:gDyY6wHgSkGEEhxRDsMkwB24aPUr4dVMh9v1w+QIu:YyCZkYnkw48roM9vu+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504284, "uuid": "b8cd477e-f759-44e1-a10c-7df642ffce90", "value": 47356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504284, "uuid": "9e3d87ae-9eb1-4804-9a73-92e1b2584335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504284, "uuid": "25b3f39c-ba01-4231-a967-846aa14d0610", "value": "wlan.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba158acf-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495355, "uuid": "10e8c499-e083-41f0-b413-7f1a2ad1cc32", "comment": "Malware payload (Mirai)", "value": "2ed30a660473eaa2933a08fec01eefd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495355, "uuid": "aa83ddf6-303c-4c02-b904-2373e36659e5", "comment": "Malware payload (Mirai)", "value": "a3aaa23b4e2a4af521694e0c0f024f2a6cb3a4b40bcf5e56f820de00e4379af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495355, "uuid": "4d5e2338-70f4-424c-8519-71df69c31661", "comment": "Malware payload (Mirai)", "value": "1d846e901ad98ab9db0c0c1d6c8009fb7756ffdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495355, "uuid": "b67f0b28-8f95-48b2-9423-4bb854e69cf3", "comment": "Malware payload (Mirai)", "value": "612456ae0cdacc83b56cb91f19c82d36ccb5c27ef15d0edec3fb4068fd2c59a43c2bdf57641c676a5ed5f346928a4fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495355, "uuid": "dc0fc5c8-0c41-4d1d-8f8c-c37125673973", "value": "T1D8634B42B31C0A47D4635DF4263F27E193AFA99120F4FA85650F9B8692B6E331186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495355, "uuid": "b7f9b842-b2f1-4b58-bf7a-ee3ae1883d8a", "value": "1536:LmalL/z0vzXfvIf5hnsfkbFOfXSAr8Yfz7GTU4IQLQ+8fByW585sFEh:5emyDL4IB+1pJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495355, "uuid": "cb3b858d-5239-430c-b5c2-585c25f463bf", "value": 71244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495355, "uuid": "72153e8f-527c-40b8-a653-5e808fdc19de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495355, "uuid": "3c481fc7-5404-4d56-a388-9e2984b800df", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fba37b6-1fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773505806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505806, "uuid": "8cde792d-bc70-4d00-b37d-261b8368bd9b", "comment": "Malware payload (ACRStealer)", "value": "9061b4c3fe5ca8e9d9398d7ab9796d99", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505806, "uuid": "b4822f19-6042-4e7a-816e-26a8a97915d4", "comment": "Malware payload (ACRStealer)", "value": "a422f723d2f1d3aa1638c789f86b355366ac86d31d96f1816a7469d1256df6e8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505806, "uuid": "475b1eb7-01ec-4437-8fcc-d927aea62fab", "comment": "Malware payload (ACRStealer)", "value": "303f48a8801b6ebeb6399ab9bfff24bca05ecddf", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505806, "uuid": "64c028f9-2c9f-404f-a733-9eafd8479acc", "comment": "Malware payload (ACRStealer)", "value": "7207f5fa32bdad85f08a19160b79fec5363fbcadb97c3fe42ed4036312709ea04169e677058680c0a5f63b81e77f2026", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505806, "uuid": "65794c93-ad30-4310-b5f0-46834d8ff197", "value": "T112C55B4B76DB05F5FB2B0838652ED65FD722F04C0B21C6EF42682D67A933BD2913A590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505806, "uuid": "fe0c5150-5b43-47d6-ae0a-9cadad0189e8", "value": "ac280283400548a9c4446017ed813f96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505806, "uuid": "f000706e-99f2-4ec3-9202-e1512fe079ae", "value": "24576:TvNfxL58rIReG12tqj4uqBVjLEoyqkRIJhTj0pWAr+NILwkRrUoLUBt5H/zDQZfR:Yh8WktFKtl/zDifJ6IZcuthShR1Kgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505806, "uuid": "781251e3-7538-4adb-befb-a71bb44c8d15", "value": 2657792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505806, "uuid": "5817bb0c-48f3-46f0-99cb-84d256940edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505806, "uuid": "c6dec576-6e47-4d04-a159-cf6e58979d40", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed50678-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486558, "uuid": "48de7ce6-9ccd-4152-857f-3e1eedd613c0", "comment": "Malware payload", "value": "d4c32dcd6ca90ccc83804a7c5b527a60", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486558, "uuid": "6cc249f8-29c9-48e7-97ac-476fcd480680", "comment": "Malware payload", "value": "a423f30728061653824099c464dc46199790c002562091a40471ea9828f1a25b", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486558, "uuid": "74124078-e9e4-4b76-987a-eddb540be01c", "comment": "Malware payload", "value": "41b536a1def6e15778faaf234da3d005ba67c0ef", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486558, "uuid": "13cf5b3d-2b1e-40d2-a2b3-4bc90a40f768", "comment": "Malware payload", "value": "2058d515db4e08810e1ccda4f3193f516484eac0c5610319fed46744b14353a51c6bfb6bacd6dabc9e243a6effda2c5f", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486558, "uuid": "b1a86368-105e-46d5-8c3e-2bbcad53cea5", "value": "T117F023380F3DF8C0430AB02051185ECA20903A07D7BD5E6FF822186B2C20389CF0F14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486558, "uuid": "63d8ff0e-797b-4bcc-8fb3-3ba0e94ef7ee", "value": "6:s8bloOVsukO6h+P6RKd8DCu17xwvb0kTZz0g6eMiNQhkac/VZgkznKqr/q16Ataa:s8hZGrO6hNp1dzRguua+ZgkzKq+P8p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486558, "uuid": "a9124657-56a5-4805-8288-3589b037d7b3", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486558, "uuid": "b6d3ffca-88e5-4330-8b0e-ddceb14c9c7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486558, "uuid": "dd5b16fa-7351-496e-9a9d-76f97ed2eaee", "value": "3ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e235637-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495254, "uuid": "0c19f919-3a27-429b-9fd3-5b43c69d171f", "comment": "Malware payload (Mirai)", "value": "aa62028562a38c322da93cc1e0751c3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495254, "uuid": "c9b73714-6ae6-4212-9b43-994304cfddf1", "comment": "Malware payload (Mirai)", "value": "a4413bb99e64323e33e28216ebf9bc3d5c2eff67db182346f4694d6a62d9ec16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495254, "uuid": "0334ac57-3bc3-4c8a-ac38-c665d33ac530", "comment": "Malware payload (Mirai)", "value": "80e5190e822dcc98e76b4548fd91b171837fa457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495254, "uuid": "5f94afe5-3bca-45cc-a7fb-dd561ed09dad", "comment": "Malware payload (Mirai)", "value": "0af618c7713d9fda1263337bae22b30a053ff081c191f01fbb73153084d6a389e8d9a503b3c9cbd02b73433747db6a6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495254, "uuid": "f56caa78-c00a-459a-a635-1f155f97fe42", "value": "T114833B52BD419F13C1D221FBFBAE018C3725ABA8D2EB3243D925BF9137864DA1D67211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495254, "uuid": "53123ade-1bb0-46bc-8bdc-babb18a33645", "value": "1536:JsVsCUPXLqwitIrx8IIk573jlJMwVx5CcKYj8vQl61d6Ocq9e:JsyCUPO+xMk57zlJXAfQ43Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495254, "uuid": "6ab7c0b1-0098-4126-b1c7-fa971a8cbb15", "value": 88616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495254, "uuid": "fda79303-62de-4499-aa65-6f9b35598df2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495254, "uuid": "116e6705-f31f-4602-941b-ca8fcd15fcfa", "value": "xfr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4396d6-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495253, "uuid": "f170a054-c04d-47f4-be2f-571396d057f2", "comment": "Malware payload (Mirai)", "value": "34c93f201c80d59dc5fcc611a4f27514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495253, "uuid": "f4228ce6-0c0e-44d0-ad9f-776bb7860d56", "comment": "Malware payload (Mirai)", "value": "a465a67b3431f3a62a5352189951a25a26c4b1862ec8e906a5957e2d0a269f3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495253, "uuid": "c5c04c3e-b3da-4198-b0f3-37b4820e4b66", "comment": "Malware payload (Mirai)", "value": "10197a17b986794101d9658bc6339c0454166e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495253, "uuid": "47c45991-9584-4419-a1c1-f4d909fdde6e", "comment": "Malware payload (Mirai)", "value": "de275c61001a27e00097434afb3d1b37eddae68ba7ba42537db771ea034d10fc36ba429ee4dee738a5550c0715158475", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495253, "uuid": "061eb5ed-c3dd-4e0f-98b3-25583667adf9", "value": "T189B31B56B9419F01D4D631BAFA6F408C33136BB8D3FA7112CD20AF55278A99B0FB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495253, "uuid": "ec65a4b5-a745-4b0e-b724-9ec10a9581e2", "value": "3072:EqD7YkTe0t4ed7aF9HyJTyON6bOC5Aqafsp408D:b7hTemBaF9HyJZN6JAHfo8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495253, "uuid": "023cd07f-598c-48df-b322-89c2e9b5d41b", "value": 109296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495253, "uuid": "6369feb6-a53f-496f-af8a-ad8fd5e318b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495253, "uuid": "2a01998d-5b44-4128-a7d8-30ddacf08712", "value": "xfr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc28fd4-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495225, "uuid": "9dd7c7f0-8e6a-4ed5-be5f-8c3ce1a5f2e7", "comment": "Malware payload (Mirai)", "value": "a252364e4ba0b7a37452c25aa4dbe4f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495225, "uuid": "a6619093-f094-4485-95f3-018757458f85", "comment": "Malware payload (Mirai)", "value": "a4fd245c9734fd840612f0c6cc219120a73443e3c1227db622bd38eace0e1f3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495225, "uuid": "ff8ff5ee-3211-4b7e-8eed-819738c948ce", "comment": "Malware payload (Mirai)", "value": "be692411962dca7d95eddc5d4ef62531697e0e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495225, "uuid": "3678d329-7bf4-44f9-9f41-ef88cfe26f2c", "comment": "Malware payload (Mirai)", "value": "a662f187fedd251f90db774deced9da352eef370e593f8de079a34023d44a0a315b5d0991fca8ab99ea4117e3f7c5fa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495225, "uuid": "da0ec7d7-2c8a-45e6-a7c6-2ad110feb26e", "value": "T1AE735B22BA751D2BC4D4A87A22F30721F2F2479B25AC8A1A7D710D8DBF31A5032477F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495225, "uuid": "6a6e6036-7717-4617-9d36-8f6b8e58328d", "value": "1536:mQMSZZm4fVFd9BPzyJrHQ7jtEeCNM5UeWzQSkWtgWG:DpzHzfjmpN8UeIjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495225, "uuid": "adaaf5a7-4fce-4d99-a2d5-3c9526531bbc", "value": 76448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495225, "uuid": "3965b291-7ede-454d-8288-d32e5b3e2911", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495225, "uuid": "408ef990-4c32-466b-8499-d9b4bd546946", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ffb8c5-1fb1-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773498111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498111, "uuid": "fb17bd61-2624-4ce7-9673-3451eca124be", "comment": "Malware payload (CountLoader)", "value": "58f149789d6a81dffda1fb51b1f45fa3", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498111, "uuid": "661b4aaf-3acc-4820-ad70-3a80a215b56c", "comment": "Malware payload (CountLoader)", "value": "a5ae0e606a415e811b36278b4bb5706bc6df75d321e2456d511c018892068df1", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498111, "uuid": "9882c0f8-16bd-41e8-934f-29ca49096f6f", "comment": "Malware payload (CountLoader)", "value": "6b562bf78e272666634202ac2299c5abbb9fe862", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498111, "uuid": "ff1a22ce-e12f-4301-bdf2-8cb255bce0f8", "comment": "Malware payload (CountLoader)", "value": "e9c5f2e8c8946c213677934e8162a3630fcae42c1490e404dd8f1016e71dabf12404e10f71410acf548779c289049912", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498111, "uuid": "34d2a9e6-ce00-451b-aaf0-8d0d1e076beb", "value": "T11AB3328B098E85EC9F9F70B845AEAE07DACE4213091DC59079DE6E453F51DF830B99E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498111, "uuid": "2971baa8-a822-4349-81e5-dd9daa0f8f1e", "value": "1536:z95/QLBcjZGiBGd/o5YcmiWtODC9vSiMOJWvoytABxxgOSavcNb:FBGo5YcmiWtIiMOJWvoytABxxgOSava", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498111, "uuid": "33cb67b7-94cd-40b0-9343-b65ce125fd15", "value": 114407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498111, "uuid": "56d495d2-7821-42bb-b8ef-51710676a3cb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498111, "uuid": "057442fd-1c83-4d00-8233-9014cfba146e", "value": "Security_Delta_Session_303.webp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb20c51-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495389, "uuid": "26998d94-ec98-4581-bcb8-51d3161bfa3d", "comment": "Malware payload (Mirai)", "value": "cffb7fc3c9e11dd1736bd9c8be2b47a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495389, "uuid": "e4771980-c13c-4cca-bc80-376b6ece39cb", "comment": "Malware payload (Mirai)", "value": "a5b11444a77102e2992888bd8aefb823aefca6ff4a749b719dc82853d0c095d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495389, "uuid": "204112f2-54cf-4575-a806-8520d39e461d", "comment": "Malware payload (Mirai)", "value": "a351ecae9d0b8736e0b97a9de5e04788d84a0f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495389, "uuid": "ae9e2b3d-e085-4d2c-98af-1fb38380a2b0", "comment": "Malware payload (Mirai)", "value": "efcd690b7f2085b0696127aca626d4ffad253b52225a89d92a927fee47665bd35d08f2c1f13350df019a9f05b65bbf4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495389, "uuid": "d693b97a-e6bf-40d4-a9b1-20efd4545f03", "value": "T1B993B81E6E218FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495389, "uuid": "0b751bb8-7900-4fb9-b090-c1797069ee7f", "value": "1536:KloXJI3TfgvWh+oqXXgLAHw3AGh6zeglH08kYf:KkJIDovM+xwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495389, "uuid": "596dc99f-3f2c-4752-b830-28a89c998403", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495389, "uuid": "d13b770e-dc24-47a6-8805-60b45052e7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495389, "uuid": "38665bf8-088d-49cf-b16d-8de7c7a55d5a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9400437b-1fbc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503022, "uuid": "028cd1ff-5edd-4bc6-b2d8-b2d0a6ffaaed", "comment": "Malware payload", "value": "e86fe5f1809c633170717afbb6b7ab1f", "object_relation": "md5", "Tag": [ { "name": "45-131-214-203", "colour": "#A56C89", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503022, "uuid": "2acea71f-446c-44a9-983c-f807be8c78f7", "comment": "Malware payload", "value": "a61f926e3fa22864f5aa5884b5967bd139ea2f9882a709f44342a02fab908089", "object_relation": "sha256", "Tag": [ { "name": "45-131-214-203", "colour": "#A56C89", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503022, "uuid": "af665023-a410-4a80-9103-457d0d8bd2ee", "comment": "Malware payload", "value": "98fd144b2216715a77b1c0b8be3425bcf1ad841f", "object_relation": "sha1", "Tag": [ { "name": "45-131-214-203", "colour": "#A56C89", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503022, "uuid": "86823425-3929-4735-bd84-deaf75ea653b", "comment": "Malware payload", "value": "123204efddc0ea2bc622d8d8ec1f06a7cf8625357e74e0919c89aa2f0c4ab0c645a8b09ea0841d9ba87e608d8784b16d", "object_relation": "sha3-384", "Tag": [ { "name": "45-131-214-203", "colour": "#A56C89", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503022, "uuid": "e9e5e803-288f-4ab8-a95a-25396006ba77", "value": "T123855B1BACD514B6C06A973288B762B2BB75F8080B3223E72F91677C2F727D01A35755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503022, "uuid": "5e715e55-02aa-4c01-8dd4-49eaa987d472", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503022, "uuid": "555215ac-7be0-4b4f-8302-30444d2936af", "value": "24576:5+VCnIb5QorpSLtqG1Jp3Vq6EHUS3p2217FFa+OGiWfK6+u87:5+EIb8tqSER2M7FFn5kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503022, "uuid": "f92e8919-b311-4e11-8bb0-a924130e4179", "value": 1841152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503022, "uuid": "452af46c-5977-4f52-91aa-1e359236f5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503022, "uuid": "2c4b94bc-9812-4a9b-bdf1-051da112ec70", "value": "egYZUTUwsbVh4p1S652BVPQ4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5346afb9-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493894, "uuid": "abfe0e80-7229-46fd-9c8b-aedbaf5787d8", "comment": "Malware payload (Mirai)", "value": "cc4b6ba92865765373f18cbcd30c0a29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493894, "uuid": "8e8b5826-14c9-4c01-9c2f-23f86b77b185", "comment": "Malware payload (Mirai)", "value": "a665805077fe5c3df5b06bb77870269423ac1e78981e87a0b1581c58b2681b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493894, "uuid": "687e6248-2f8d-4286-9ac2-29f6e4555405", "comment": "Malware payload (Mirai)", "value": "d389edf45617cb85520ea81e1d366c7031b1e2b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493894, "uuid": "e9461fae-cb82-4485-aade-3cf0910dbcd1", "comment": "Malware payload (Mirai)", "value": "152b89d3cd8b54c03e1a3ee9dcf954313141847edfb1d455f5cf3891a64ebebd89895a6a84c2ae3fdb496456e163fd39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493894, "uuid": "34d8f7d0-c865-4a67-aba7-6b210311fe60", "value": "T15103E12E63041A96DF1C84FB27B00BA03E7E0691950B79CF26C6F70B68469DA7C14FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493894, "uuid": "343b9716-9223-43f1-b141-c97c303e7697", "value": "768:4i231FZvxdH1jTvvsCHzFvYGBX3QvG3NwBhgwdH6DbVJgGlzDpbuR1Jr:ShxrTMCTFfQu+suIbPVJuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493894, "uuid": "cd20d8cc-ba4c-4ffb-9b87-6f2bfbb5f6b1", "value": 38948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493894, "uuid": "f2896c8a-dbfb-499d-ad0a-b88f201ccb3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493894, "uuid": "2b544b40-d45a-4433-bb41-9bc64d846006", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3db401-1fa6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493619, "uuid": "af36fe86-541d-49c8-bd86-c7d12cca15ff", "comment": "Malware payload (Mirai)", "value": "ccab0d0e7d3ace987d7f510f2cfd5d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493619, "uuid": "a4393fed-2d29-4523-8bce-6c6d0adb4f88", "comment": "Malware payload (Mirai)", "value": "a766f35221a3a37e657599c30e8c652cf02d367ec5d44e06973e1f5bf88d69af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493619, "uuid": "ec525c1a-311f-4c05-b78c-5ccdec051f06", "comment": "Malware payload (Mirai)", "value": "d30c5bd4f742c23d88fac895f9ec4d93fb55eb24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493619, "uuid": "44e3f5d6-de8b-4924-8ff1-820950322908", "comment": "Malware payload (Mirai)", "value": "e78c548e7a7f0a6e4043ed47ac62d109beff0bf1905cae4d37936095f9414e7cff3ab976d6251574512837d59e9f97ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493619, "uuid": "d0753652-19ab-4324-ac2f-beb9b7383591", "value": "T101242B037A81C9FEC496D1F04BEBA5319979F82D0635714B3794FFB12B09EA02B6D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493619, "uuid": "551becbd-a5aa-4737-8d1e-beb8d8afcf49", "value": "6144:KBbbTJgbFZthT6XdrPG2er/+PlNL9/4X9:KgPT6Xd62er/o/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493619, "uuid": "74dd4775-345c-4a7a-a1c8-16e7ed93c9eb", "value": 213456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493619, "uuid": "41636f97-cbf5-431e-81f1-52d8cc4d99a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493619, "uuid": "7c8de859-80f8-47c5-b28b-275ebcac20bc", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9832921f-1f85-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773479406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479406, "uuid": "5fa626ff-5631-4a82-9409-6ffd62305177", "comment": "Malware payload (njrat)", "value": "6826b710247314b6fc0c02d12796dcc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479406, "uuid": "f188ffe2-ffe7-487d-a796-458dc9977e76", "comment": "Malware payload (njrat)", "value": "a7b5fa68a512950248122dcb6f815e6f12619097b48de3a6650bc65824781fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479406, "uuid": "f5faf830-5994-4795-aef1-6e060524d534", "comment": "Malware payload (njrat)", "value": "4ef491a92650ad594679ed1eeccc43cf4f1c5fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479406, "uuid": "acb1fe45-d185-408d-88c8-c9cbf6193830", "comment": "Malware payload (njrat)", "value": "2e524c96f5f1efc77797a2f3b95475cc4042cfcc160e8243e5be51de0f99fb91050c7fdc0fe8e6d8f8ae5ea66566d991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479406, "uuid": "6b77455c-4e78-4bd2-970d-f7c3e614c69c", "value": "T17EE21A467BB58216C6BC5AFC8CB313114772E3838472EB6F5CDC48CA4BA76D04245EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479406, "uuid": "101c1358-6929-4263-bcf9-a9ca952427b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479406, "uuid": "eaafef0d-306c-4a06-86db-57a62b384b6f", "value": "384:e0bUe5XB4e0XKOxBIQgYbr9p6WT5tTUFQqz9YObbJ:PT9Bu5PIQVbJf+bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479406, "uuid": "0bceadeb-8326-47b6-9477-9659b2f25631", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479406, "uuid": "3f925e82-1fad-4b70-ac36-640c90038110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479406, "uuid": "7288ddd1-682e-4f76-a081-92e6dc80e004", "value": "6826B710247314B6FC0C02D12796DCC6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb438ea-1f73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773471789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471789, "uuid": "1a002b36-7e52-4c8a-a4b0-3f5ba6ed89ec", "comment": "Malware payload", "value": "2604364445e5e030cdcb37a9b40b5a65", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thelobstercoin-lol", "colour": "#3A5042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471789, "uuid": "127b3cd1-1643-43be-810f-3ab985d2179d", "comment": "Malware payload", "value": "a90260e471c88fedd035e4a7c980a14211c78e6257df79d4dd727a0df9adbeae", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thelobstercoin-lol", "colour": "#3A5042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471789, "uuid": "f2551756-a827-4c17-b287-31751914d347", "comment": "Malware payload", "value": "88593e724a33fde70a62aceb2267a2345bf69dfa", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thelobstercoin-lol", "colour": "#3A5042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773471789, "uuid": "30cd26dd-cb60-4406-953a-da49f1ae395b", "comment": "Malware payload", "value": "7f337a3fcceafcfc51a90ce786178a7975fd51c514964a32500e3f7985b38ae5cfac5176c4f769181b7290fb3a178278", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thelobstercoin-lol", "colour": "#3A5042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471789, "uuid": "de680c46-f904-4991-a870-091033841365", "value": "T1EDF05C794F3DF8C4430EB06065245C8921D52A57D7795E5EF511196979203859F0F14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471789, "uuid": "34a8600b-47b3-4e23-9e44-61d207222841", "value": "12:s8hZGrO6h2V9R1YzRguua+ZgkzKq+P8p4:rZGrfUTbvZhzKvEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773471789, "uuid": "dfbf338e-d946-4769-a669-f58308ae7a2e", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773471789, "uuid": "73fef5dd-abbd-4c7c-ae61-773366a6d174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773471789, "uuid": "8dfdd98e-8fbe-40d9-b80d-eb7939ed1c2d", "value": "3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004089fb-1fef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773524678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773524678, "uuid": "df171719-eec0-4f0b-8e1b-3f1223818431", "comment": "Malware payload", "value": "dc99867f12cb56f2213f39c55416545a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773524678, "uuid": "bf5f9e73-ee5e-416e-bed6-26459f6f80f6", "comment": "Malware payload", "value": "a948603c6a98efe282053a11422765c2771444be9aa2c90d6c5447744aff0985", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773524678, "uuid": "d459d6a8-3c68-4179-83a1-59617ecb0052", "comment": "Malware payload", "value": "9b57e870b396d9440fe8979ca57166c1da3d8a35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773524678, "uuid": "1ad97dea-7152-4049-a5c9-810e4f6df5bc", "comment": "Malware payload", "value": "8b5d706cc66fd7f57fe4b101c0710b105e3e50b627f26479bdcf558f57d129d30a6679ef877fd597d61c58ee083e2b49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773524678, "uuid": "9cdbebe0-cc64-4e5f-aa81-cf12ed396e31", "value": "T163925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773524678, "uuid": "cd9c369d-da35-4990-8306-f31d15bcc144", "value": "384:RuFcuQpWx+BL0SWL0gKzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:oF8i+BL0SI0lzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773524678, "uuid": "3232a3ec-de94-4e25-8a59-88732f80c728", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773524678, "uuid": "600085b3-13d3-4fa5-b096-76f5ad34d42a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773524678, "uuid": "e9336c5e-caa8-4981-84e6-cfe96b5c9f8c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847e1435-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773486675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486675, "uuid": "20509098-673c-4f4d-ad69-8988a49b8434", "comment": "Malware payload (njrat)", "value": "827607d89c33dcd2e0eab71062cbadf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486675, "uuid": "e50f8d3a-db3e-4301-ad95-7e571740f2fa", "comment": "Malware payload (njrat)", "value": "a9a7ebc3406ddb00ffb5a2607cc6aa76bbc39c6865a2f9b5e434b0e065b11353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486675, "uuid": "96ca2237-2692-4374-9d87-3064e0865260", "comment": "Malware payload (njrat)", "value": "fb73c5bfbe5d8c4b465a191cefe68fcf1f521178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486675, "uuid": "7930f3e3-d5d6-4ed3-b57a-2c8b7877b95e", "comment": "Malware payload (njrat)", "value": "7255774f1e24a805ec651ed1a9727d0d3c0518a6fded3ed9ab220399184c607a2f00ed2a38f33c30a6b944602f5d065d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486675, "uuid": "1176b359-2c5a-4ae4-8d9a-f4e923099280", "value": "T19125C19173F8850BE1FF6BB4E4B245594B7BB9129936DB4F0D8890AD1EB37408E103A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486675, "uuid": "797b0221-46c9-4406-b320-aa71d76392ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486675, "uuid": "fcd9dc8f-fb56-4d1f-92cc-fed6c003ad58", "value": "24576:M6aTQKXtxJzck+uGW/yFoBkkArjzKsBgW:M6+9TYjqqanOjzKsBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486675, "uuid": "0544835c-4460-4778-bb99-92cf84ee8104", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486675, "uuid": "725a9743-2f56-40ec-a958-3a17a80d21d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486675, "uuid": "9301963e-3bcc-4349-bd16-1d246ff5b0d7", "value": "dumped_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7db7497-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495324, "uuid": "6f073945-db0d-45a8-a411-c0b550866821", "comment": "Malware payload (Mirai)", "value": "0dde6f150a458e9a7694e064c1def8a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495324, "uuid": "9a29154b-3e0c-4291-b8a1-6932b565ec15", "comment": "Malware payload (Mirai)", "value": "aa550d2a15495f8f43858d92b3093019fa2201ed2d4fa03a782b9d2b32099b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495324, "uuid": "3866681f-d206-48ef-8f76-27f55dc2276c", "comment": "Malware payload (Mirai)", "value": "09a365903a32a0b15038c0382e519c81f42eeb65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495324, "uuid": "39d1f2be-a097-4a7c-a50a-9ed69116192d", "comment": "Malware payload (Mirai)", "value": "6e05e7022bde5879083548a6df02c10cf9e47fa47af3726655c9a5dd8a5765e70666340f9b90d676ca06aebc93cd2bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495324, "uuid": "ec79d48c-eae8-409d-ba20-bd49676020c5", "value": "T146633A81BD815A53C6D112BBFB6E01CE372613A8E3EE72079D266F21378781B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495324, "uuid": "a4113640-bb4f-45dd-8c81-8e32a6da621d", "value": "1536:g1NnhydU0LklPVqUMt+Zo82Op3GlO9NUVyZvXo:g1N0Y2t+yHc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495324, "uuid": "bda28da6-9e74-42c4-972f-9df921fe1e58", "value": 73348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495324, "uuid": "bfb0a334-6cdc-4139-a7bf-5105ee5144b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495324, "uuid": "9bb09e64-b8d3-48ac-9859-3e0e34dcf82d", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a44d6c7-1f39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773446634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446634, "uuid": "41e837d7-2479-4d30-9580-ef647f2101d7", "comment": "Malware payload", "value": "82792cb2e8378a26e7dbb66a9c93bb00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446634, "uuid": "39dbcd67-43a0-428a-9a8c-f84064575562", "comment": "Malware payload", "value": "abc1eeecbc6ff62c483f999b42b63166dd984458e26b71165f447b49b21f1df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446634, "uuid": "a832c660-7fd7-4622-a94d-80221aed369b", "comment": "Malware payload", "value": "4322b2fb5a7d70a03459315292f4ebba0dc99350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773446634, "uuid": "ce877d71-4b1c-477e-9ca6-fce378bb0e5b", "comment": "Malware payload", "value": "f5fe272668c830c0661e55e5d6eb46fc275d897daf78d4fa112371e66cc0f749158098d31cceb2a2643705556d40a97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446634, "uuid": "5a4be97f-b5ed-4ace-8436-495257714e45", "value": "T123E623DD81E412F4D5D30980B28E63CE71D0A45E46FD6D2D3AD61C02AF22DAF560AEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446634, "uuid": "c5ecbd0c-cabc-483f-8523-b54a6064f808", "value": "b8520e8f79ed8ee58f7251128275518f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446634, "uuid": "efdbabe2-a588-4648-a672-5f82b564eaaf", "value": "393216:wjUNmXsEYb/dhwXL8FaYiuP6LtbETLbE:CGUc/dhsL88Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773446634, "uuid": "6bee3cf5-47da-44d9-ab7d-b7f47969bc0c", "value": 13880832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773446634, "uuid": "ca7e2ed6-4b43-4926-8c2d-c81a6d0210a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773446634, "uuid": "6c2da4e2-871f-47b5-96a1-c6a32666f995", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cf8c0f-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493784, "uuid": "b4c1ce99-3edb-4a21-97c5-442444a86c5e", "comment": "Malware payload (Mirai)", "value": "10d949687e978f70141353659af75062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493784, "uuid": "8680e9b2-3ff3-4e4d-829e-d96d8ee728aa", "comment": "Malware payload (Mirai)", "value": "ac52c987b506b2ffb0a703c618bf6b47a42d252fc07623717a9419879f6c0ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493784, "uuid": "2413e929-754d-483c-b46a-efb5b68594dc", "comment": "Malware payload (Mirai)", "value": "1eadb5e55998d4705857d5620a2e6344d1b29908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493784, "uuid": "b554ea69-f0d9-4ece-bbf9-1587fdd8066a", "comment": "Malware payload (Mirai)", "value": "7fb83f5314ee2044588069411d139933d6f6009ef6d44954788e41623a903efaaaea2d6af4ae39deaa9796e06249fda7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493784, "uuid": "3478cd3d-0a2a-4565-87c3-62db68b1c28a", "value": "T1C3F47C06EF951FEBC4AFCE34891FC30705EDC89746D2A22961BCC96CBA8D2594BD3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493784, "uuid": "51838d8b-1c1c-4408-8918-d642900d714f", "value": "12288:gYflg7znLfd8kOdNg2C5hBqMiA3jIPLvtdlfBiLyTt1eY/X777nfdd0zZhU1NYO2:ioe4CbifMIfG7RV6aXYUUdRwsxYtbWcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493784, "uuid": "7ff65f3f-26d3-4cda-933f-c7e1c5b44e0a", "value": 724020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493784, "uuid": "5c7a4d95-80c4-49d9-8ffd-c9f2cdae7129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493784, "uuid": "1c214514-f31d-491e-bac8-af24fce40ed1", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edfc082-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495255, "uuid": "e2b11c4a-0f40-4f30-b41e-b96a8b65d383", "comment": "Malware payload (Mirai)", "value": "3b0db02c8ac337f0855d43b764c0027f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495255, "uuid": "f086e6a9-5290-4aa8-bb5e-c1e6ff7b3ed4", "comment": "Malware payload (Mirai)", "value": "ad9d4e169b6a84a012517b6060040bda953a300c2200a46cde2fb383b9aa9c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495255, "uuid": "362517b2-faf7-487c-82ad-edbe267e6301", "comment": "Malware payload (Mirai)", "value": "214c489040778996a7ccec65985dcafe7bcfe8e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495255, "uuid": "553cf3db-92aa-4083-b60f-0de6171b8f4b", "comment": "Malware payload (Mirai)", "value": "45160be924986b573e2d9fae84cfaa4d0551bc1e8af849dcab172666cdd375f1a4ca3dd778f430a22d79fc4476ac9bfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495255, "uuid": "74291df0-761f-4f99-b82d-62f48dba80b6", "value": "T108834D077981CAFEC08AD0B017FBA935D823F87E0A39B1E5B3D0FE515A49DD02E5A615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495255, "uuid": "ce3d5dd9-c4c9-4a72-9965-c78bfb8db2d0", "value": "1536:MwP37fpnZIWA+MNtFza5/bw/UqG4dN5d3SOUHHg/F5BrClo:DbpnZzhMNt9Ow/3dfQLHHmzrClo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495255, "uuid": "8c80a467-ce71-4d08-8203-7936cb48472b", "value": 82616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495255, "uuid": "249079e5-7034-404f-8537-c46c54da0723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495255, "uuid": "b4736507-0ee0-48cb-81e7-85c0a99d807b", "value": "xfr.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339422b4-1fb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773498995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498995, "uuid": "b83e496d-0e03-4326-9d34-e82ea78af2e2", "comment": "Malware payload (Mirai)", "value": "419d2cefe6177c4d04f4365428b6a249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498995, "uuid": "26c80b4b-d423-4f58-aa5e-0939f10e8dd9", "comment": "Malware payload (Mirai)", "value": "ae59efba63a87727bab650d5ceafbec4664c09c762d1f1955204bf284adcb335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498995, "uuid": "3e2440a5-8ae9-44fe-ba55-e261e1a86648", "comment": "Malware payload (Mirai)", "value": "7ec9eba35c90fdae6ed67d8d674a8456255ec50f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498995, "uuid": "09370f6a-d3c4-415f-9b86-1693a5cd9234", "comment": "Malware payload (Mirai)", "value": "7233668eedfb8f9c93f213e435fbc42b403d9c8569a95b7d791095af8c768a2ab77eed6e0172885ea1e8175cefaeae18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498995, "uuid": "3db99e9c-cec2-401c-87dc-7be7c8e6f767", "value": "T11134E806BF610FF7D85BCC3306E61B1128CCA41B26AA3F35B674D958B50B69F4AC3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498995, "uuid": "e16a4a0a-f95d-415c-91e3-50c0ff624e30", "value": "3072:W2ZNG4yGrkwUUmw88I/yr9p90OU5ZGh3O/Te:W2vGjGreUmw8AvIqlOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498995, "uuid": "cd2bf6ec-f0fd-4d35-b07c-cd82f22b705d", "value": 252288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498995, "uuid": "939ea5ef-3c2b-4032-bcd9-17f3a10a6598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498995, "uuid": "de49e05f-fec0-4b92-8e5f-302091c6d1aa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3ed2eb-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516300, "uuid": "a250e447-ae55-46a1-9fb1-b88036081358", "comment": "Malware payload", "value": "eab5a9360f42398da232d853d72e05a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516300, "uuid": "aba227db-d046-4e15-92a3-cf99be37e322", "comment": "Malware payload", "value": "ae6404b3a71d8ef2ea5c8002cd4e5aec3c6643fb87baab9486d2420ec8d633c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516300, "uuid": "09b653bc-66ac-418f-81e9-2b4b45371f8c", "comment": "Malware payload", "value": "215b2c775518536f1917a31a7ae202b79eab79a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516300, "uuid": "ae3ff241-ea5a-4f76-a2fc-db106b6592e6", "comment": "Malware payload", "value": "db393338e0d575d404f5569095b2d2fe16a91994866b6f5ded27690cff864f72022d651ecfaa6a74d77270544b20afe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516300, "uuid": "29cec426-1427-4ea4-8e40-5ee77b5fd29e", "value": "T107F34A6863FC4955F2FF5BB658B19A904B39FC23692ACB1D0299A0CD1E327508E44F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516300, "uuid": "60080d4d-b820-48dd-b053-89f8822b660f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516300, "uuid": "55b76811-29ca-496f-a649-cda40bf81069", "value": "1536:eWRlRdrL9xpiaF40c9zCfeXIVa+nej3EKjBiMdbOCTbn8/9tU:BDRdrX1S5ae4VajLjgMdbOmL8ltU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516300, "uuid": "06b3c9a8-ab4a-4667-9c88-d2ea280b0264", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516300, "uuid": "e90a6077-ab32-45aa-b894-81fef7995697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516300, "uuid": "5cd27148-1623-46c4-a2e1-5fcf8e8c4150", "value": "SecuriteInfo.com.Trojan.DownLoader49.2012.7468.29754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8646f7-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773505133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505133, "uuid": "12c358a5-1de7-476c-b2ea-ce9e757233a4", "comment": "Malware payload (Vidar)", "value": "ea875ad4e93ebe981c3ee6dd7c0f97da", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505133, "uuid": "82970f7e-9305-4cf4-836a-1208b374337f", "comment": "Malware payload (Vidar)", "value": "ae8152a859ae5c8324c1bf55378eb8acd6055d50da4e76c41c5bc688b92336dc", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505133, "uuid": "d6a2bc3a-90fc-4513-9fc9-e64f27c72834", "comment": "Malware payload (Vidar)", "value": "a3238b42e907b6e743c8c4f16a562ddb3038cd6d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505133, "uuid": "6f5b9a59-0423-4483-87f5-08349c1e0204", "comment": "Malware payload (Vidar)", "value": "dc86fbecbe397352a411a0dca3628f9ff61300a1749d4922535f2ca9667abf5019486a315c322d2415aca19ab405ee2e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505133, "uuid": "e3d98ead-eb50-4296-b844-7f0880c01719", "value": "T13AA55A1BBCA859E6C46E977188F745A23B30BC190B3263D72E81BA782F727E05D75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505133, "uuid": "7013003f-29c9-42fd-b853-5f38d46355c6", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505133, "uuid": "2feca690-8f78-4e90-a024-bbf2c5100c0d", "value": "24576:m2AoWD0l30F89DzkpHUE6zB7bdtyNGzyAhpEsUZtP86LVQyY:m2A7D0l30C9DzfEgXucGsUfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505133, "uuid": "7107fc92-8546-4748-969b-1db56514f718", "value": 2207744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505133, "uuid": "283f2e0d-5f99-4205-9dcb-9fc6faf801a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505133, "uuid": "639330a7-0f68-4a43-b150-f82862d8696f", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038afb6f-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477439, "uuid": "82997086-b042-4c14-8bab-df2bbabc223a", "comment": "Malware payload", "value": "a6a8b9fe3f77ef4bbed0bdf4ae7264a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477439, "uuid": "3387b6a0-9b98-481a-9a3a-4003ea8d05b5", "comment": "Malware payload", "value": "aeee73026b5bf17b968a8a530dd1995faadbc609bd392f9f205388bbe744039d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477439, "uuid": "7c3601ac-268a-4d1d-a0b5-effbb49700cd", "comment": "Malware payload", "value": "895d919bac11d007a459897912349aef2284d75d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477439, "uuid": "eef3f3b8-ec36-4651-857a-01c83bc1ca0d", "comment": "Malware payload", "value": "75dd5f7c271a89988fcdab51843a7d580b9de988cbc488d964d343703c37a6b108b3857a45f393632cce149b410223a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477439, "uuid": "1af9f176-f7b1-48e0-8b8d-2a0482b6a835", "value": "T1E7463A276B58EB4ED72421345DB1CEA867391C4A82DAA527B345F30DA4F20BC496FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477439, "uuid": "1dd7d2d1-87d4-4a45-9252-f73dbbbd6a22", "value": "49152:7fImWcIJ/PMjcme4PC6K18gx9Oy8XlIs99MbY0Mp2sUn1Gd3plFQWSZvHH:lmaenA/6vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477439, "uuid": "fbb7212a-4e0f-4c94-9c57-37af7def50e5", "value": 5767168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477439, "uuid": "a64df4dd-f438-42cd-aefb-c8884312fce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477439, "uuid": "69b023f2-a32b-47a7-b445-9bf00c484351", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da503830-1f74-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773472216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773472216, "uuid": "f1abc485-6151-4664-97c8-f7505573263a", "comment": "Malware payload (ValleyRAT)", "value": "733107e0eeedd22ef86ee450cf0bb03b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773472216, "uuid": "9228f15b-26f3-4661-81cd-779383b737bd", "comment": "Malware payload (ValleyRAT)", "value": "afa9c121b2809fcfd968b063db325611f15fb7525f6acc89e44dab2c393d4773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773472216, "uuid": "2fdce68f-4822-4ca6-96d0-2b5380fe841d", "comment": "Malware payload (ValleyRAT)", "value": "65c6ac3bc224d72c9f76ab9f613ae99aef5f68c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773472216, "uuid": "b1173754-f51a-4d2b-b6e5-59a1af5ccee6", "comment": "Malware payload (ValleyRAT)", "value": "e5a8a0d4e49f611d1e95d1d72106df8fd3fbdf2d8cc71b89767dcc46f8689b947d43beadb050f2a3af292ff418ad3cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773472216, "uuid": "957825f2-5f30-4093-8757-a922946a3093", "value": "T1355523523AC59561CA7A06B1B4749B64083EFC240F70A9FF63D86B578D308D1A738F8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773472216, "uuid": "16747af5-9781-4261-91c1-f701bd15b2fd", "value": "f2c3eb485ba9fc16997200a18f9fc48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773472216, "uuid": "db50940f-e3c8-4c50-92ef-fedc1400d9fe", "value": "24576:uxs/sH1hFBVArKgrQmnmVUZSreppGh5uv8lbJZSx4XOZ3ikBtrcUUox:ks/sbF0rKgrQLkSrCpGh5uv8lb7SxkOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773472216, "uuid": "c87df989-fbdb-47f0-9a4e-7e2a454b7d01", "value": 1324032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773472216, "uuid": "0df9a8da-ce31-4cd5-8a20-e0199bec2f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773472216, "uuid": "e9f1c370-9cb4-400a-89e0-4db20efb9edc", "value": "afa9c121b2809fcfd968b063db325611f15fb7525f6ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828f6034-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504281, "uuid": "77039a32-0220-42d6-a607-93f811a5511d", "comment": "Malware payload (Mirai)", "value": "02de674c8b86ab6ff0241f4eea248fd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504281, "uuid": "d00f1005-e40b-4b94-bfcf-aaf728349b0b", "comment": "Malware payload (Mirai)", "value": "b01b3b0619cfea63f4571b8e5bf6d7d8ac42fcc575e5bd7fb3de862363581957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504281, "uuid": "f8483309-4fd5-47a3-9dbc-455c99443c6e", "comment": "Malware payload (Mirai)", "value": "1429e204c07f8fbe0fd498e3984f36dbc8a40853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504281, "uuid": "6d99b31b-80cc-4b33-bfc2-d7586c22f424", "comment": "Malware payload (Mirai)", "value": "a12762e91e32ab2958d8f4b7179c72b11cd13a85f1b7d4aca7397b808e78e1aa9bac4698f89a69b4964094bd3d1bc812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504281, "uuid": "501fdfaf-0783-4907-b46d-bdb2b0863c28", "value": "T138132A17B48281BDC5968270476EBA16ED33F1FD3360A61A33F4BF766D9AE120E09C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504281, "uuid": "f1746479-cf4f-49bf-8d6c-dc2d00d5788a", "value": "768:gRQ2ZIAnlL7MZpMMkzy8uVxcjOJaYV5v4tpp3YkOGEwIX:2Q2ZIAnt7MEMkzJu8jOJfv4t7HEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504281, "uuid": "ac04e1fe-a2df-4893-9373-d9e09259b8f3", "value": 43120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504281, "uuid": "e0417be9-f931-4402-ac4b-29a44d56d57d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504281, "uuid": "389e663f-0bb3-46bc-af68-a3e4d8881249", "value": "wlan.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63857a04-1f78-11f1-a769-42010a9c0008", "comment": "Malware payload (BillGates)", "timestamp": 1773473735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473735, "uuid": "40733bc9-e3d4-42fb-a92d-39486b5acfce", "comment": "Malware payload (BillGates)", "value": "0e94a61a1690e53cf211dbc6163c75b5", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473735, "uuid": "35e5ec50-8e2c-4f85-9e35-09598c686677", "comment": "Malware payload (BillGates)", "value": "b02337d82c44ed46e5b186bd54cde717be39da81a29fb332090d10a5c444ccb6", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473735, "uuid": "3be1b261-aa8b-4352-bf7f-9f195c8b42b9", "comment": "Malware payload (BillGates)", "value": "f98748453a5a2bc3026d8a093a254b121ad5b48c", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473735, "uuid": "d4095ccd-8da7-434d-b76c-e3840a246eaa", "comment": "Malware payload (BillGates)", "value": "9b030622741c4a58a16f0a632c0f43897429602f1c5c689e57f7d08291b3631ff63cb179cd279edbae8fcbe174d00077", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473735, "uuid": "64d0c9db-ea58-4657-840c-073f9bede8ab", "value": "T152E58D13BDE09CF2C45B5271455A9A62BA31BC565B2393CB7F84F9383F726C06A39324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473735, "uuid": "8874f33a-29b3-48d5-bc41-95cf55665656", "value": "49152:2fsdURZWsYVvE5QGYZZjh45vRVJKGtSA0VWeonu9pTtqIQ:2fbRUqNRVJK0SzVW1u9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773473735, "uuid": "683a9e68-8e4c-443b-91f7-5d600e0da0b4", "value": 3141794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773473735, "uuid": "fe0d441c-39a4-4e20-9fcd-c5dc60676f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473735, "uuid": "740fe550-45ba-46b7-aefd-bf0895da28ec", "value": "kal64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef3015b-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501886, "uuid": "4a1ac6bc-cdf8-4780-9711-06bdb8e5ec1f", "comment": "Malware payload", "value": "9e48f4cbb592f5be96e3c44ec53cb1dc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501886, "uuid": "4e3386c1-d19c-43df-8e43-f0b71e5b0828", "comment": "Malware payload", "value": "b08ebe5bec9d751b5d189d5a48c3d0786e06959f2b7e832220b9b722ab467573", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501886, "uuid": "80edbc05-b60e-4066-bc7a-ecc8390d0850", "comment": "Malware payload", "value": "7246ff45db20f862a4a743642d66dc8c06f11338", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501886, "uuid": "0fc67b9e-530e-4876-ad3e-0e8f0ead0c2a", "comment": "Malware payload", "value": "fabf7fd23643aed0967242f39dce9d734e6f319c3c184d96384cbe3755d7d54acb0fa5edf09fe20f70953279e7d2cffa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501886, "uuid": "cd0f6aef-8f46-4dea-a706-d9c708640fd1", "value": "T1B055FB9C33CC98D3104B7A5E6AC9A7ECDE297A78784474CB81537C5B12AB706C5EC9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501886, "uuid": "9ed7223f-f238-47ad-a2cd-c37613211b53", "value": "12288:cIhXzaNkLu+9iwIEZqjs506rHndc2aCb2Th1XCOBoXHtrUg/GFyhcOG+L9tonIGx:zv6YsfsfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501886, "uuid": "8756da8f-0305-48f5-ac0f-d6d54ad9ad9b", "value": 1300054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501886, "uuid": "7cead523-6b9a-4b9a-b8f6-b4e4bf2b1c45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501886, "uuid": "7cff6368-6907-4f98-ae99-224781b8e3d3", "value": "cache_optimize_obfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962f5b95-1f8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773483269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773483269, "uuid": "de145467-85e8-490d-9a81-0e10ce70627a", "comment": "Malware payload (Phorpiex)", "value": "91059abcb7caa8c148f8431f4d4e37d4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773483269, "uuid": "989b9827-d4fe-4c00-8547-0ac1f9f83431", "comment": "Malware payload (Phorpiex)", "value": "b09ad30eddad0ce173b1a72be28ce99e44d21acb0298747a178f48704d35a2e1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773483269, "uuid": "f90d0fc5-f2c2-4bb1-94a2-87ee17a5db9c", "comment": "Malware payload (Phorpiex)", "value": "3d2ffbc459568028195cfa6c28b1c6ce9c8dad8a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773483269, "uuid": "c8ab111f-3d22-4613-85c0-ebaffcf1a504", "comment": "Malware payload (Phorpiex)", "value": "7b43f1cfad33d7d52ca6585fc800f069c982c7f4ec6e8e83c89767052b965cfcf1be580068fb49495258c39aeda0a669", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773483269, "uuid": "d7cb2e1b-5fed-4521-8272-7fd97f2a6cb5", "value": "T197826D0FB9414217D1D100B59A62867BD97D947233D854EFFB904AEE1B686E2F83314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773483269, "uuid": "5ec44d44-2a2e-46bb-b341-3ca0be92843b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773483269, "uuid": "059f0e1f-4a38-46e0-b905-7fe3df23d2ec", "value": "384:+eGIUVp9cfcPwOQxb0YSLSffXnZ+lNSLZav8U9chiY:DEifZ0pLSfPZ4MLZa0Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773483269, "uuid": "acb49d48-3664-4243-ad20-6385caceeda3", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773483269, "uuid": "8c28b94e-4027-410a-b6e9-fd5ec1d8c96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773483269, "uuid": "2d3d36b7-0246-43db-b713-e8063c69f224", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da215303-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773516024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516024, "uuid": "8e966756-8d25-49a2-9803-47cd4039f6db", "comment": "Malware payload (AgentTesla)", "value": "598ef00801912b325739ee2129da276d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516024, "uuid": "630047af-a6a6-40f0-8297-f7d00f107cae", "comment": "Malware payload (AgentTesla)", "value": "b0ad5cd8051572ef9860d239e3b5997b61e66735c0e3c564809ae28f0b64ea5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516024, "uuid": "b01d3f0e-e441-4394-b49b-14c45d7f147e", "comment": "Malware payload (AgentTesla)", "value": "9beff21b6c39eeae78ff64043462f39d1bef423a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516024, "uuid": "7e280aa0-59ea-41c2-97f1-7e92b4ccbb42", "comment": "Malware payload (AgentTesla)", "value": "146cf4a14e5ae53afc746effe198cb364b50dc3f1c480d7621c984553b606277ad7157ca3cc85447e75f2ff313ddd93a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516024, "uuid": "e33f2396-0480-4efb-b0b8-aaab92a9ae8c", "value": "T19D557D29E0853B1445452E7941A12487EB7A4CF20E936A4F33B1F9ED1D7B69029FBF0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516024, "uuid": "ea5e5a14-eac9-4184-91ad-6561d1d08c14", "value": "24576:9NpkojfmhUgvM7iFA4DNqGS74ENis3nZ1K3S4:NihUgvM7iFA4RqGSRis3nnKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516024, "uuid": "c1732e0b-0921-4624-85b2-3580c32dcc2d", "value": 1348163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516024, "uuid": "70b02fe8-c4fa-438e-a2c9-9467ec04059a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516024, "uuid": "da8d03e5-0452-496a-8a4e-a01fcb8765cc", "value": "598ef00801912b325739ee2129da276d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6c03ce-1fd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773512191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512191, "uuid": "7d213995-0cc1-4d52-8f79-c0d70a65335b", "comment": "Malware payload", "value": "0b52789662b07b775868eddb36898d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512191, "uuid": "e585a79a-2469-4190-ad75-0f643b28dae9", "comment": "Malware payload", "value": "b18e84c03195b6e8e4b92c59a2845d7118e915c2638c2ca524fbeb10c81ea83b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512191, "uuid": "3cdd3796-d449-4751-9126-45caf5e6b02d", "comment": "Malware payload", "value": "0433288a8308f90e440c006eb8fbd2837a08b905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773512191, "uuid": "2c077d94-8b00-4a5a-aee6-b307a0cbaa35", "comment": "Malware payload", "value": "499885e73cbde72b7dedd9e94e6d9cd36d804f515c6ffd1e511de32a142c7e2e4511421462279db9b0c7586e6a75c720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512191, "uuid": "fc81a178-8428-4424-ac8b-816042073f46", "value": "T15774C04163B84E63DBAF8F7D968A42664EB29106A413DB0D1DDC58CC6C933815B2377F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512191, "uuid": "9107977b-c742-4165-9bf2-66ac70c08950", "value": "6144:3/kda4pmLghAHhzFqQdCQrLFvFhzPhdY7BXmkBuyDd/EjV+HbahaPbHiVt4X0qVf:300L0SzFqQzLFrdIBQyR/EjVFObHiVSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773512191, "uuid": "356a5abd-1225-4a25-8301-76150fad898f", "value": 356568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773512191, "uuid": "a2de8d33-2821-44dc-8904-b337916265cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773512191, "uuid": "faafd66e-5f7e-4040-ac78-092ba54c5028", "value": "FlashTestInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3d100f-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773514825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514825, "uuid": "08deeaa8-4b1f-4eef-a6d9-2818478aa259", "comment": "Malware payload (AsyncRAT)", "value": "d7af908c62d909fb61205390aa0e2702", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514825, "uuid": "373882fb-a542-4413-82db-0468b8c07993", "comment": "Malware payload (AsyncRAT)", "value": "b20d623d8f905d4344d6849d640423d6c5b5284f719accdb9f6c27c36e753d63", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514825, "uuid": "4e90e0e7-b0ee-4198-84a6-d0111ebdfdcd", "comment": "Malware payload (AsyncRAT)", "value": "6e05f22f223483f5a4647ab6344ab110a645d111", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514825, "uuid": "5f45dae2-56d1-4b18-be19-08516246c5e2", "comment": "Malware payload (AsyncRAT)", "value": "91ff364a1ac90a6b281d25222397f479c7911cd95ca66374512d7f71fed2e6dd2bd4e234dcba57e86035e41ad4220c61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514825, "uuid": "b6d2b282-5597-4917-8a52-b24276514268", "value": "T173819754DE99C93C7575EB2AC5DE841DFD3360B32597C269B0CC83486F35028423CAAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514825, "uuid": "b7028ca3-3d2e-4d6c-84ee-83d66c8d0828", "value": "48:4SLCek6cJ6PN9azfPjNjqBj1Qj+K8BjkjoqzaBJi+RH1H1gHTQoNB1+4rCzDhkw0:atYN9azHxWBJQazB4MgafitQ4OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514825, "uuid": "73c75116-550f-4146-9107-1d4cc13ab25e", "value": 3904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514825, "uuid": "7a957eb8-7506-4a5e-b326-228babf7e4fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514825, "uuid": "31b2adf2-7986-4de4-bf35-a3fe5eb14007", "value": "Tranium.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b119633-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495249, "uuid": "42a1c394-fc32-446d-827b-830b31fcb417", "comment": "Malware payload (Mirai)", "value": "fa5b65f5db3cacdd07de336835ebbcd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495249, "uuid": "73f09924-23d5-4b39-a98d-737eb8993e17", "comment": "Malware payload (Mirai)", "value": "b210ef4305e97f4c51ffca4070e028cec6e204e357eda0a791ceb1deda2db838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495249, "uuid": "2cf73f62-6ac9-4977-b980-6d028ff67122", "comment": "Malware payload (Mirai)", "value": "4a229bbdff499d87022498328c5db96b2bbf11ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495249, "uuid": "318dfc0b-48a9-4df2-a729-627b5fb4ca31", "comment": "Malware payload (Mirai)", "value": "68fa3ba88ee4408700515a9651c120c0a5b93e7f5c7fdc13d94021c34ae11541ecc210f092d660d181c9e13cc020e412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495249, "uuid": "1224c929-517f-4e09-8f64-34ea1ad13670", "value": "T130736B63E916AF46C05761F062F28E780B53FC154A6B1EF19965EEE25103EE8F6083B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495249, "uuid": "190e25ed-7204-4c7b-a2fa-bd2446a9320e", "value": "1536:8owtvK2pVo+Z/qf+K25pV5T42C9J6RCFol61d6P:dBB5x2bT42qEuo4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495249, "uuid": "5d479e65-2d96-4457-a013-a4aef5f07510", "value": 76216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495249, "uuid": "b571ff7a-c4ca-4cb0-8b08-c674bc55a87e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495249, "uuid": "d8ace918-0a6f-496b-9e21-c630fad39e9f", "value": "xfr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b685b93e-1f88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773480746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480746, "uuid": "4a9bd6ad-e59c-468e-8c2a-97a108c2cdbe", "comment": "Malware payload", "value": "2d976d00189fb7feb5225cd11073789b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480746, "uuid": "612159d1-ac7b-4d1f-9fe0-446dd636140b", "comment": "Malware payload", "value": "b218d76b0aabd9066c4f9d02637a405c85a0635212f0eb79e07ce0514c3908c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480746, "uuid": "eaeacc8c-3319-4cb9-86ad-4ffddb916dfd", "comment": "Malware payload", "value": "508b9d018c6d5a7a3d4147fb9f0606b00a2526e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480746, "uuid": "3a7f615a-90d0-45e9-aa8c-0fc5dd623c7a", "comment": "Malware payload", "value": "dd2a04fc09b6416137e639f36cd2717daa961f51575aca44535b035eb9318be63f5948cd6e132e61305f9e76d99506de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480746, "uuid": "753e48ff-2c87-4a17-8174-c611d830df9c", "value": "T16162B440B583D96FC0C416B15BAF29ECB647826DCBEB2316C5148FCD2A6E7968B74D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480746, "uuid": "621b7ade-34ea-4cf0-bf36-948af2d5b68a", "value": "384:wy+GiW7Sp1HOrLAXTenzhV1bVPvDKCRzWHhxEQ:h+GiW74HOH+TedV1bVP1zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773480746, "uuid": "79a870a3-2055-422e-80e9-68bfe71d4432", "value": 15644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773480746, "uuid": "d464282e-5abb-4130-9d42-844efb309566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480746, "uuid": "3ed26bbd-69ad-493a-935a-39e8e4959da9", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742fe283-1f78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773473763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473763, "uuid": "cea9b86b-9f61-47ec-8e3b-f79f8338aa45", "comment": "Malware payload (Mirai)", "value": "6330663acd4699c98cdf49067e435106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473763, "uuid": "a2f0ded9-7804-4d58-9c00-3d462c251e86", "comment": "Malware payload (Mirai)", "value": "b2cc5ad7247be26a841db034090d14f9a980b4771dc95e9f4110f2066ac1236a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473763, "uuid": "b1adb720-f018-4f85-831d-865a1210e63b", "comment": "Malware payload (Mirai)", "value": "da3bd19b88e968f9d12ff0a5bc669cc3eda4c980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773473763, "uuid": "7ebb0e0e-0255-4644-a3e6-36b1cdb45db5", "comment": "Malware payload (Mirai)", "value": "632a39658e26409ebb37ff34b984b299d9ee6669db9daf145ee203d44de79dd94fe0a399673578cc5f314bfc8f2b5969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473763, "uuid": "f0506da3-d5d5-48eb-a5d4-eeb6ed38e02e", "value": "T112168E5AB5BC04B7E48989B0838ED3569E38749801F261AF7D4416E53F29E305FBBF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473763, "uuid": "f2f0caa2-998e-4109-9f80-11bf8e48d446", "value": "49152:pIz8Ijri5ku5mUouDcxriA8OjqJmCIU6ipi83szlIxnkaL0t/obbQT+lFKiVj6:I3D+q+pi+kum+FBVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773473763, "uuid": "348443e9-082a-4521-a69d-509d30dc8de7", "value": 4220752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773473763, "uuid": "3e57bede-a93f-4c4b-b25a-5b4aeae5f3ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773473763, "uuid": "f9039f38-fc62-4581-8348-688cb574cd24", "value": "apcid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee686ee-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503765, "uuid": "169525b7-33d8-4b20-9e6c-3efa657622e1", "comment": "Malware payload", "value": "7a7ec55b0fe5fcfe897d935d57480f0d", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503765, "uuid": "96741b50-a547-466b-9af6-b8a1421a70e6", "comment": "Malware payload", "value": "b302c43a9f322eda5243aea3255c583b5609b6217bd9615fe555b471af336d8b", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503765, "uuid": "ed295733-f9a9-4b57-aa4d-0488f3817139", "comment": "Malware payload", "value": "f31d47f93fde7f662fab3e0d1cfde00f1b15812d", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503765, "uuid": "a391fc0e-aaf1-4e31-a66b-661e60d51775", "comment": "Malware payload", "value": "dfbce3737ae809e2af5de63f07281d9931c6f02df2b196ce8af2e776c3fdf5bd627d0f01462de2233e68365382a0505e", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503765, "uuid": "5707b04f-3926-4817-b189-8430d6359890", "value": "T122721A9237C561EDE7E81375684BBC6DCAFD09BD31D9642C06239DC81409E70E4ABA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503765, "uuid": "368baddf-7647-4a13-8eca-e5df6b412aa4", "value": "384:RbzgQcOUmdueaqMhQa6sopthDaILRwzP4iOfD/9UDYsMhI:5lcO7dBv3tUILRzU0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503765, "uuid": "9fbc0e86-6318-4afc-a515-ec762147aba2", "value": 17559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503765, "uuid": "189153b7-641a-4dd6-a0c5-8416f8584896", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503765, "uuid": "c82c0aa0-4a88-49e6-a1ae-30efdbb41e1a", "value": "cdn-2faclov_clickfix.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e300c0-1fdd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773516977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516977, "uuid": "76a18498-89ed-4cc3-aa5d-c6cf82591372", "comment": "Malware payload (RemcosRAT)", "value": "565c601bd2692be511e23eceb1b52b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516977, "uuid": "0d726eff-f178-4657-ba9b-fc4eec27e599", "comment": "Malware payload (RemcosRAT)", "value": "b30aa1159a660f71f48c58c75e2844e3342108e4e3fbd72487aa0e2662da3d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516977, "uuid": "db1bd2b0-d030-410e-b1ac-f5de995a4ab1", "comment": "Malware payload (RemcosRAT)", "value": "b66de4e54a61eb06c666d1610be4c3d5f8435ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516977, "uuid": "844adfca-f77d-49c0-9bef-d57f99ab990e", "comment": "Malware payload (RemcosRAT)", "value": "46315e9fb1b24b0c402323978874aab0f01c81d5aa3334c6da78fed32b60b313b4f3ddff126e5026398f8e9e3889fc22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516977, "uuid": "a2854b8d-f4ac-4ea8-a67a-46f427ad1731", "value": "T154B46C56A39447F4D077C234C982852BE2F1BC456672C62F03EB4E5B6F232A15D2FB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516977, "uuid": "b668ae12-cf4e-42dc-929f-88496f866b39", "value": "18e660d71c4864435cdaa9dc956b239a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516977, "uuid": "fe13ffee-7440-42aa-896e-11bd11bafd17", "value": "6144:mbzcDkMx/A/Qc/gbGTzYMvmHRXvzyAy8Asqz6RgE8wWDAnRwA9FvYkDqCXAF8cjR:ff/A/lgbGTiWsUvZDEDPWFjBouBESkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516977, "uuid": "c06a97e2-07a3-4d7b-b3b2-18034f7a635e", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516977, "uuid": "f257536c-d718-4eae-bc41-949ada3831e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516977, "uuid": "4ae62c88-29b2-4bef-86ac-c2b87eafa66d", "value": "remcos_a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579108e6-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493901, "uuid": "03134616-5b06-4d3a-add9-def662a7d72c", "comment": "Malware payload (Mirai)", "value": "7e8a12a5154fdbf9cf5c5dfe9f5cd25b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493901, "uuid": "d05daeff-2d9e-4ca1-b0f1-c3b2d0e72076", "comment": "Malware payload (Mirai)", "value": "b45c6d7087db19283121f229cb314d3409703c6be947f9c7eb81055ce9b6c7e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493901, "uuid": "86bfd360-2e3f-497f-96ee-c36cd96870ce", "comment": "Malware payload (Mirai)", "value": "12afd1beb51c034395ee4d66a2e47cfb48c6242d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493901, "uuid": "d114474f-4e52-4492-98fe-e9c2319d84c3", "comment": "Malware payload (Mirai)", "value": "b7b57dec939064a91abb6542155900c9fdac22e232027620947a8ac2db7942626c82a48922919d25d291a363b6ba24b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493901, "uuid": "620c010d-8494-4210-8795-94495e79cd6c", "value": "T19CF2F107D63C8E01E066917C4DBE2E1AD260E4A79294D3AB57942123E197F053A2CBF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493901, "uuid": "f0b31154-a950-4d39-9a7f-a86cf367016c", "value": "768:fT7+FNO2ylmGTEbeLOitZdeDiomGnbcuyD7UtQRjL:fTAIZTEbuUDiinouy8tyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493901, "uuid": "18fa5c6f-97dc-4cf4-a94a-966e7d9fd160", "value": 35264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493901, "uuid": "6b6a2ca3-ced5-4f06-87be-324769fadb00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493901, "uuid": "bc70ad3b-3c5c-460d-8501-cfc64c4b1a79", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b9ac75-1fbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773502379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502379, "uuid": "8a16ef21-a134-405e-850b-de74afa7feae", "comment": "Malware payload", "value": "5aa636bfaff0a2f1d08d3bf891cdb286", "object_relation": "md5", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502379, "uuid": "83efcd1a-a308-4dd7-8689-dcaa6a1e3576", "comment": "Malware payload", "value": "b527c29eeb7427cb9e2b32b45f76185411ba55c95b40a774b053533c8b03433b", "object_relation": "sha256", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502379, "uuid": "eb081334-60ef-4e8a-a473-e01d070b671e", "comment": "Malware payload", "value": "dd4eaa687b434d2c0b2ae2e2390c10ff78e684ad", "object_relation": "sha1", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502379, "uuid": "082790d0-5496-4e3e-9510-951286372c19", "comment": "Malware payload", "value": "241f3d3bf9fd0f12d237ec868196d1b2c60402c32cd8646149c15436ae8412b2b4e50d42f27f93f288b085f94ee92d4a", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502379, "uuid": "3f80b913-aecc-4d6e-b838-0e51b4dbf818", "value": "T1A9E512C3E9681ED5F83A63F3B5A744D39AB078FE93A4947770A5F2624142291021FDEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502379, "uuid": "da8b1cb0-4a85-430b-b692-558b60607e41", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502379, "uuid": "33ac32be-61c6-40d3-b16b-d4c1d6d562a5", "value": "49152:+wMmA+qRD1vAOs/WT1W6Ogl2d/pCI87I5:+FrjRxvdsuT1W6Ogsd/sI87I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502379, "uuid": "2e0255f9-c1e1-4c1e-babf-b25c3dc844bc", "value": 3230718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502379, "uuid": "7e459299-d539-4650-a36b-094d919b61df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502379, "uuid": "8fae639e-d5ff-401c-ad59-f85eb67f230a", "value": "Setup Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4a57a0-1fbb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773502531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502531, "uuid": "9f65353b-0f16-4fe6-bb55-1fd637f7192d", "comment": "Malware payload (njrat)", "value": "a20db9a62dee9cec05208b5acaa8cbb4", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502531, "uuid": "2d8cc568-067e-494a-9c9c-7e1ba6c19448", "comment": "Malware payload (njrat)", "value": "b54ee709bc4da31ddaf192d2441806014cb528a9239e7864ba965999b2b50987", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502531, "uuid": "dca6c769-d780-467b-b778-b8619570a6a8", "comment": "Malware payload (njrat)", "value": "e58741a04b42c05c63feaa2e0baccb01866d79a0", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502531, "uuid": "49937692-5e5b-4e39-866c-3e9f651146d3", "comment": "Malware payload (njrat)", "value": "2dd9bfc4eced5b7a37a626cdb0f866dec19303ee9888c335076de593c36c9f32454468325d38fca75e5d690bb74947ff", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502531, "uuid": "98946ce4-04e3-4e21-a97d-8bf64f9d079f", "value": "T16677BE12B7E80166E4BB873098B78A12EA35FD511B31C3DF1294B26D2E737D09E35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502531, "uuid": "e28e062a-ead5-4bcc-b4e4-7e53cd9efb7a", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502531, "uuid": "1b6e26e6-7a4c-4160-b3bf-9ef95d52e457", "value": "393216:mp/jis8ch/3xrYlYdndlom+Fq5KNUm32CURM13BGMbKMCBs6qf8hOUwUV4YYyFP9:mpbAK/1jG137e+6qf8hOUwUVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502531, "uuid": "8c62873b-e8e0-414d-a9cb-9fbb65dcaeb0", "value": 34826752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502531, "uuid": "34bf7ec2-4fa6-4bdf-8fe4-aa7cea8c7340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502531, "uuid": "734b43a2-622a-4e56-8b22-c02ea2ebd61d", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263d17fe-1fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773517011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517011, "uuid": "17647626-2f64-470a-8fbc-63b06caa27b7", "comment": "Malware payload", "value": "af27d78a6c573951927a73085a947e80", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517011, "uuid": "c464eeec-8f0e-4ab0-973f-877dc0063ce5", "comment": "Malware payload", "value": "b5dce3c0d922012db229ba284121354730362cb11f4fedae4209cd264f9e7af1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517011, "uuid": "29848779-adbe-4aef-b225-76c13f436e00", "comment": "Malware payload", "value": "6c8a88b532a4e8f807d16f769eb29624b88f6e9a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773517011, "uuid": "8ee73864-0383-45bd-8202-cfd4e03449a3", "comment": "Malware payload", "value": "45efd18899442689270068f1adc6f0dd9f153ba96909277a26de2b2a9c1cbe348cbe5aa25ccd4dc302b456e2e38402a7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517011, "uuid": "0ca6538f-a874-4e81-b2a3-a8dfd7039c08", "value": "T116231A2CD3A146690242387884E2375648ACBC39DA93976FF7DD44E2DBF3C5A3720E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517011, "uuid": "dffbbb08-51e1-4538-b15c-b305927f8ca8", "value": "192:KkPSPa7P43Pd0sTP1hMxPQSFX8uK/MuTjYIIPYPSPtPsqWOP0PDPCPw:x0l0svMpX8uKkuTEIcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773517011, "uuid": "0779be94-7d11-4bca-91c5-a6408d7e3134", "value": 46615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773517011, "uuid": "2de60e0b-677a-48ef-b280-954528a87297", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773517011, "uuid": "42a016b1-eb63-4c6e-aeac-95c620765b7f", "value": "goodfeelwithbestjourncy.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1097cd-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515601, "uuid": "ca615b1c-1ab9-424d-bf21-fe0944616587", "comment": "Malware payload (AgentTesla)", "value": "16ee63e2e0bb8d87b160d019e02832d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515601, "uuid": "cc74f4ed-b30a-495f-a863-79877e18f32f", "comment": "Malware payload (AgentTesla)", "value": "b6d4adcf7a0771a4d088ed7b207bdbc293f31125d47883807d92b57ac1c4dce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515601, "uuid": "36ad2f29-dd06-45a1-9715-ff17c740fea5", "comment": "Malware payload (AgentTesla)", "value": "f1cd5ffdfe6dcbe6c1249b8379bcb4abd65e1396", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515601, "uuid": "e4acb282-b6d5-4229-9780-b3c76d4ccb2b", "comment": "Malware payload (AgentTesla)", "value": "8a8aab5788d3350a1abee9ba0d4c1c18aa359a471766906307d774ff1c18eab31cdd94fa0a3e96a459a2f4461207e570", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515601, "uuid": "0e975656-5149-4b72-86e4-790eb93e853b", "value": "T12C843931ED24065A0F9323DABDD5465089BCCA09D53694B2F6DE075E61068FCE3BE3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515601, "uuid": "ce71b9a5-c731-4dee-abb3-aa2c8b1f67a1", "value": "6144:ueR0a0A0e0q0Qqu07rT085050z3Ylh0o7C0X8B0b0j809/:GBXtR14NOHwNAXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515601, "uuid": "8aefcda7-1e91-4846-844c-271ede9c323b", "value": 398105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515601, "uuid": "4aab8f99-57fb-4722-9e63-63264c562743", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515601, "uuid": "046bc7b7-5898-41a1-a3e7-152fba8c1dee", "value": "16ee63e2e0bb8d87b160d019e02832d9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11119238-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493783, "uuid": "b16efc70-de07-4fee-92a1-3906484bcf70", "comment": "Malware payload (Mirai)", "value": "cbc256947a10815b372a41615a462737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493783, "uuid": "ebbee734-e372-4249-86fd-e3d8e523afd8", "comment": "Malware payload (Mirai)", "value": "b707599d55bb71d24c273a3114eb3babe65001363823cfdde8e193037df49884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493783, "uuid": "56d8be6c-8a2a-44f8-a83a-92a9802eac9d", "comment": "Malware payload (Mirai)", "value": "8e15720b64808481bc0e4eacd8d3d57f2ac91015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493783, "uuid": "bc2d72d9-270c-4617-89ed-3ec1ab039534", "comment": "Malware payload (Mirai)", "value": "6a244fa3bcde066bc7cf17407c3b3b4ea7bf369af76dfc7c3cf07d881eebf82aa6b525b8777854dd211183af2ed4c829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493783, "uuid": "69238138-d155-4846-aebc-fcc05cbc9421", "value": "T114259D2AB2B3B6BDD007C0304BDBCAA15531F0345A312D7B36C4DB343E9ADA91759B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493783, "uuid": "993c4e00-cff5-40f3-bffd-d173a50031e3", "value": "24576:VrJQUK3ev/DRqSNgstng/E44CU09e4ul4nFdkY:1wSNgO34R9eR6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493783, "uuid": "5e357921-d274-4937-a7e6-e7209e4d73ed", "value": 976088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493783, "uuid": "1b496d82-7629-46e2-bcc8-522090890d32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493783, "uuid": "e071050e-e7a8-47c6-a36e-a32b335cd608", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f7df0c-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516204, "uuid": "d5b2e7ba-bebd-4e2e-8bcb-ed823f37f48a", "comment": "Malware payload (XWorm)", "value": "4ca8dbc97ee90afc1f734eb24e182061", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516204, "uuid": "f50a8aec-0cf6-45b5-859a-7d4647983589", "comment": "Malware payload (XWorm)", "value": "b72b66fd622dbc007f49bd1a344192321258e1203885f1fd202b45c59d8c8a20", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516204, "uuid": "7407d7f3-9389-443e-ba10-120871a2bd94", "comment": "Malware payload (XWorm)", "value": "5746c8853480fc5f17abca24ff23d68a818c3c23", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516204, "uuid": "a2910c01-c45b-423f-805a-e144a8517e90", "comment": "Malware payload (XWorm)", "value": "74fcf689777e6d9fda4927226478be98bdf9695bbdedf7794b6ee14e43bf9b37254b98fad4aee44189281a64e2310034", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516204, "uuid": "337258ff-401e-46b7-bcb3-d85ecf55ee53", "value": "T1F535E7D68A318635ADC27F76D83A845E26CB389CD3529C8486F7CCBC43ED93158B548B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516204, "uuid": "73f04e02-0600-4581-8201-84684f03e412", "value": "768:X6uqfqcF8U8TDnS9e+HuMPEUIUO5TEQUdQEkkEU6IEpIP0TDAd6NPEUIUO5TEHx+:X6H7vW6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516204, "uuid": "dbd24f88-7e31-49dc-955c-22c17db26283", "value": 1163986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516204, "uuid": "206f1005-a45f-4c55-b2aa-49f2e22b487a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516204, "uuid": "72230efa-b707-4ecf-9f7c-1e6f64d1108c", "value": "4ca8dbc97ee90afc1f734eb24e182061.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23e17fe-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506589, "uuid": "474eaeeb-ba28-4a19-ad0d-128c23aefaaa", "comment": "Malware payload (Vidar)", "value": "159d1a9ab4d4e94ee074a0c1f9024436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506589, "uuid": "9732ff2f-9baa-4efc-b91b-32229a40f7ff", "comment": "Malware payload (Vidar)", "value": "b805348741dcadaa949bca46b041128aa604772f05e149918707cb4faa211071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506589, "uuid": "8d3c5816-6f7b-4fe2-9aa6-0205a848148a", "comment": "Malware payload (Vidar)", "value": "69c9a127838c44d4f1c04aab8f1d886c5176ab1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506589, "uuid": "d4b23121-0ccc-46db-a6eb-d322ec28f640", "comment": "Malware payload (Vidar)", "value": "632efdbe068a1e6c6744fec395f8db7961de70c722492115f949a64aa32e7deb3f03e6767822f7fba588b1d77093a810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506589, "uuid": "b3bdbecc-764f-4404-b988-2cdce410f751", "value": "T121B57B0BBD9548EAD4AA97368DB722927B71FC580B3223D31E50B5782F727E0AD75304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506589, "uuid": "7f4e21fe-22a4-4bf8-a7f9-ffd2f7e5f6a5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506589, "uuid": "891df896-0d6c-4915-8aee-417529ca9726", "value": "49152:JzgLSwG5ZKBNdT6g9zoqyiO5qEVI7WLaG:JztfqBB9zoqyiOwEeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506589, "uuid": "4b01b78b-e8fa-41bb-acf1-12a31a2f73ba", "value": 2310144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506589, "uuid": "723e19a9-2045-41bf-a754-53ba1040f874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506589, "uuid": "3c609140-03f8-413f-b30b-8dbe47ad74fa", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4e5ef6-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773515167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515167, "uuid": "9b0f1610-2244-4a17-b1cb-dbafb4b8321a", "comment": "Malware payload (RemcosRAT)", "value": "16e018fc38ef47a3f1fe62e46593660c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515167, "uuid": "a23eaf8a-3c1d-40bd-ab53-97064ad53c02", "comment": "Malware payload (RemcosRAT)", "value": "b89bc8bad5ac269240d796dab22990a8d730cb295532dff4b92bedf76d58615d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515167, "uuid": "6689dfa5-8557-437f-87ca-5e035e90cf0b", "comment": "Malware payload (RemcosRAT)", "value": "288facecc21a7c383e80cd09775c7d4c62ffdf9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515167, "uuid": "8ecb392a-143a-4f1c-b957-ada2c7d600ac", "comment": "Malware payload (RemcosRAT)", "value": "0dbefcc519768ca98067632ac1d238a8a51df41562d308fa5c8bfba84df8afebe5f541a42d28384b7637e68e220f776e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515167, "uuid": "8351c8f6-8a9a-423b-b949-a98d6f804380", "value": "T1F3150269B71B46FC75502131EE97E486AE1B01277C27A07DE444BBE9CAAD40DC3D8CB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515167, "uuid": "06de73ba-422d-48fe-b050-9890ca156912", "value": "96:GA3MloEYCXvURJqriYLXRTYYYBOMCLkgRGY3NULjjWJM8Y4yide/9LbVXVJ4lRh3:GRJPJy2KcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515167, "uuid": "1786349e-8117-4e4f-9d58-9f381829d81c", "value": 957741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515167, "uuid": "71439621-6a89-4b65-8bc3-73157eaed981", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515167, "uuid": "802efada-f3ee-4f44-b5b0-42ebaf15dd8c", "value": "16e018fc38ef47a3f1fe62e46593660c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bdf3cc-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486494, "uuid": "d1ea15f9-8a11-4d2b-8171-221797dbdad7", "comment": "Malware payload", "value": "aecd7b7d8f0d18a8f1477259e3b82937", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486494, "uuid": "63f05359-d6ed-4291-8cac-c38f0fbc0a49", "comment": "Malware payload", "value": "b8ae6a8df2f3120e256c427400dbe0c205d9914d74a28ae6ddaba1e98350a0c7", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486494, "uuid": "ff436cc3-7154-472c-94f8-54bce0efd301", "comment": "Malware payload", "value": "fec01c37e019686805cb1b2986f09b1817d2ff3d", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486494, "uuid": "79ab762b-f9e1-43fd-8709-6d8f2e596f7a", "comment": "Malware payload", "value": "4b43d143c427596cfbd58ed6460bbff38cc543ade14cb1b5550214b5c45167866ce583e2faa703e7e3115fdd1238a703", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486494, "uuid": "3aded5db-5000-4803-a5fe-1a1c335951e3", "value": "T1A1E055248330F5A003AD708051257E4B20851F929BB75BB9E12208447CA17EAFF2B28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486494, "uuid": "90b23e0a-9055-4bc0-ba1d-3d9ac3ae7848", "value": "12:s8hZGrO6hsRpX+lIJl7btpsCoMADXtQFjohognia9kM:rZGrfOOlIrbtpRoMAGF0hognZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486494, "uuid": "be8dfabd-2b7b-417c-b61d-e4b88b54545c", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486494, "uuid": "7faa1ade-ff57-40c8-801d-bec0dff2c8ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486494, "uuid": "52ee8688-6b7e-4a51-9fe9-f0eb27e69085", "value": "10ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd255a1-1f53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773457699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457699, "uuid": "96d4a39f-c1e3-4625-be15-1f4571b88edd", "comment": "Malware payload (Mirai)", "value": "6bc5f2ac373e0a0184f0be2238fc221e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457699, "uuid": "7c562d5d-508b-4acc-95e8-d2ea9dd3efa5", "comment": "Malware payload (Mirai)", "value": "b988eaa416e61ec5ecefa04265e09766e3ce90be6e6b0808335e3301fddce7d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457699, "uuid": "eef4578e-d168-4cf8-ac9e-a07904be9915", "comment": "Malware payload (Mirai)", "value": "92617dcb63b3343aef540657409e592e87e69ba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457699, "uuid": "9a0866b7-dc54-4125-9e50-d41e33571f78", "comment": "Malware payload (Mirai)", "value": "db22d959cc355c11b82916dfd3cd2ccb9c965b40bef773928eaa82da2e32aa54c009bda8bab01d94a4c7c3065b9d7ca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457699, "uuid": "9326160c-57dc-4e7f-99d0-cacc6530eb44", "value": "T177834A02770C0A47D1A61EF4393F17E193EEE9D121F4BA882A1EDB468175E33158BED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457699, "uuid": "c134d2ab-22ac-42e9-9990-24ee236d4a52", "value": "1536:Ppya2ZscK8vxh0Cwpcb26d7IVPsOfwfePo2V34UBlc2G7ypA78Qu:9b6nwpcK65MVw2TV3RB2p7yeoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773457699, "uuid": "e0707a8e-26ca-4664-9de2-210ff9371c52", "value": 87280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773457699, "uuid": "40ac7185-7d7f-4957-9c8d-d1e49042b8f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457699, "uuid": "fd40f978-2372-4655-87e8-e5d74f0e3588", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab5088a-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486551, "uuid": "9d3cf52c-c3cb-49f0-879e-5560cc9c03af", "comment": "Malware payload", "value": "855b1a5ece6b370260257d15973dfe5e", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486551, "uuid": "45b88412-45ac-443a-b790-b1a7d09182e5", "comment": "Malware payload", "value": "ba256fec9d0ca64ee644fcb8d63b257bd18d25b891ad5351ed423e6a199ffdb2", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486551, "uuid": "12e15a47-0dfe-44d1-ab00-346141bfa24a", "comment": "Malware payload", "value": "2e92d3880bb3ee9c668811351e75695cbe2ef18c", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486551, "uuid": "9a27963a-e80c-40fa-85a0-b6ed9a54bf0d", "comment": "Malware payload", "value": "ac55c9ec802d105d9e7a8bc969774451b02d9e92c35733035cda2ffb494fc91a19389312841c12ed421c25fde06eacac", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486551, "uuid": "6dda6b66-9e43-4e88-8bf1-27d3f30a568e", "value": "T128E02B249334F4A003AD70C055357E5B10D66F529BBB4AA9E62205547D916CAEF2B24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486551, "uuid": "6026c7ec-5638-49ad-9d05-b7a033adada6", "value": "12:s8hZGrO6hm3+lVl7btpsCoMADXtQFjohognia9kM:rZGrfM+lPbtpRoMAGF0hognZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486551, "uuid": "a514bbbb-33f6-44db-85f8-7797cc62c0ee", "value": 421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486551, "uuid": "cc628bc2-d7b2-4ab7-b324-556569ffd84b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486551, "uuid": "7fad7977-0e9b-4e08-b149-f5891c442736", "value": "4ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5014edaf-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494318, "uuid": "b63e179d-a374-4ae4-a260-56cdf01873d6", "comment": "Malware payload (Mirai)", "value": "43da4743c46dfe479530e044d8548f00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494318, "uuid": "0dfda4fc-ed76-4528-af26-48243785e5bd", "comment": "Malware payload (Mirai)", "value": "baf4d6177930793e06dc9602c9bff025becb81a3c94d07f66e7d303b0f39c305", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494318, "uuid": "4d5d2ce0-bc2a-4140-ad1d-92e8e86fcc5c", "comment": "Malware payload (Mirai)", "value": "8d8df4762b1ccfb03eba02474988de9409498724", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494318, "uuid": "c33e0ddf-a042-49d1-a887-0a5a6ccbc4ed", "comment": "Malware payload (Mirai)", "value": "66251ee6aafba0da821490c942875da5e1125ed07028b0e54f9be4a87895b78f41d4226e7889ec6f76dc54ee4a242645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494318, "uuid": "dbed3e95-58a2-4f58-ad8f-1d6db9201343", "value": "T10183199AF800DDBDF80FDAB74463490EB931E3910A931B377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494318, "uuid": "c999611b-08ce-462e-b007-5eb25378b606", "value": "1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7I6n:4G5hLsd9lJP4npeqp+psrbI6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494318, "uuid": "ebda7ca3-f735-493d-976e-869edde36306", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494318, "uuid": "90cf8b3b-ff89-49e8-a265-cfa1e415fa02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494318, "uuid": "c78d632c-b8fb-4eb0-b0ec-d7a12465a44a", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963fedee-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515051, "uuid": "ab3ef734-3d8e-4be2-a560-4703627f5199", "comment": "Malware payload", "value": "ac80c9529f5a3c3b4dc75f3a9663060f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515051, "uuid": "0d03cab5-dcfa-4554-ac98-8ef89e3f314e", "comment": "Malware payload", "value": "bb02896ba092bc2d5f8cfc61f8a282d3857416330523cf12f815d0c96954e4e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515051, "uuid": "57b83c3d-edf3-454d-9587-a4e1b5288229", "comment": "Malware payload", "value": "7d0c04fa7a84a38a0269f7a9563703715a9fa11f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515051, "uuid": "0cd521e5-f181-4005-84f6-1e6e4d88ce8e", "comment": "Malware payload", "value": "37c88c7851a6e98d092439c81fb2d81b97ba948535ff0fbce04eb47fbcf28e26a8fcaa214ffe82c881f2abf075d7324a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515051, "uuid": "eae26885-ed14-4243-a76d-a762852274e6", "value": "T14045D6DD94BEE8E662A56390C80571104816ED7AF04B867EFD30C3FEDAF545341BAA38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515051, "uuid": "a63b88f3-c663-4a28-acf4-9c8ac2a856d5", "value": "48:2DoeWSGWOvzHbava1z8gfHmWLLupTnB3cNLqxR1DTGBw1nBhLLMLwSY+Vssvj1UV:2+Wyg2CUFaZWvwvoI9af5tvM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515051, "uuid": "7e7eca04-164f-474d-9e20-094099987b0f", "value": 1189216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515051, "uuid": "4d60e9e4-c20e-4a50-9439-82a4ac3e5403", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515051, "uuid": "397c1150-26d9-427b-9ed2-0ae0eae3510c", "value": "ac80c9529f5a3c3b4dc75f3a9663060f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2158ed95-1f92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773484791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484791, "uuid": "acf81494-35f9-4962-91c5-70f5bbc82d0b", "comment": "Malware payload", "value": "b0f0b354902f9a36a530d6ca0ba8b43b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484791, "uuid": "24e035d6-2a75-4de6-aa69-8c3a70175a2b", "comment": "Malware payload", "value": "bb033aac43e985ab6a097a240c9af837bed863eb1de83a1e13e394df7faa0c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484791, "uuid": "1958d5a0-5def-4d4f-9569-f608450a0392", "comment": "Malware payload", "value": "1cc6cd650f1c3ce14aa39d3660ebfd793546f447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773484791, "uuid": "79de9148-c19c-4568-8327-b658742d0577", "comment": "Malware payload", "value": "14fe7560cbba937a23292bcbb46c3edd0eefe211e0f409d9ac1a7ece651edf7b0d1e656e334d17ef00eb0a41fa522f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484791, "uuid": "928670d6-3a4e-42c0-ba16-8124265a8e2f", "value": "T109187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484791, "uuid": "1270f149-2c17-44ca-a552-4537dc131127", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484791, "uuid": "008d23aa-ad41-4349-a4cf-ca2c93fbbed9", "value": "786432:KAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:KAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773484791, "uuid": "c428095f-e7b6-4482-8e29-a1fc20ad5782", "value": 90247168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773484791, "uuid": "5246d8b2-5127-4c8f-809c-3337def42e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773484791, "uuid": "2cdcbf2a-64aa-41d7-8c18-6385efbd74a5", "value": "cherryfaceit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f2358d-1f94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773485597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485597, "uuid": "9a5e98d8-bee6-4019-8851-bf92e8e51e8f", "comment": "Malware payload", "value": "71384e976fc8a40dd0583cd4a99d4d67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485597, "uuid": "f2867c38-b39e-4464-abbf-a6cdf9deeb91", "comment": "Malware payload", "value": "bd9b08dea8420fe8ce51a30edaf1eb289b2df605b502aa71e193524e5fe19654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485597, "uuid": "b85aaef1-1458-4bf8-a347-e1b9a5e3c5ef", "comment": "Malware payload", "value": "a5ace1a66bca9aa07e55da70c11f2d5a70bde12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773485597, "uuid": "236d056f-e3a5-47a6-91d8-73ac34623561", "comment": "Malware payload", "value": "c9865ccbec5fcb1c12063723bac006b1ad8309988cf3e84b22384442d09527bf153b07ad4d05f37b6324fcd3fc1b9a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485597, "uuid": "4ff22b69-18ad-4622-a19e-7d00c1b8a92c", "value": "T100579C19A39815B9D427CA74CE41A233D2B1F97E4726D08B0A9DD70E1F73E918F3BA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485597, "uuid": "98d1ac85-f847-43ca-81b7-8d4e8a5d724d", "value": "9bad55e74bad1909944ad2c6b5915bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485597, "uuid": "9369a61e-7eef-465e-b141-5b832a7f1d88", "value": "49152:FAYJaDRRUciCg2m3NGVUESuIK6VNep7diPm3YAANjUCPqgTX80N1o:+NADVvPm3YAANjUCPqgTX80N1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773485597, "uuid": "f820d77f-cb2a-414e-8a64-aa7de8d66872", "value": 29406208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773485597, "uuid": "7b2acc06-e930-433a-a6ac-a3d22eb9db13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773485597, "uuid": "192f982e-0f56-4c82-b2ca-d5af02101a17", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae78d4d-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495222, "uuid": "19bc7e6b-8f9e-4922-bb7d-b8c93b4fa0d0", "comment": "Malware payload (Mirai)", "value": "e7d423640110f47d70ef537544739e77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495222, "uuid": "1a8ec3ee-57c8-4c6e-95ad-da5e76c8c2f8", "comment": "Malware payload (Mirai)", "value": "bdcbb8d34dd4ee0b5ddf3992510e72d169cfff991279ad8b67d292ff3b5899e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495222, "uuid": "719fadbe-fec5-4fd6-a11e-c992bd4a913a", "comment": "Malware payload (Mirai)", "value": "a2b7549c86baf2ad3ce623daab01a167fbb8f6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495222, "uuid": "02aa1f15-b4dc-43ed-8f7e-f1b040a8fb0d", "comment": "Malware payload (Mirai)", "value": "199822ac15c06bec2d375dcab91212d8a5bc04c728810b7ff9241bfd9f1d42660340843353e2ae7220c46946d2ea2b08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495222, "uuid": "eafc51ff-6fbe-44b5-a571-2e3a72f7c280", "value": "T179430139C001D570FB06E6B58E2581AB6C471E39E0FE68471F0499B839C2A1797EE1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495222, "uuid": "474ab79c-f09e-416e-b7a8-96f69ef3c3d4", "value": "1536:EPS4tGYKkP3QrRH1r3rjOloPH3FdLCYYH9re:EPltGw/QZ9Ol03FdLCYo9re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495222, "uuid": "6bb6ff85-e5bb-40ce-8c23-85ac97282d4a", "value": 59072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495222, "uuid": "c8710379-d75d-4ad6-9356-3f139551e1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495222, "uuid": "75207ac0-c8e6-42a6-b9df-7cc4f6b94ff4", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ff0dde-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773504253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504253, "uuid": "848d94a2-fde1-4a51-82d0-e2626553c708", "comment": "Malware payload", "value": "a488ae7b95c6b2cc45f0a5c2b5a3769a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504253, "uuid": "12a4dd50-5d2c-407a-ad90-469a4e8a7ad3", "comment": "Malware payload", "value": "be08e0f9a9364d5ec86e61b783d8ed6d1c63a5d65ce35d34af66415ed442a789", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504253, "uuid": "20bb0cc2-def3-40ce-9de4-d1fe32e09686", "comment": "Malware payload", "value": "b164f2db8471e475e8dfdee52c6b15f4fdca1b92", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504253, "uuid": "e800690c-09b8-4135-9078-5687779ec7fa", "comment": "Malware payload", "value": "aa1c85f67e0178df50c7a00fe0d9e4d5a4180b709f453f12f803041e798093273db44fcfea22e787ffb19a1a0024995d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504253, "uuid": "3aa55e1a-2a7b-435e-a64a-622baca5a3ce", "value": "T161546426ED875DA383D3DEA3D1E7D31CBEA844DC810B5EC4B5B9C2865861D6A0788F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504253, "uuid": "34003e6d-7b39-462c-8699-80a9f69fe01c", "value": "1536:tAJhMcT6nHZx42rPbFmYn/YUtpOit2Erz2kw:tkV6nHZxdBmYn/YUtpHt2gz2kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504253, "uuid": "19f26442-6870-46b1-b11a-a40ccf9c8a45", "value": 296488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504253, "uuid": "b05df536-b036-4c16-86ad-d796143b0523", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504253, "uuid": "752c86b8-3991-4a07-89be-b616f36116ef", "value": "test_seeds.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9478f709-1fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507747, "uuid": "92f3239c-8c3c-421c-8910-f2e4b06adf47", "comment": "Malware payload (ACRStealer)", "value": "fb500de82cd37d8c14db9ab7bb5470b0", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507747, "uuid": "bf6634c8-f964-4e46-97cc-69bf1944007c", "comment": "Malware payload (ACRStealer)", "value": "be30ca153d627b54132cad9420327df85b3b75f094840a5948dbc26749683443", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507747, "uuid": "2389133b-1259-4d10-bb57-27288f3083e7", "comment": "Malware payload (ACRStealer)", "value": "b3abbd97f1de9ef88637d24e64c080acf2da606c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507747, "uuid": "eac6916c-83ac-4bc0-a581-39b09d40d662", "comment": "Malware payload (ACRStealer)", "value": "4454eefe553cfbb1314a984011cfe72b2a57ee1e5049afc31e05d0f298370facd17c39405b31c369dca04a6553e2e0c2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507747, "uuid": "7d0a3188-1a98-4bea-b8a9-28daa424493b", "value": "T1E1A53B8E50DB55BBFB4B4C77401AA3CF6F1E6D687A20CD51C2AC6E56FA723A25031483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507747, "uuid": "a2c50836-19c6-41b1-b376-288d411bd8aa", "value": "dc8893bc3b4bdf7c712ea6e721916ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507747, "uuid": "65bb6e4e-3db1-47b9-8b94-d4f1ba8940f8", "value": "24576:okFX8xGhS4aJ8v05mp9gR6lFdyCPCExgeLQbfUdzG5V8sQhStojX28e:9JCWRCEOecbsdzOK1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507747, "uuid": "2ceae469-19fe-49ab-95e5-884b58e4fdb4", "value": 2105856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507747, "uuid": "55d3aa28-daf1-49a8-b62a-c795e6c901b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507747, "uuid": "cbb190aa-b033-4ada-84c6-1b175d63a59f", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5c5510-1f89-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773481188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481188, "uuid": "b0751674-30ce-40fa-ae11-fc34ad49ecde", "comment": "Malware payload", "value": "ec369e11ed77f708ba3397dbdbd7d7d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481188, "uuid": "b8b64c0c-57c8-43ba-8538-412fdf96b6b5", "comment": "Malware payload", "value": "be33d157d949e718fcd73b9f9b652320ecd87cb9e197fa034969ef4c65b3c83a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481188, "uuid": "b23ae266-f55e-4906-8192-271e7fe149a4", "comment": "Malware payload", "value": "be7aca583b4d9454ab42fa59f0c6585cf0c34871", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481188, "uuid": "1653435b-8095-44b7-a56e-2850f0e4f2e2", "comment": "Malware payload", "value": "6aea5f764bcc06a0afc195e8f944ab358405545f100e51e7d3c3257f1d7e9e963c30156c0cfb224dbadccfb30d590338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481188, "uuid": "1b0bdf67-9609-4de6-b0e5-7f1b09cdaa99", "value": "T15FC22A74BEB74DABC4816131B1EB8318B2F6534E28F45E2E3C621ECCEF449546216A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481188, "uuid": "a62d72da-6be8-4a4c-9e35-7fd89ae93fce", "value": "384:fhR9kfJ8GjJGM4S+kJtzjpvnkFU+f/7YUlgGaq:fdk8M4S+6z9MO+37YxGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773481188, "uuid": "24a54d3f-7191-4546-a625-232d9ea7c758", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773481188, "uuid": "e834b900-7a24-42d4-879d-5cd07289d587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481188, "uuid": "a6072174-113b-4b8f-b542-583d2432b14a", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced87858-2001-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773532756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532756, "uuid": "12338c9f-8f8f-42f7-9d8d-d4a4a320e1a9", "comment": "Malware payload", "value": "c923cfd44de873d6665a2e4902621ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532756, "uuid": "384075ce-7dad-4664-b6af-0ae1570f27a0", "comment": "Malware payload", "value": "be60e407cde68178a7112d457a517486bf41d9a4bb475d3f6808569c745132e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532756, "uuid": "2d1d0f76-4a74-4418-8580-e18cb676c4f9", "comment": "Malware payload", "value": "541e1413fbe8fc697788516adc0c6c03f6c05d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773532756, "uuid": "7e162478-9543-4630-b257-284c91a571f9", "comment": "Malware payload", "value": "b563c983bd8ea4033fde721fa82bc0d4eb784f95718d252d300503047f4fa3d58e52482021caf43cf0f03c9b506c0ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532756, "uuid": "0c2739df-589b-415e-bc6c-7500a78e2cb6", "value": "T1B7E7335092B06919CC4DCD3981A1232ADDBF1CA8BE17D7CF66CD26C8D0B4F6524C9FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532756, "uuid": "ec388513-ca41-4e63-9f34-4a5d1e6177b9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532756, "uuid": "b849e5bf-4318-44c7-9b1e-77d4898de6a4", "value": "1572864:yte6nrLoxXJLTykmot7o6BpkYQDlayu/NRxW2O0/MPY7:yFrcdJLTykmQPpkhCV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773532756, "uuid": "5a55211d-ad99-4cc9-9ddc-3f465213add4", "value": 64637918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773532756, "uuid": "e30d5b0a-53dd-47c4-b7c5-63fb9797b6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773532756, "uuid": "0a50d63c-1577-43e6-87c1-b816b2f782c2", "value": "a497bd4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1ee8bd-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515571, "uuid": "654f64cf-aae3-4699-94c6-f2cce6556774", "comment": "Malware payload (AgentTesla)", "value": "cf07d6e8651190d473c41886e0edf13f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515571, "uuid": "2a226744-a490-4a3b-afc9-fa64ff93db01", "comment": "Malware payload (AgentTesla)", "value": "bf293a4162dcfda272b65d269650607fbd9f64463b14a0d3cda5abb207784805", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515571, "uuid": "93eb280c-e2eb-4332-96e8-2e610098af30", "comment": "Malware payload (AgentTesla)", "value": "6131faf30c70c81082feae1996fb4d5b9fc9a251", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515571, "uuid": "2572aff3-ddb1-4b88-8a2c-798b5dfa65f9", "comment": "Malware payload (AgentTesla)", "value": "f0d4ad333942448a4679f5953c8fd3225f091f210715cf695d0d2f6de6bb8edbc4479334d00ae2fb969293cc3a6da6fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515571, "uuid": "4129b15b-89aa-44e7-b10a-431a03116d06", "value": "T125844A31ED24065A0F53239ABDD5465089BCCA09D53684B2F6CE075E62078FCE3FE6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515571, "uuid": "23159bb4-e57b-429b-b202-011d53626576", "value": "6144:Gey0a0j0r0W0XYi0a0I0S50zC0h5ibP0qQ80l1n0g0Os06H:xBYQVgdXzZvts3Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515571, "uuid": "01e97ffe-23e0-42e5-a728-15335e3a0fa7", "value": 398137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515571, "uuid": "a4583503-8d05-41ac-ba2e-23a2d5e7485c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515571, "uuid": "b892a0a6-9c96-4226-9f53-b30f05521b7d", "value": "cf07d6e8651190d473c41886e0edf13f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8353f575-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504282, "uuid": "6519efc5-2b5e-4dd3-a5a7-ac7efb1ff67e", "comment": "Malware payload (Mirai)", "value": "da9b972aba6e7366dccc232e542b8109", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504282, "uuid": "e7a98cc8-517d-40c7-9f80-21f578822f28", "comment": "Malware payload (Mirai)", "value": "bfbf271eca3d08b58433f0bbb817a6f071463ec5057cacc61f444d8a3f893fd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504282, "uuid": "3224d9a4-fbb4-4557-96ac-2ca2b3aaf5df", "comment": "Malware payload (Mirai)", "value": "2584f665813dafffce5cf95cce91e9739536c7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504282, "uuid": "c0d716b6-dd16-415e-b9ac-6dd59d772129", "comment": "Malware payload (Mirai)", "value": "a63f0eca3dcdd599f9a8867c32abf52d9a5db846c2ef7fb0158942418c88bfbcd9b190aee3ad8f4b7667109bbc546913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504282, "uuid": "4a08ca50-6807-44eb-ab61-5f08bcaaaeb8", "value": "T1D4131A41F30D0943D1632EB0253F2FD1A7ABAAC222D4E645751ED699E0B2D339946ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504282, "uuid": "34703338-7be4-45d6-9a25-919fad8e6123", "value": "768:PG7JrnlNiQLgdI9OhABtqKslMM5GFwptwZ2w+EIf:P0XiJgOKBvslMYzp6Zv+Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504282, "uuid": "e713a081-b776-49ef-a73a-3da2245a229b", "value": 43456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504282, "uuid": "e3a123b6-5d59-40af-ba37-9c73c32f8831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504282, "uuid": "af221dd0-ecc6-4e35-b093-21b57e2a6608", "value": "wlan.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7b0db6-1fd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773514174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514174, "uuid": "348574d5-9e5c-46c4-94d6-9de5bd05a70e", "comment": "Malware payload", "value": "f80a919689c2ed46faa7cceca8ccc1ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514174, "uuid": "34337bb4-d5a0-4c59-93be-a512587691b9", "comment": "Malware payload", "value": "bfc95b7311c864697d561b2c81f89e95b56c858ff5f87f6b0ccd7e60750a4fc7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514174, "uuid": "d6c85b1a-bbdb-4a48-b30d-c6c196d15009", "comment": "Malware payload", "value": "54b032062fe133e4418b787d66fa24151231502e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773514174, "uuid": "e56a45bb-0242-4191-813e-e4533042b557", "comment": "Malware payload", "value": "252063cfb2725207da6a152de4ac100183174cc43e8d5b31e0ed77af17292553829a3f0dd01d5d4d03bb0ab36b8deff9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514174, "uuid": "fbad700f-ac31-49df-a156-a069dce8df51", "value": "T12C141E446AC4784017471B7B3B1FF8E9F86F0DAA3849484BD155FCA0E1BA706F9E1A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514174, "uuid": "ca59c95f-edac-4412-ba6d-b43d0f5a265f", "value": "1536:0vDutB8rQYh4DLjakkatHsko6KgXy5K4m6CRG3L6YJk1rqGu4+wfjiRja8vPIfBn:vWg3o1Lkm4Q6KUUejm1jbfl+imZjH+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773514174, "uuid": "6c57b6ef-e66a-4230-9309-7d35d0339725", "value": 193251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773514174, "uuid": "3194a15b-b033-4290-b3bf-f8c4c8dacba1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773514174, "uuid": "950dda02-e8c8-49b3-8bba-0d0ec1f10430", "value": "f80a919689c2ed46faa7cceca8ccc1ca.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd87e8b-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515678, "uuid": "5209ea58-a532-44ca-a64b-f3a72efe650b", "comment": "Malware payload", "value": "4d9b0b9afbc063b62178c532f64f2926", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515678, "uuid": "602aa19c-6fe7-4e85-87c6-6c75739ad5d1", "comment": "Malware payload", "value": "c07739f375f698e85a1fcb67cbeefe6f3bfacb06e4346f431400d076c9317d28", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515678, "uuid": "d80b89fb-5bea-4a03-8b7e-208d0cc80bcb", "comment": "Malware payload", "value": "f887afe9f8fd8b5a831cf56afa48921e07358191", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515678, "uuid": "4a3de1f3-c437-4c6c-8e0c-921391134a4f", "comment": "Malware payload", "value": "e33a961f3c8e79202fffe2a7c1e9d734c57acb98987a08800f7e5d2555f8423667512d5c1741fa8afd5fed51f89aeadd", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515678, "uuid": "36832257-7d32-436b-a5d5-fcf7a3ca1c30", "value": "T10BF41218F4D6FE6BC916253992A490C9C220BC17EB69C3475FDC3B8D6471AF892D443E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515678, "uuid": "10d810b7-dcad-4a5f-9342-fc69e7bdbc1a", "value": "12288:dgBtc+rVILg1YBqwGA9eVrVw6ozu7SBuhm27qKlgfzUL36X7hg6q:YULg12lMVZw6oyw2m27dlgfzULW7+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515678, "uuid": "afd73013-a61b-4441-ad72-b38a13ac122e", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515678, "uuid": "c6e10fc4-289e-4162-a93d-b4068cb73006", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515678, "uuid": "aa6f67b7-8331-49d4-a2e1-887bea57e1e5", "value": "4d9b0b9afbc063b62178c532f64f2926.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902c157d-1fce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773510746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510746, "uuid": "bb81680d-0d61-4274-97a1-2b3df46b95f0", "comment": "Malware payload", "value": "eeb2010bdc95ddfa3e1d7c4b3b1f0ac1", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510746, "uuid": "58203dab-e5ca-43e7-af96-b38ca7b01131", "comment": "Malware payload", "value": "c0d30a31bd193e5b2cbfdfded8c46e472e025cca789c074275f80047fc0b8a8b", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510746, "uuid": "5610ccc3-6887-44b3-ac88-67103ab1cc60", "comment": "Malware payload", "value": "a35ac02af5c2dbb087106b48733defb9f1810ec8", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510746, "uuid": "6a2ee23a-beb4-4ba2-a94d-1a82d7717fe7", "comment": "Malware payload", "value": "4cc5a96c6994b751ab9c974d1a2c91ac1bca524133d1dd085f24afb2ce57e9896cf9bd7ede5dfb19cde082930f68c27c", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510746, "uuid": "360a6bf7-a9d1-46af-ac37-6f20fbeeccfc", "value": "T13FB423CD64BED0A87B658DDA9FDCBFD30CFC403A6D7526F2A51C1A13A0C400B64A958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510746, "uuid": "f16725ad-38f6-4f0b-804d-ba827cf3e454", "value": "12288:UB/e4pqNFTFbEXkdDoGbDDGIabs/7iiEVwYg2l3/2NyM:UBm4pgTXoGTabs/7iiWw0DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773510746, "uuid": "883d2bca-f264-44d3-9cba-fa93cd6a9db1", "value": 510128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773510746, "uuid": "dd365250-e63a-4f4f-b6aa-17b5ec9ff1b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510746, "uuid": "e58a7258-a0b8-47e9-8962-4e8d48db1049", "value": "coding-kit-ai-v3.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c80ae9d-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494312, "uuid": "ccac4c00-641a-4896-8fa6-beefe6794ca5", "comment": "Malware payload (Mirai)", "value": "326412b1391aa7f97af753f3b01cca10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494312, "uuid": "786d4f30-bada-43b5-a456-302c4ac169f8", "comment": "Malware payload (Mirai)", "value": "c280c2d767db6b6bdbc430519a9d67b9a27e03983ad0e165f831ca4d2dbd956e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494312, "uuid": "595eec2b-fa6f-45ec-b1c0-4b3009ab9081", "comment": "Malware payload (Mirai)", "value": "905248a7b4351c3a75b32585c7feb75919ccd863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494312, "uuid": "24a8f0d1-0a50-47ec-abc6-4c272f559897", "comment": "Malware payload (Mirai)", "value": "939d9325b1b574f2df3b676a3edc682ec76d51da2607b99c5e231b9010a11da2d9153380a7d71e1e69b3b7c8fd41fe66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494312, "uuid": "a80fe56a-2e99-4773-b91d-b1d00050af57", "value": "T1A1639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494312, "uuid": "6563d359-f5c8-428c-bd45-6d84997bce1e", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udp:DYkwfCFlugsz9xznsxrdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494312, "uuid": "5a114304-db83-4b9f-b96a-adfcef8c3eb4", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494312, "uuid": "7a3b2ad9-172f-4ba7-8970-1267c8cc6cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494312, "uuid": "b65de99a-71b2-4266-8234-f32f3dae3b6c", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c9442c-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477445, "uuid": "771ece17-b360-412a-8939-008284c27dc8", "comment": "Malware payload", "value": "ea563f51c3abf088f0412d2577bc8877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477445, "uuid": "8d88ac03-caf1-47db-871b-ee3326761320", "comment": "Malware payload", "value": "c29297ab22c8eef2ed6212c88b04bc5b19b5c337444e5c2d708df889e13282eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477445, "uuid": "a5341159-3bf4-4fc4-b9a6-b545d2f5fd06", "comment": "Malware payload", "value": "9fa627b21b979160bb934c25839d0db0b693e74f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477445, "uuid": "3c433543-ca14-4b78-8ad6-55772c7095b4", "comment": "Malware payload", "value": "3a999855d5ed2c3da10d50344b03f9ffcedee1209193171d4b91f015779efb7fefa74193630430449eb06d632d4645aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477445, "uuid": "353db7a9-c9d9-4432-aa02-1a5cad1d5794", "value": "T14446F705AD842BE7C42C4F7495E6CD6522B01E140AF14B3A26A5FFE9BCB62747F0399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477445, "uuid": "c6ac6ac1-440f-417f-8895-e4c8f5ba3527", "value": "49152:YzYDt2QsZfbpswDWvb96InSJQ3JljeVOl:Qsw6ZnoAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477445, "uuid": "0564d6cc-b15f-493b-a31f-5e6cde24ec76", "value": 5767168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477445, "uuid": "81611b00-a6ca-4d86-80df-6a65fbafa339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477445, "uuid": "bb042733-ee1a-46e8-a2be-452ebb5b943d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d3ce0f-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495242, "uuid": "ebe4fb30-c2d7-4c72-b7ab-c47a2f2080ae", "comment": "Malware payload (Mirai)", "value": "ffa7ad808c073922c7118141d83739af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495242, "uuid": "c24028ab-e999-4b46-a0a9-035d0bc6ae4f", "comment": "Malware payload (Mirai)", "value": "c3298ddc57e0dd95cf31a597f3615ba9b4892e80aa5457766d778dc3e633b79d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495242, "uuid": "165f9615-aa66-49cb-9454-52f1cf04cfc1", "comment": "Malware payload (Mirai)", "value": "e44711eaf3c0dd6960e2c0509af1058a4a8a5bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495242, "uuid": "b169b0f7-1d61-470d-9283-397135ca1f36", "comment": "Malware payload (Mirai)", "value": "4f103ba5dbac3064136bdd28e83891bb5e61ee170e8f6f79a171611c847f260b1645898b034679a9cf79dcb37dfcb3a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495242, "uuid": "83a64ea9-6fb5-4d47-9878-4026ba1eda1c", "value": "T19A832952BD419F13C1D221F6FBAE054C3715BBA8D2EB3243E921BF9127868DA0E67311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495242, "uuid": "1364d3b3-33a8-4ad9-bf64-064520af0354", "value": "1536:u8G8XHN77q3is1D7QIGG56BcbpBGuHa3wpJQc3l61d6hake:u8j3NKF7WG50cbnpwwXt4Uake", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495242, "uuid": "a1578f54-c1aa-4c77-bb06-97c425297cf9", "value": 88468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495242, "uuid": "0f35b622-ef37-4930-8066-73cdb6bb2c8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495242, "uuid": "a151cf59-d173-4953-b839-7495798bca4d", "value": "xfr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e382851-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504274, "uuid": "ab08447b-544e-433b-8341-c8c859911a22", "comment": "Malware payload (Mirai)", "value": "c4698e442826a7278eeb46dad0b9ffe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504274, "uuid": "aeb73e9f-fd2d-4613-85b0-a68a3b4596fa", "comment": "Malware payload (Mirai)", "value": "c39cbdab3346012b5bd8963be09dd793f3e3f4d6f147c3081db38ac7d56ca190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504274, "uuid": "27bc014b-9643-4515-812d-40f62feac97e", "comment": "Malware payload (Mirai)", "value": "b50f0631b157b726b66721779292dff650f47b50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504274, "uuid": "90d47fbd-6697-4a57-8b43-cf77f97687cf", "comment": "Malware payload (Mirai)", "value": "657b79a1051caf71a07eb482e61aa94a0ed7a376ca3cdc5fc32e21f35ee932ff45a899a09ffcf058cfca5ed4dcb95a9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504274, "uuid": "8e9af4fb-c8e8-4fa2-8c58-2d526555fec5", "value": "T105130995F8829A17C9C20277FA4E87897F2663C8E3DD73039A266F2037979270D5BD04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504274, "uuid": "90e801bb-e7fa-419c-b2a1-7f6f12d871a7", "value": "768:l3ZU6wH0W02rGRxRroM7gB0vafgNMSQ15dAw+QI:JZep0Bz7gFYN7QNh+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504274, "uuid": "b06d30ec-b483-4460-8975-82eb9c8b6979", "value": 44228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504274, "uuid": "573f5cfd-02be-4237-ba54-e7d0e8c04583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504274, "uuid": "5e518a09-0dac-4c61-b4c1-e0fe6c0291ef", "value": "wlan.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32648fd-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516066, "uuid": "f97fce20-44ec-4724-8ca0-94ed94089fdd", "comment": "Malware payload (XWorm)", "value": "185587ce8415c203252f5daf3be5911f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516066, "uuid": "bb8b1e76-c1d7-41a0-921d-0c650feeab5b", "comment": "Malware payload (XWorm)", "value": "c3b55713df418e6bfc1862a39c99d4ee3ec5e0921d773850647ed772b5d2b4ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516066, "uuid": "f9a14870-c5b4-416e-9dc6-13f49e30c6d9", "comment": "Malware payload (XWorm)", "value": "78094e911e6a04080c37d9f62d64c94dccaeb3be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516066, "uuid": "6c8198d3-30c5-4187-84ba-5cc00fe8418c", "comment": "Malware payload (XWorm)", "value": "2036c900a3d8c056b8a875e9bc884e12d86350d7fec680f39128f9f0d12ee8ddf6f689c23537b565fb53288a2c079551", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516066, "uuid": "4f0425bd-6787-4a8f-b5b1-7768782b1619", "value": "T1AC450147E2B6DEC6178682511DA0EC85EEE0DE5C330B516C371EE1DFD9A0C4A414EEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516066, "uuid": "44d43360-fecf-455a-8240-2e2752e94b70", "value": "768:QlTL89WHQNjUH0xKRsJ07j0pDswsJv6sJIbpDsAepDsqhsJnWqF2WuoyUfh5EZaa:QB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516066, "uuid": "cb4a59fc-50d7-4847-ac47-242e4a65462f", "value": 1247270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516066, "uuid": "bc76a629-6731-4000-a898-a47627cc6a5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516066, "uuid": "4cf2d066-ae4e-4a45-a3d2-b7d3f5620a49", "value": "185587ce8415c203252f5daf3be5911f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59537bed-1fe0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773518385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773518385, "uuid": "0bff8b04-58e0-4616-95ce-5e9aad509700", "comment": "Malware payload", "value": "5e4c2751374eac2e48b85eaa34d4f3ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773518385, "uuid": "542df4f0-a177-4bf8-aeb5-d30115c4ece4", "comment": "Malware payload", "value": "c424cef8ade79dab30ad4e6b688ac8bb7c5099ebea863e072d7a745db0b58e88", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773518385, "uuid": "ecb6ede6-92ff-49a4-a5a1-3d770594a6ee", "comment": "Malware payload", "value": "893e9589cbabe0e881409f7d669ca17ac273f6a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773518385, "uuid": "c4ba4cee-b8ca-4250-b02a-5231a4905199", "comment": "Malware payload", "value": "8f78e30d05a48239cfca81e6215fd4d7e3a5d2119920ade16528b60dd3ab227bb94258b904873f981e4addcdc7303e9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773518385, "uuid": "7457f194-65fa-4b7e-a8e4-dd2ed9e6a2f7", "value": "T141925CB506496CB9BBC0CE799F3C7F0CAEE582C42129E39DBA5F39704A2065DC60935D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773518385, "uuid": "0a25f6f9-4b34-4865-a4a8-e4951ce3d301", "value": "384:fP4ncuxOLnVYMS0zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:HbuQL+0zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773518385, "uuid": "5c10fe5e-165b-452f-9b11-95e764ef840d", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773518385, "uuid": "4b50e5e6-6ee0-4aa8-94fd-d409a83db99b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773518385, "uuid": "3fe76f44-2ea8-4d88-bf66-bf6e6cf67010", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613034a8-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506372, "uuid": "8b02829d-b7ce-4c70-a062-769706f57a5d", "comment": "Malware payload (Vidar)", "value": "ff16837894eb7ab134bb92098f2a4bfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506372, "uuid": "22dbea6a-17aa-453c-ae84-3492f8f4d0f1", "comment": "Malware payload (Vidar)", "value": "c4ad2d2df36d58cd27d9d0525aa82b8ab46c9f1d453db1e4d032cbfe9a489106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506372, "uuid": "5369c360-9919-4d12-b613-a0c546ba42f0", "comment": "Malware payload (Vidar)", "value": "e161b4311ecb9bf5182bef96af8d2180b32f321b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506372, "uuid": "7ea2358d-c0c6-4c29-a0bd-4972aa4c528e", "comment": "Malware payload (Vidar)", "value": "4988cd5049f2b1f4bbc5248fcee9f1f65aad46b3da1df8dccc0a544a21d0d24876b1e390ce6a2a5ab3ca38f2ee2719ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506372, "uuid": "a40a9260-fbb3-4b29-8ca5-a7e19c83b2e5", "value": "T1C624231B7279EAFFE043D17E54CACA073CD414D8E4992CFD6F48CB92826C691F88A459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506372, "uuid": "58f887a0-2adb-45f7-b5ff-0230d0d0d575", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506372, "uuid": "07a3dd66-f5a4-4d4c-add9-a3f2f1c776e7", "value": "6144:FvoSneFARaBBtIeZTrV3aom7E+izUItTy+7Ix7:evFAcsen/m7bfR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506372, "uuid": "9a76ca81-7e3a-4535-a4b1-c02f1f690b6a", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506372, "uuid": "4f1cf688-0e6c-47fc-84a1-19b54302e8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506372, "uuid": "7261490f-ed99-49b6-9512-0744b53ba87e", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70c9c77-1fdc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773516878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516878, "uuid": "26171206-08d0-4934-ae89-5a47d4104287", "comment": "Malware payload (AsyncRAT)", "value": "7c44770993f9c34e81e104a48c9a5a77", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516878, "uuid": "d75c53f4-ba6d-40ed-8e8a-62da2c02b345", "comment": "Malware payload (AsyncRAT)", "value": "c4c9d191f53e1f2a4a6c05a35d0354719b3797192b7d361375f475302c7d3c9b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516878, "uuid": "e6b407ad-12ce-4905-89ed-edb55990e4d9", "comment": "Malware payload (AsyncRAT)", "value": "c8de19de2dca295cdfdbb40105009e8c79db3597", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516878, "uuid": "7e1f03a3-340f-46e6-90e0-cfac2301e45a", "comment": "Malware payload (AsyncRAT)", "value": "f364fcae0332d0b6dd6565d7c57c0f5286a00b1e9ba35c8ed6c538f64a15d39529eca75cd28fae0474220ff9896295f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516878, "uuid": "a7c5301d-a68c-4b76-b6c7-28827049f7b1", "value": "T187232A0077E8C12BF2BE4FB8ADF26205467AB2736503D6891CC4519B5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516878, "uuid": "e698bdf8-36be-4a21-b4f3-864a6fca0915", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516878, "uuid": "51f22363-78a0-4427-b434-d494eb9e3936", "value": "768:NuSEa5TAYOTSWUkC+zmo2qLZBC+fkUxYgmOPI3zjbqgX3iCdk5sRWbrfy0BBDZnx:NuSEa5TAxv2yhkUdU33b9XSRiRyy0/dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516878, "uuid": "66196df4-668f-46df-a4ac-06a9ffda8169", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516878, "uuid": "e925f145-7a50-4f65-81e0-39a9752fcb85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516878, "uuid": "efaf4fcf-30d0-4d5b-adef-6c9b82e737f4", "value": "AsyncClient1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f95d66-1fc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773505220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505220, "uuid": "e03dceae-d36f-46d0-a3e1-08b1f256e6bd", "comment": "Malware payload", "value": "16e8f928dd495006e199a82960d053f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505220, "uuid": "1a949643-9d35-4e2f-8afd-6c7638c876c2", "comment": "Malware payload", "value": "c4fd81542eb06f7c6f3db4616cab0bd7293c6a154eae3e6470539961c83bd560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505220, "uuid": "9af87e7d-eb94-4f27-bd48-6c3a251b66af", "comment": "Malware payload", "value": "cdac719ec29b0eca0ea081121fc0e4d73d24ab4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505220, "uuid": "a49a4e96-4f53-4dc0-b82c-998998bc75b5", "comment": "Malware payload", "value": "4a5e8c0bc7b219b272ff9b7b87c6c161a2e6540b9ae25ef5ab8f44c055c2f65abaa791c777fb702745ecd79307db9b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505220, "uuid": "63899875-e2fe-4e8d-ac9c-861ccec31668", "value": "T117F54B13B288663ED09B0A37CC369640593B76656A379C176BE40D4C4F3AE817D2EBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505220, "uuid": "2f1119ae-cced-407c-b4c1-dcb7cf9d52be", "value": "94501dbaa1b3c5f4854e93b5848f4994", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505220, "uuid": "0f589ce0-41e2-47b4-930d-15f67b397cb0", "value": "49152:ycQGDZ5luz/d8SxFIEXm3GHcwZufQCa/FVCM+9ljG6O+1:hlEewZufQ5/FVCqlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505220, "uuid": "e41a6e38-bdb2-40c6-83d9-ee2f7d5787ef", "value": 3334512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505220, "uuid": "ca8e4fb0-136c-4df7-94cd-4ffc6fdd8896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505220, "uuid": "fa57290c-9534-4cbe-9d79-f1db7cd04320", "value": "c4fd81542eb06f7c6f3db4616cab0bd7293c6a154eae3e6470539961c83bd560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb2be2f-1f86-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1773479607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479607, "uuid": "b8cb5371-6fa6-4333-8dd3-a0199b3b928e", "comment": "Malware payload (WallStealer)", "value": "a4def2f5d629622e6e317a8f7cb3e394", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479607, "uuid": "817a03b4-d8ff-4cff-8832-64f9df12c604", "comment": "Malware payload (WallStealer)", "value": "c56fe91d945feb8b50437bf259f6e0a6a78cbad5f5f89519114d711b16e61165", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479607, "uuid": "1b82db8a-3a73-49d4-99f6-3efcf984d9b5", "comment": "Malware payload (WallStealer)", "value": "fa17d8dd4ce5b210a466e8da14cde3c36020d57b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479607, "uuid": "fd0d39fb-4400-4e19-897e-f530a3c375fd", "comment": "Malware payload (WallStealer)", "value": "67003b97d36d4413ffd0e70ef34c9c98d56fd71da8bcf8c30e2a79fce78d02fed231adcbb8c6187e0f2934f884049882", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479607, "uuid": "3e148baf-a103-44a1-93e9-c0703cb87dd0", "value": "T1E096768FB674861388E263B5B2063573BE2BD435479983367CEDE835319F07E4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479607, "uuid": "b96a8190-11ba-40eb-8e22-14cab5d80d14", "value": "5494c81f61f9ff699d47be3808e7b4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479607, "uuid": "8a7566b8-48de-48ec-914c-9982ca5c3114", "value": "49152:3jzYUQyd0f3W7hsdHAr38ON97SHvt7vU4EMsXA7I/KNIkxPqKkg8po256B6YMfH2:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479607, "uuid": "a48b99f8-1703-4ad1-9003-542e3862815d", "value": 8886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479607, "uuid": "535b9657-c4b1-4dca-a460-2b86a4362201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479607, "uuid": "5899bcb0-c9ee-421c-b247-ed49d59b846a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc38c03-1f88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773480649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480649, "uuid": "9c2e3594-756a-470d-a3da-9ec3e1ba23c5", "comment": "Malware payload (Mirai)", "value": "7c01b8558f3d3ec8506a932b05e6c029", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480649, "uuid": "2ac292fa-846a-47fb-9eff-2026f0f78b51", "comment": "Malware payload (Mirai)", "value": "c5e1006e88211487a8adfa3f9c9db20974c1348be679275f517da398c57e745f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480649, "uuid": "d6eb5e8d-743b-42e2-8b1e-4dc3381574a6", "comment": "Malware payload (Mirai)", "value": "10b7e70b90340a002a0b2f36b1ea16f355afeabc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773480649, "uuid": "6516f213-9c7f-43a6-8fd5-b3cf77d53a18", "comment": "Malware payload (Mirai)", "value": "4067a5186f504b29bb4b9d02ccd1473e206faa0f8194f6cd489979651df2cb8f847c0c64cbd642f8636450ec39042caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480649, "uuid": "f15a1ce0-e389-41f8-82d8-a1cd3cac099c", "value": "T100B2F7B2F44ADE78F40FF33E85564805B273B75502863A32B7732E37997928424A7E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480649, "uuid": "5cf03b0b-8a95-4945-8499-b79331a4831e", "value": "384:K6BLtSWPPqDhOEX7uADjTIhUtsp10d58HAR1s:DtSjuAkCtsP0d58Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773480649, "uuid": "0cf972fb-b22a-4370-a94f-cc3fff145c2d", "value": 23852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773480649, "uuid": "0ced93fe-448f-45e1-b095-e3d3fd4e188c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773480649, "uuid": "cd53c61e-e132-46c7-a2a9-7bce36291da2", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb980f1-1fd4-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773513369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513369, "uuid": "cd7af5d1-2735-43e6-b089-d15ef1b1f4d6", "comment": "Malware payload (ACRStealer)", "value": "1771564619fa4103ce47cbff2931574b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513369, "uuid": "25686b52-c9b3-4c37-87df-5de36d7bc488", "comment": "Malware payload (ACRStealer)", "value": "c67730156049d229b79d1d132a4c0f96a6573574f34bb825aed850cdfdf5930a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513369, "uuid": "547c1162-aae9-46f6-a2b7-a849383bd80d", "comment": "Malware payload (ACRStealer)", "value": "5c6b7878c15dac810d3861968bcc60b00f0af893", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513369, "uuid": "44ea63cc-19ce-4eae-8514-4df1941350de", "comment": "Malware payload (ACRStealer)", "value": "7a19fcabd47e46e96804ebb9dcf3451d06fa6bfb0dc8605cf67b861a1e2d599f6d6b3a055b9b53ccd8194e048d39e419", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513369, "uuid": "2f94fd7a-f615-4b59-a4bb-a114d7716fa1", "value": "T1BE85A381D48F98FAFA034A3280395A3F6729419C9F28D9D7D6647DF3E8727D2127B481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513369, "uuid": "a371c0d1-a982-4eb2-abe1-f91c53e0a299", "value": "93cb7c9e1d40c39a2757300ede359d24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513369, "uuid": "ed62fc52-e78b-4a5d-a276-ab0a28cd842a", "value": "24576:k9R8UJHrnxzeq4eW04P4FCXqHu1S1xvEJWxM8+4BpbfQFl9gaLv5aqi3UKvOhD2R:mnOhybfQFbgaLv5aqi3UllS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513369, "uuid": "294faaab-b1c6-414b-845a-6fa9fe048d73", "value": 1839104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513369, "uuid": "b5199e9f-76a7-4a00-826f-91c9bc49d37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513369, "uuid": "2cbe042c-6416-40ca-bc8a-e6a4da629dda", "value": "SecuriteInfo.com.Win32.MalwareX-gen.13192578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02823d23-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773477437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477437, "uuid": "bb91ce7e-60c0-4558-82c2-0ab737b43db4", "comment": "Malware payload", "value": "1cfe983ad6c40b256720c2f4fa59df86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477437, "uuid": "20de242c-131e-49b4-ad91-ab26da50c021", "comment": "Malware payload", "value": "c69eafaa4f2d5c95639cba3f4817b82fe9d6680d89cad4b3e081ecaabe7e572e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477437, "uuid": "977c68bf-5635-472a-9580-2d00c65db925", "comment": "Malware payload", "value": "9b67f9e5f5e95ad1658275f58d444b014ea954cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477437, "uuid": "adf12f6b-0623-4adf-82a5-ce0464f7bd6b", "comment": "Malware payload", "value": "52a7687a147a93fb5be646c5be70a5c38e87be66bb91756641dff4cb4f57c5f7f7dd07ecefacaf4941780bd81e4852f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477437, "uuid": "0fe24568-7a79-4b1d-9968-76fe72029d2d", "value": "T12C363950FACB44F6EA031E3144ABB27F67315D058B25DB87EA507F2AE9776D2083621C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477437, "uuid": "f93e6ee5-2ce9-4478-9275-c009567962f0", "value": "49152:pYQhABz/zHgZCi0X+quHS+PRRf81XJzvk5hfpe6qiVF8n4tgP1ibRTPVnexca4hH:GBBSeX+quHSkREt4cxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477437, "uuid": "8c91df88-d485-4aa4-a149-58887d02a85c", "value": 5128192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477437, "uuid": "e7644183-fd4f-4b8a-9bf1-910042aea3ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477437, "uuid": "f3ce6ee8-34bb-4d32-bf66-2750bde2675f", "value": "386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b71e58-1fd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773513059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513059, "uuid": "833fab61-5bc7-4ae4-80ab-4a52ecf8d603", "comment": "Malware payload", "value": "f1f3bb094218164cc3017d0f507df255", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513059, "uuid": "ee44c6c5-eef1-4cb9-bd17-e0e4444d54d4", "comment": "Malware payload", "value": "c75ebab7bc1babe41757a8aa104fb4d53adc6590a7de158fd5ae723ceb8cdb2f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513059, "uuid": "33cb9034-0bab-442c-bc6b-89581017dfdb", "comment": "Malware payload", "value": "f65f4c05097effb763525eac10ab0f3eae2aa773", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513059, "uuid": "77e7718d-c741-4021-965e-1768160abc35", "comment": "Malware payload", "value": "ee50112a212dbae2d5e70cf353333dbbfacd8d43d82c0ab6bb7bc053e20851e1db6f61ab66078668b1bab5a68b6f0a40", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513059, "uuid": "4e11e02e-82fd-40c6-87ed-428ab8096801", "value": "T10C11EF44544CD0C6473102D6D190D924F46197EB2705DF48268CC8FE89A98FC34392EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513059, "uuid": "697d1f7b-ed64-4832-9369-6afd8600c466", "value": "24:9AWyL25OXRHMZiCfMBRhX8E16ZNUqQVtMByhf06XbMJ:evK6RHwfMBRGE1VbMByF2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513059, "uuid": "a85e529f-48e4-4a42-be09-c9a62759ea1b", "value": 1056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513059, "uuid": "e913f4a1-b576-4ee9-8028-13ff96a62db3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513059, "uuid": "9bb397a4-34e5-46c4-b668-4c85e1dae778", "value": "r.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4344a61d-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486565, "uuid": "05d4c62e-8681-44c7-ba5c-1dce89fabd03", "comment": "Malware payload", "value": "90e3b9f44b37bc9a1d587d76d06d3d9b", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486565, "uuid": "6b990e89-db9c-4657-a564-5e8314735002", "comment": "Malware payload", "value": "c78f15cfd7808a4b4b4b480f4089387c5f62e983d01901e2ea06f1c35386ca87", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486565, "uuid": "c83a3bd5-49af-451f-a527-fe2e36c74fba", "comment": "Malware payload", "value": "4308f86d9d188baa8595a9fc48ca70fbbdc1531c", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486565, "uuid": "6669871e-4394-4073-99a5-7995abb76863", "comment": "Malware payload", "value": "b3b0a6d0bc8d8a41a6c588991eadc7cd141e6ddb9717655d8a705adc5436c42c5b06c1adbc1dc222c3887b70afe3b593", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486565, "uuid": "578fc4b0-bb4c-499e-be49-4f9d6a242705", "value": "T1B2F05C39DB60F8C0433EB000C4252D1910948D23F7799EE9E2210CA96C64A64DF0AA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486565, "uuid": "aacd99c6-55b1-4c6c-b21c-8a1034a30537", "value": "6:s8bloOVsukO6hSgnVe/kty6BuCMzeMkqCcAckk5t0h++XPHZkTkM7hTalYWs6qa2:s8hZGrO6hRYEB1cPjP0RihqYvLAk1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486565, "uuid": "7733b821-e46e-4ec3-a825-dab12c11c6e1", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486565, "uuid": "1be8eedc-70a1-4307-b10e-f1eef3c650a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486565, "uuid": "816aa5c6-598d-45d6-aa17-bf54d298afe7", "value": "2ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78da1d58-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494386, "uuid": "73829fcd-6b0d-464f-8c3e-2355c2cfd7d1", "comment": "Malware payload (Mirai)", "value": "8cce3e323774064909b9741df2d9634d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494386, "uuid": "e59a601a-0bf1-43d6-ad6f-56d1d1bc47ee", "comment": "Malware payload (Mirai)", "value": "c7a631642ff391179a4a9548357757f65a17f8920968f7f2b5922289d350a9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494386, "uuid": "36cd329d-d364-49ab-b5e3-953e3acfd061", "comment": "Malware payload (Mirai)", "value": "6e3795b6686ae987851e4a21b24e82779ea5a853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494386, "uuid": "50fd5464-add8-4a49-afd7-28e72d554e9e", "comment": "Malware payload (Mirai)", "value": "9aba005d84763ee5345dfb30e42f599d6128ba1cfc965a0f02f909eb9be2921b209decc6616df6fa489f972d3890ccdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494386, "uuid": "4d654253-0534-4d1e-8ef0-299b86ae653c", "value": "T158733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494386, "uuid": "f845d2a9-930d-40b2-b26c-f9a9c7309f80", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNd:OZWLnJpcO72RDRZNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494386, "uuid": "30867123-a90b-42bc-805a-d1936608f8bc", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494386, "uuid": "86ccf98c-f930-47a8-bd12-567e2fabf070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494386, "uuid": "6daeff3d-5f83-41e7-ac21-7bb23a6ccb64", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ce02e3-1f50-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773456579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456579, "uuid": "b45a1de2-d0d1-40b4-8d5c-a57e41ea6bac", "comment": "Malware payload (Mirai)", "value": "e247df926f77ba25a1110b0f9a74e143", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456579, "uuid": "89c5120b-a748-44eb-9590-a430b29d5252", "comment": "Malware payload (Mirai)", "value": "c7be2a712d076b44d81e5d1bbe1a81838db6a77852292433d263c9b7ea27e1a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456579, "uuid": "8ed1aff8-bbd0-469a-95ab-08a9641c3574", "comment": "Malware payload (Mirai)", "value": "50152f054f548690f6f36802197a1a24f0048585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456579, "uuid": "6351d3bf-5e49-4646-99c0-17fb174715b6", "comment": "Malware payload (Mirai)", "value": "5b553886e28b7035d738d1df873b35485e0e748d2ad8b18bfbc23ac92ea4260f7c4eb48a5cf2fee8241cf4c8b36416ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456579, "uuid": "bab37f67-8517-4836-b6f3-d88fa838eb71", "value": "T1EEF34C46DB818B03C4D61776FAAF42893323A764D3DB73068928AFB43F8675E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456579, "uuid": "ad92a549-1ae6-49e5-9804-ea79ca483e0a", "value": "3072:tkwQoQLXDXXAMavshtTC4rzfi1VY06Pmm7ybWCjqOM/9SBTMpS:x5sDgMavshtTC4rKVa17ybWCjLM/9Sy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773456579, "uuid": "76d241ce-7b59-47e8-82c1-0333169da838", "value": 169896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773456579, "uuid": "8d51c152-e356-4c95-ad33-a60a467cb28b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456579, "uuid": "bdaaf4a3-46f0-453f-bffb-1c1ba4bc0eae", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1495af43-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773501519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501519, "uuid": "dec14cbd-2478-48ef-b37d-0cd8bda8c6c5", "comment": "Malware payload (ACRStealer)", "value": "1ad628e579ebd02c6feacf0d0ad61e81", "object_relation": "md5", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501519, "uuid": "a8cfad25-b243-43e3-8403-0996cb348a51", "comment": "Malware payload (ACRStealer)", "value": "c896db3b9af6063123ce97105e063621e0f2f23615bc38e383bbf704e94863d3", "object_relation": "sha256", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501519, "uuid": "eb6005c4-880a-4392-bc8b-a8fc06119f9f", "comment": "Malware payload (ACRStealer)", "value": "2a37d75d54bc2cc45f1e0aa3115fe76cb212418a", "object_relation": "sha1", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501519, "uuid": "d42492d6-71fc-4fea-b8f6-82ce69142d2a", "comment": "Malware payload (ACRStealer)", "value": "2d8c3e645860743a8b53a1b8353855b1d9ac0aa9cb0a671e8df2ce354b39a5f6dd2c131e5866f0a9d29818ae5088a850", "object_relation": "sha3-384", "Tag": [ { "name": "45-89-60-3", "colour": "#6C4A6B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501519, "uuid": "0bed60d9-c12d-4e5f-81e1-e78076495023", "value": "T1F1969020F29784F5DDF900F141AB96771A2D2E146335C9E3E5843DD86C722E352FA2BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501519, "uuid": "d98c2da0-24bf-4ac6-86b2-278513b646eb", "value": "bf3ffd977d02b78c1688e06aef113cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501519, "uuid": "f0345bd8-7311-4801-9b92-f46b75bc132c", "value": "98304:xgnaHwnTAQsSbh0+fSJcUEri5HdjL0V0HZMaJV9zUq5ZSfw4B8eENSdbDNFpQTZH:qhTAQJCnyamqOF8FNSd8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501519, "uuid": "3ea0838c-346f-4fbb-945f-f2267a2a0e0c", "value": 9342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501519, "uuid": "fcf20629-3c63-476e-85c3-e7052a8d8912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501519, "uuid": "02ec45f0-dda2-417a-878b-559923094720", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56251e80-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493899, "uuid": "56c34909-a995-4b0a-b3fa-9710d0b36017", "comment": "Malware payload (Mirai)", "value": "9b204754351bd513610b5b5c3978750b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493899, "uuid": "a12f4a5e-7226-4202-a4e3-1532cfa4c7f0", "comment": "Malware payload (Mirai)", "value": "c9bc39729dd8b5a4c1eb99c11ce8dd37b7c5bf71bb8854e3bd0f080e01d10a3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493899, "uuid": "a85a0d10-e1dc-447a-a083-bae09960294e", "comment": "Malware payload (Mirai)", "value": "9584af7703e10b4bc68679b9061270858f0ffc54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493899, "uuid": "bc796d60-0754-4810-ab0e-417a7271e456", "comment": "Malware payload (Mirai)", "value": "9b085ecafaf3e45d395f5f377b3a784b4c0e35d5353372c607c180f9ae7a673b462feed70a0ef304649675a12a471c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493899, "uuid": "cd793560-09c0-43a5-a345-559af81c043b", "value": "T16892D12D15D1E432E1B00C34E96FCA09B24B177E52FBB7B125864388E1DA5029EFDBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493899, "uuid": "91c93eb2-dfe6-44c8-96fc-a7a5f0def6d7", "value": "384:Ju1uGPCl4YYEJ9yyQ/9ceV14ThC9dDPwJBzhwRYUK81/jhymdGUop5h5kFa/:KCl4189Y9csmC9JEzWMw/js3UozWa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493899, "uuid": "3a804b31-4d6f-4462-9c10-3781fcb7cd61", "value": 20860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493899, "uuid": "952cae76-1e6c-45f7-b576-bb15c2b1b12e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493899, "uuid": "9892274e-94cd-4c38-a4a7-168be2a202e1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d7f0e2-1fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773504285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504285, "uuid": "1f6d1365-c3b8-4b0c-8010-9416013b4ca3", "comment": "Malware payload (Mirai)", "value": "8b1d3af5e900423d8e2c4a90ce15d00d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504285, "uuid": "00a9d443-9483-45fa-a6d7-b236178697dd", "comment": "Malware payload (Mirai)", "value": "ca01e4ee41985c3cd05d3bc63858149b6e0b2a6f6c89fbb24ad04d3388597a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504285, "uuid": "6ab425a7-fb4d-4b2b-935a-e7e6fb28ad04", "comment": "Malware payload (Mirai)", "value": "bd5507bc9985c88d1f1675b05570f66324be4265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504285, "uuid": "be6107fc-c482-493d-b502-9bf70cd8fda5", "comment": "Malware payload (Mirai)", "value": "b1bc8842df6ed856c339703774103266f9d958f781d326d1a15bc4ebce9f79bc4aa77655aef5c1eb953a5fc0d9cd4c72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504285, "uuid": "06cd1194-16f6-4d1b-beb3-c9b1e65d48b2", "value": "T19443B71A7E214FEDF26A863047B74E26675823C623E1D785E2ACD5105E7024E681FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504285, "uuid": "1c8090fd-9865-486e-8477-d0b8fa3e1107", "value": "768:QQf+jh1k2eNtGhEtHHO6kEm2cvF6RD+idWfFv9I+v8/j7QWQxlMyIW4eu058w+uR:Yh5NHdv6Sf9v9Nv8vQFYeu05d+uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504285, "uuid": "d2f0fbd9-5f70-496c-a7c4-c11bba350a90", "value": 60236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504285, "uuid": "73b3cd6b-d941-4183-a2ae-59968e5aa8a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504285, "uuid": "b29c5d06-c7de-4fbb-9005-9c40516c14ae", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8602e61a-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495267, "uuid": "2c870a60-36ae-40d6-b0f2-6aeaa723433e", "comment": "Malware payload (Mirai)", "value": "7591c1289f8c8444253ad84dfdbcbdaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495267, "uuid": "4de07cf7-2607-4c4b-bc39-6f02f8106aed", "comment": "Malware payload (Mirai)", "value": "ca737be2d07649ae978e59e58a5b2425cfa8e045f8ea1ce884f654cc845e648f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495267, "uuid": "4f19d059-effc-4a31-9b1a-3947dc2ca336", "comment": "Malware payload (Mirai)", "value": "6a95050676f443ead2539d82dbae258f4ab0abfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495267, "uuid": "25c788ff-77ea-4a16-b806-d991f0e1f65b", "comment": "Malware payload (Mirai)", "value": "e430f10104c51d1410f594783e8516121f3a5289130fdcd7e31e693e995cca9083926c0ff57ba82c4dc226f2dbab2209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495267, "uuid": "f5c8293d-e3e3-4f38-aea7-61112933a80d", "value": "T14446F805AC842BE6C02C9F7490EAC95563B45D145AF24A3A26A0FFECBC762347F47D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495267, "uuid": "9acff122-7780-441d-97c3-c4b1fccd89d7", "value": "24576:OEs9m6u5n3LlXLDLJ3IaLlXhy1NraSazHlvSzB1voEVcpk4jc0tJVGAYmuyue28V:RLJLX+QEaXpZ57kK9BkzwfQT78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495267, "uuid": "b9153838-7533-411b-b0e3-c4a28630f49b", "value": 5767351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495267, "uuid": "3b2eccf5-efcd-4871-94cb-dd781a14dfe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495267, "uuid": "d5f6821f-7ff2-4b06-a9a8-fce5383db95c", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486bee24-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516209, "uuid": "120ef850-d3b6-4293-8577-a4000ed9085c", "comment": "Malware payload (XWorm)", "value": "3c6f9e998cee6093676d975f68ea6dc0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516209, "uuid": "59f6c68b-3e0c-4545-97ba-05146f0ffb14", "comment": "Malware payload (XWorm)", "value": "cad71cd33bc35e6eefe1bfd43cedc39b2deb09057e29c81309fe2b87a1d7d405", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516209, "uuid": "092e607a-003d-423e-b50d-1eb7f0c89759", "comment": "Malware payload (XWorm)", "value": "d103604333b9245c483f2761587e7d0e34192c5e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516209, "uuid": "ae4e3ad9-86c3-4df7-a8ff-ae4f625c62ea", "comment": "Malware payload (XWorm)", "value": "4178782a1e203772700d1de72dfbbb702783848702b52db3bb165c0a9f55328de902d7ea2eb9ca2a805856abbe48a1ee", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516209, "uuid": "e82973ca-bf0f-406e-90de-6b327bf05ba5", "value": "T1FB4512B388B849FA1DA17235C3FF1545F0881647365E9BFB69E2C9CA0E3C485698D21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516209, "uuid": "072ebab0-da72-456a-81cb-81148d80ca44", "value": "6144:U++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++m:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516209, "uuid": "2dd84bf9-6bc5-489d-a5a8-8374d8c176da", "value": 1246149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516209, "uuid": "02ac628f-94e8-4b88-8ede-9cfc86bb1649", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516209, "uuid": "bdc290f2-9c8e-4e84-931c-b17b5d509890", "value": "3c6f9e998cee6093676d975f68ea6dc0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e93a87-1f7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773476346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476346, "uuid": "f0ade833-7ccf-41ea-8416-aa71ffa83766", "comment": "Malware payload", "value": "6b8bac241d1703df72069295ad3dcd19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476346, "uuid": "d7e6c64a-f544-4c8b-b23a-ae99aabb4ff9", "comment": "Malware payload", "value": "cb33701a8ffcaf3e060fa8a48ccc4b73f5e498298244f746c82f50b4372bed55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476346, "uuid": "a8708f68-96c0-4ac5-ba7a-3418048ece3a", "comment": "Malware payload", "value": "d98f50c631ddf318ec88ccb14e84149b15cbeea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476346, "uuid": "188bb206-ba61-4947-90ec-66907d54523b", "comment": "Malware payload", "value": "42c3d1f67c6adf1a60d89dd411af62d980de418f0303d7dcef084eef7c30c1dd1657dbd41680675ae36a27e7b6875a3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476346, "uuid": "921c2461-1837-4a64-ab05-8a0f9d569462", "value": "T18B232844F9829F16D4D925BAFF4F21897353472CE3FE7201DD244BA9278EA6B0B76801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476346, "uuid": "4b5553b2-c935-4661-8e55-b71769873669", "value": "768:gSnMTZPPSmy0h15nVDzYCazEQZIId6KmKluJiIdRYZv6v0RtTHgGAMe7W:gSnUZimy0hbnVSzEGIIpmKlMi6OEWAM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773476346, "uuid": "041849d6-f28d-460e-a70d-960c83396854", "value": 49016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773476346, "uuid": "038da6cc-0ec9-4004-914c-58e25cb914aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476346, "uuid": "8e2a6132-7937-4de7-b601-1919683f212b", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54aeb18e-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494326, "uuid": "00481fbe-9b11-4ee2-a3f1-0c7caacc8012", "comment": "Malware payload (Mirai)", "value": "05608147d041625cc19dc593b0fcf692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494326, "uuid": "f5aa7a0a-0733-4367-9b8a-b0a1220298de", "comment": "Malware payload (Mirai)", "value": "cbdec6412238365fc6a07d64ed574dae7097ff25ae83e554e3f77a22231451ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494326, "uuid": "c476a973-2938-4774-9d65-606b8f7008eb", "comment": "Malware payload (Mirai)", "value": "de7192f84001242bc90384e86bd47632a8eb4ee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494326, "uuid": "cfdf954a-3e3f-4f9e-a0a5-05e85b1c232d", "comment": "Malware payload (Mirai)", "value": "3fef242354bda9e3ecdd6e39fecafd48d1eef23c41024eec9a0d3f4e95c53e26098b0e9703b9bfe861f044b8113eeb2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494326, "uuid": "8c342ebd-fc1e-45c6-b453-4ee3a6508de3", "value": "T13603E11BA460B06BC91F1C3F139A01AE1960F2D671163B676369CCC9EE3799F94CD8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494326, "uuid": "10b64fa8-2664-4540-b6d6-7a31d2ca2cfb", "value": "768:tF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0OXP5/bqZfw:zl5JnsrXvrKy9QjyBZLvDmR0O/5TWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494326, "uuid": "2e7ab626-2fa7-431b-b0f9-a1105c6c713b", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494326, "uuid": "06764ee0-ea26-48c0-864a-8094da057124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494326, "uuid": "219c0afd-8ded-4217-bee3-0d422bd3c085", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ac5c95-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516099, "uuid": "21bb7def-f1c9-481d-9f4b-ee85429be20b", "comment": "Malware payload", "value": "1489dd49eed43a576cc4cefa6d47cec6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516099, "uuid": "d5ff48c8-2280-41c3-afcc-7245e1db6b23", "comment": "Malware payload", "value": "cbeabab922c21af994832f77f1a71e6ef7a004acecd133fa57379701a28cb498", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516099, "uuid": "9509c2ea-9b35-4bd1-b971-b79fe5453c21", "comment": "Malware payload", "value": "b29ebe2548917d94467edb6171b9d9f5df2af9bb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516099, "uuid": "91232e47-5245-4947-b296-03ef246209f7", "comment": "Malware payload", "value": "9f251d9e9c602a64539a820b00ecee614c62d18640684c2f5fa50119a30d2ca36f063b6e55dc9d2b40c78ef0eb509305", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516099, "uuid": "8f963d90-ee59-44f1-8955-4085cc8f355d", "value": "T13896768FB674861388E263B5B2063573BE2BD435479983367CEDE835319F07E4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516099, "uuid": "b95338b3-f634-439b-83a7-7b04f29aafc9", "value": "5494c81f61f9ff699d47be3808e7b4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516099, "uuid": "e136128b-1d9d-4aea-9320-6e6cdffe5c51", "value": "49152:WZnPK738Oa4LgYKLsffckUBMdUbaOZDcWueGMkIWoGso/TU6bzX1UyFwhJOH8w49:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516099, "uuid": "23657aea-ccf2-4454-b411-dd75756ed963", "value": 8886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516099, "uuid": "50c4d9f9-7727-46b9-8690-072f22b2cd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516099, "uuid": "28f36cb6-7476-4ff8-9ad8-91d4a1bb9f46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf496fa-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495224, "uuid": "f76e13a6-efad-46b4-97b3-de5e36e6b148", "comment": "Malware payload (Mirai)", "value": "69242b3d5e9e320a332d47ec39dfbf1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495224, "uuid": "4d3d03d4-55ef-46e3-8199-64f7f80eb8a5", "comment": "Malware payload (Mirai)", "value": "cc15a6ec3078e1976e11bd8cee783b178b4c7148853996fb09cba95586369288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495224, "uuid": "66cffa5f-a132-4966-9a7e-91cd74e09d63", "comment": "Malware payload (Mirai)", "value": "81f425ea12a9e778783ea2f8bbf7e81896661ff3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495224, "uuid": "d5058da5-78b5-46f7-9b29-c7fa5cbc1484", "comment": "Malware payload (Mirai)", "value": "073970ce5904f4c08a3726f930ddd65c6641275339214771f6b581ff7181db6bb6064b6f32abdd745e46750dd336e271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495224, "uuid": "d8565aad-6c6e-4308-b35a-2942f488938e", "value": "T198F2F12B2C962ADCCF380434D8698602A2776B7CC4F4796025C451FCFBA615B77BCE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495224, "uuid": "c0b692d9-1b50-4794-9c8f-3a0d01a88283", "value": "768:/8kUDTbWxEjVgnjHDLnlAxoVll5fUGmB6N2nnhnrQIvK+ILxXCs3Uozv:/8kUDfIEJ+CxofvfVmB6InVQIvD2xvzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495224, "uuid": "21293343-03cf-46e0-b9f9-a88948bdc964", "value": 34692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495224, "uuid": "218579a8-587d-4dd6-8edd-0943d3f421fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495224, "uuid": "e58618bf-03fa-4d7e-b443-336934eed20e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76efc6f6-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493954, "uuid": "3e394646-26f4-44cd-abd5-16651203ca14", "comment": "Malware payload (Mirai)", "value": "f632f699d21a44e73a2afec124082e84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493954, "uuid": "3b0a791b-8f39-436b-bcf5-5181501addd6", "comment": "Malware payload (Mirai)", "value": "cdba22de2c117776fa0f03ccf27202e44841b981f8dc7bbd5e105ec75aee4dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493954, "uuid": "1235aa56-ff9a-414d-81f1-cf5c7fcef648", "comment": "Malware payload (Mirai)", "value": "05af3fce34d326926d1870ae5b73802ed21c0d45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493954, "uuid": "4321ef59-f9b5-4133-a63c-db28258bdd1e", "comment": "Malware payload (Mirai)", "value": "bb8696e7e8c303bccc006580265b7d912deeb0f25e9a68c81607ede9cf5fc0e766aca844c511dea73bbe4a6397eb7a41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493954, "uuid": "de8c147f-5980-4cbd-ad77-34552848d5f0", "value": "T111A3D91E6F21DFBDF269C23147B78A21979833D627E1D685E19CD2005E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493954, "uuid": "cce8ec7b-f3f6-40d7-8a6d-97e4a6ddfa95", "value": "1536:V4poNIjCa2VZA9mUpZrLNjkWQGjeuvFXz361d64m:rNIjn2VZABhLdkWfjz25m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493954, "uuid": "20893742-9f02-4140-b7b4-bb9e2989d4cd", "value": 97912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493954, "uuid": "3d725d67-dddd-4eed-ba8e-4d1b5c8e9dd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493954, "uuid": "be1f3017-e06b-43f6-a403-9e44d71864c9", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb162a8-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494316, "uuid": "40313e52-7131-4b94-96fc-c1540b8831a1", "comment": "Malware payload (Mirai)", "value": "28fdea2714ed11d41058794cf267fb6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494316, "uuid": "794b492a-5076-4015-a7ca-763ff6ad7763", "comment": "Malware payload (Mirai)", "value": "cf8728276ca85676493a72dc24af99e0605c73399176b801fa7ba2a54f48b7a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494316, "uuid": "eef235d6-3825-497f-84bf-aa6b3e168add", "comment": "Malware payload (Mirai)", "value": "e9a980ea3959f2e6c3838c5db28eafd53150e23c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494316, "uuid": "f633eea8-5517-4faa-999e-e59dfff80121", "comment": "Malware payload (Mirai)", "value": "23e0aaa8f5899ea296e39977d9f919816237ac4027359ae33952bd6d8f6c52b96f0a765a421c512be4d12f3826dbda59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494316, "uuid": "f23246fa-088d-424a-8a32-450dd29f34b0", "value": "T1D1030207E45A68C5D89444F2DE6680853A561BE0E4F9B3A36350CAB5DCAB8DF34F4F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494316, "uuid": "dfb4c485-5ad5-493e-ac5f-b3dd212d5d84", "value": "768:ZWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5tIK9q3UELyX:ZWXasPGxplekBgTP654QwGQLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494316, "uuid": "a8dedf37-8a57-4760-b4a8-f29228159439", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494316, "uuid": "d611b066-8e68-4bb3-93c8-e987ee02c35f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494316, "uuid": "1cac2fa7-9a05-4076-b484-10d7c4652e5c", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a993781-1f52-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773457479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457479, "uuid": "4bc50983-6a17-49aa-94fe-32e3b337fb63", "comment": "Malware payload (CountLoader)", "value": "97c282d84951c3189181d4d023f93ea7", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457479, "uuid": "4f6a3756-5402-47d3-be07-b76b9ee6ae39", "comment": "Malware payload (CountLoader)", "value": "d00607f49b281654befb521480c90f177d48d80a4af91dbac75a1740283c34d2", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457479, "uuid": "c6338a86-1d43-4993-9628-bf0d46e1a376", "comment": "Malware payload (CountLoader)", "value": "85dc688a6d8a38b7d9aad44024e072024440a00d", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773457479, "uuid": "0900aba8-dcf4-4aec-98b3-5bee5cb685f9", "comment": "Malware payload (CountLoader)", "value": "95fba6844d42da135b6bf2a023c9f701f8ffb6bdfd849c554b9ed3329c3bf641f384a0abf6378c19fb6fc4011531605f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457479, "uuid": "2f13d630-4a7c-4b96-a6db-bc337bb4c2b5", "value": "T150B3439B29CA84B59B9F342C8B1F5C0B9E8C9183071DC5807EEE6F48BF158A475F99D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457479, "uuid": "80a64c63-44a5-4025-8177-e413fbc40d7f", "value": "1536:uZwlF20RZFdqWBc1sIzQBZpu4xgvY3clV3kytN7aHv9HNwMPB:3lF20R1qWBc1BY3clV3kUN7aHv9CMPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773457479, "uuid": "9a43c10d-39bc-4659-8af2-20889341b171", "value": 117520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773457479, "uuid": "33b2bace-9817-42d7-b8bd-365da6f13344", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773457479, "uuid": "34365460-c34e-4523-91cf-907c75a6a2bb", "value": "Logs_NewYork__70.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db267328-1f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773478230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478230, "uuid": "22f4bd64-6b89-4f80-8707-ba733a3cfbea", "comment": "Malware payload", "value": "bf93b64f89338ae6e1f345d5fdf75f85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478230, "uuid": "ce6c0c9a-b04e-47c5-8117-7adde3205578", "comment": "Malware payload", "value": "d05fecfdf187e28b21ac5e5df5659f10a5e5a23eeb638440ca93789c721a9d5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478230, "uuid": "a9841ef0-8ca5-4c5b-97b4-cdd88df30608", "comment": "Malware payload", "value": "c2c6722813452bb4a9d5d7afb0cdbe541f7a5b8d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773478230, "uuid": "ea26ff97-b706-483f-a607-d7441e5058fd", "comment": "Malware payload", "value": "423a5567425cc84eb3947e70bba151250ec34048df1672b33090d9bb62b7b665d2311a8727c63c2bee67b51e22354578", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478230, "uuid": "ed2fb832-734d-4546-9940-3a09e03fa883", "value": "T14C925CB512896C79FBD1CE39AF3C6F4CADE8C2C42124E3ACBA4F39215A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478230, "uuid": "fc99da49-97e3-4692-980e-234f7218d85d", "value": "384:FFcuQpWx+BL0SWL0guzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:FF8i+BL0SI0FzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773478230, "uuid": "8a073b1e-0c59-434f-aff7-a2b1d0be6692", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773478230, "uuid": "66c77b20-f8c8-4782-ad08-bb85985d323e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773478230, "uuid": "44c71955-bbc1-4dbd-af1b-a52e665cbeac", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6016024-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491509, "uuid": "fd980e80-bd8f-4a98-9233-7498edee5d2e", "comment": "Malware payload (Mirai)", "value": "700a7e93e52f25c8ff79b4fbf49c357d", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491509, "uuid": "7bda441e-9e75-434a-a04a-ddb5a5f3210d", "comment": "Malware payload (Mirai)", "value": "d0d25b1a30b234f57010b0030e2c2d8fd082582561fbda13ccb808f74540ce86", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491509, "uuid": "8625f92b-0de2-4b09-808d-1dc20da39d10", "comment": "Malware payload (Mirai)", "value": "7c9e074c46e2c9b6481d74866f87e279aaf0cecb", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491509, "uuid": "b3177213-70a3-4813-869f-34a57b90ec94", "comment": "Malware payload (Mirai)", "value": "83166d1a97f2eeb43da3d95e7f0621911025d33c34240db6c7583e222cdaade3b3d7d37c9e6c15984f38f8cd7911ebb2", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491509, "uuid": "9862c044-2139-44b6-bd10-836f05ff8233", "value": "T155E48D99FE4E3C02D2DBE33DDB4983E1632B75E4E32342627941421CD4D6AE9CBE1A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491509, "uuid": "2f2a6d8e-b260-4970-8b06-999030316eea", "value": "12288:7LbRuGtTNYkVCqFAtBOgZ0ey+gVNRB6cs5wVql039vl:7vfNDCqFhggqutv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491509, "uuid": "dcbb5695-d361-48dc-bc31-63cd980d8d5e", "value": 661792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491509, "uuid": "520d4dd8-7ab5-4b7c-a36e-9d93c465f1e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491509, "uuid": "d70cecfb-36a2-4f64-bc1f-63cdca955a65", "value": "bot_opt.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfd1c9d-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493776, "uuid": "8aedb747-ab91-4e12-8158-026b2c38fc7c", "comment": "Malware payload (Mirai)", "value": "c427403dc9e037d6ee29a03a0d890d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493776, "uuid": "632c2374-4574-4966-a35b-898588acc9df", "comment": "Malware payload (Mirai)", "value": "d1380ef812a36814b5085edb2780f444beb6580fb704c9128e5901747fdef340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493776, "uuid": "259b2015-7e9b-4b90-a647-c48f2c699fe6", "comment": "Malware payload (Mirai)", "value": "b6579f0e8b557534441f31bae22c0eccf94c0040", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493776, "uuid": "2e39da02-68e4-4cca-bbd9-b45b2d343101", "comment": "Malware payload (Mirai)", "value": "8ddc39d761366e6ac246d8e89aaf231aa0b648be975d31dc84f7fc7bc6efaa61fe39dd1cf6565cc0923fcfa297cb289e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493776, "uuid": "d4ac63e8-f8bb-40b5-a31c-9e5c06fbfc9a", "value": "T1C4E43A56F8809F62C5D1257AF65F82A8331347B9C3DB720699189B383BD786F0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493776, "uuid": "50b83547-33ec-49d9-bfa6-b6d6b8b9255d", "value": "12288:SSnR4B6HUPTIEcb2R8inYoHqFU5iSvbwsQplgpkgqI6LVbB6QaqXst:SBdTIEc6Aod51v8sQo/iVbB6bqXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493776, "uuid": "533ebaec-2cba-4120-8a0b-3f75a1f713f7", "value": 660996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493776, "uuid": "3b272eb2-902b-43aa-8ab4-ad6350110d5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493776, "uuid": "7897e588-3de0-4d06-8cc8-95465c2a59ae", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e216dd96-1f6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773469652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469652, "uuid": "f6cd2bba-63f5-42a2-ab60-0de51983aa64", "comment": "Malware payload", "value": "1580d5c86a0469f92a9876eaa76df8c7", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469652, "uuid": "6f5fae5c-51d8-4cc0-af86-534ef54b1bc2", "comment": "Malware payload", "value": "d1e843217520a8667d0f2fcf15d761b9fda8c0ff0756fe8cf7735b3ce03875f5", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469652, "uuid": "8839fc22-03a6-4d18-813b-ac8211aad13a", "comment": "Malware payload", "value": "4b303dcf6aeb9584fb778459e259bd7a214832e3", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469652, "uuid": "9b1f3ed8-c2bd-41d1-9090-b7f93d1d4d1e", "comment": "Malware payload", "value": "1de75c850d6b2abbbad268f87bd12daa89555e05db12fc51e2d4c7e12fecd50f70f166860f5cfe14fcde2e9c4522e7ef", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469652, "uuid": "9273514f-a0e6-49a9-8b90-8b06c4f6d88f", "value": "T1B266332AB52C5EC9D46B64BAE0B12F9583EA130FF003D977965139D8B0D4BCA5DCC06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469652, "uuid": "d675ba2e-13cb-4fa4-a6d5-1d07a2be8ce4", "value": "196608:yF7Q4SP8SGSFOM0uU+HB/OGUElH6XU8YYlbHXUZZftC:yF7Qr8EOMrU+h/PUEl0U8YYlbEZBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773469652, "uuid": "cfb1eb6d-9eb8-43d0-8937-37688003dbc6", "value": 7028413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773469652, "uuid": "42b24c33-d936-45d7-ba90-f36ff1539ae4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469652, "uuid": "39339ceb-351e-4c03-bb1c-df5f149b6ea8", "value": "asfixsoftwaredev.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b577c70f-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491481, "uuid": "089239a2-90ec-41b9-867a-b0fe9c8c5466", "comment": "Malware payload (Mirai)", "value": "eba0a3dec0f36d4d8460d2a7b4345ee2", "object_relation": "md5", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491481, "uuid": "ef1c11c1-e878-4d73-87a8-75cc838d29cf", "comment": "Malware payload (Mirai)", "value": "d24e6aac6e235cd3ee4deb25d9f9eb8b940b0faecfbdd6a5d37d3ccad00707c0", "object_relation": "sha256", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491481, "uuid": "55417da4-8373-42f2-b26e-86bc47545ab3", "comment": "Malware payload (Mirai)", "value": "a5774f92ee109dd89581ba640be36f88f98821e1", "object_relation": "sha1", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491481, "uuid": "1964d372-3c46-4244-b0e6-52ebcfa9db3c", "comment": "Malware payload (Mirai)", "value": "56552debfbe16b280064b17ba6eecf3b5f9f870397afca6ae2294eea309197336abff391a28918ee91742a3a43da19dd", "object_relation": "sha3-384", "Tag": [ { "name": "arm7", "colour": "#30FEAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491481, "uuid": "54ce23af-83fb-4074-a006-010354a872ff", "value": "T168A4D055F20A3F43D8D7D439188BC285975DF96733E3930A2A4369BA38383768F29785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491481, "uuid": "94f05795-7156-44b3-8d55-bbd2e11e3678", "value": "12288:h+IC/X8ZeKngwIPYPIEjou9IpQ8pXqdjj:hEsZEjPYgE+od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491481, "uuid": "b304c443-aeff-45ff-a852-45f0397d9314", "value": 449328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491481, "uuid": "9d5b5f2f-e0b3-4176-827f-7ee0033766e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491481, "uuid": "c8e0bf54-3f7b-43f1-9c01-bccd3f8984c0", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e988b85-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495309, "uuid": "eb0e70ed-04f3-48f5-8f1c-55fa0bb4cea1", "comment": "Malware payload (Mirai)", "value": "bf96c20c5bafcc6cbfee1f9eed2d1165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495309, "uuid": "a1732a70-5a5e-46dd-8e5e-3fe0e38a45f0", "comment": "Malware payload (Mirai)", "value": "d2d7903020b0bc413ccc372de0d33eb8687d76d05197898d9489dec14bd8199a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495309, "uuid": "bebd0250-0c2c-4982-b740-8bba40260cdc", "comment": "Malware payload (Mirai)", "value": "f31b452c43fc34f2ff8cb2902cccf6c5d1787a9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495309, "uuid": "889e6220-3bb5-4a80-a4f9-dabf45cd2fcd", "comment": "Malware payload (Mirai)", "value": "4fe0c1610ec42848a91b47fac7e93e39e559d640f7c07726207af80e9643eb70ddda6028139ed1ea7cfcbdd73dfb143c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495309, "uuid": "da26937e-3f43-462b-8498-6847e3dee8dd", "value": "T188437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C769D83BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495309, "uuid": "e3b0b5ab-1b83-4539-a2b3-9fd20ac98e98", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7icBDP+JSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2WtO+gz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495309, "uuid": "43a46108-dcb2-4c22-acc4-5dcf39b336b5", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495309, "uuid": "d94c2507-df84-499d-b62b-80497a48b6db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495309, "uuid": "35661f89-cae1-4d23-b3ba-1106da62acee", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4703e6-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494390, "uuid": "9e40c682-d3af-4644-af61-a45596cfeead", "comment": "Malware payload (Mirai)", "value": "8d97ce159b75648aa85e45b513148e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494390, "uuid": "e87bfe12-3892-4e42-88d1-f911e92cb6e2", "comment": "Malware payload (Mirai)", "value": "d361e2edc1627b86dea4d98d52c9c80e9b8681e6f9275f888e33e26f6a9cf3db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494390, "uuid": "7eefde95-7eb5-4c7a-9378-1e6481448e36", "comment": "Malware payload (Mirai)", "value": "ef4afe7cfd2005e7a676bba3e7c6a4117c927fb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494390, "uuid": "c1cfd4c6-814b-4f61-a2a9-b9d0183966bc", "comment": "Malware payload (Mirai)", "value": "7b52e83ed1a208ac83cb1590a97162585311bdad54e07ee9d0d2699298cf8062e628c512b5059dd6db1486f7503b9f3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494390, "uuid": "192656f9-77cf-4797-85dd-4aba408a20f7", "value": "T142F33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494390, "uuid": "85a32bab-fd16-4999-88b3-51d37e58edaf", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjjHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OjHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494390, "uuid": "b97913fe-b706-4953-8b0a-cc8d9cae3544", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494390, "uuid": "f27981ab-c184-4481-8ab1-fb2f93cef171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494390, "uuid": "16c3bde1-ce21-4065-848b-3b33ef398ff8", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10bc954-1f7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773476549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476549, "uuid": "55b0e59d-c3b6-4356-a132-b20e3b1c44d9", "comment": "Malware payload", "value": "81021989c4833e0dd594b005b1d60fbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476549, "uuid": "12b3efe9-1393-4ff9-a5aa-29a40ce87e07", "comment": "Malware payload", "value": "d393a37fb960f9adb7243ebbb38f3e19890bb39a05ee389daacf23fedf6cdb77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476549, "uuid": "32bc5aae-4ff7-4c8b-8924-277413c34676", "comment": "Malware payload", "value": "2d0728594a044be25b79a09843077db86f070d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773476549, "uuid": "379d2438-fde2-46a9-ae2e-618d0bcb5c35", "comment": "Malware payload", "value": "ccc6724b0f648256351d5958856610f1453b1f1225cedd546bb233ca52f4ff11240c16878de3d8ad94afff7f778068b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476549, "uuid": "4189d922-c4b2-4e53-9758-e5b792b7ed24", "value": "T104A2E856A20E0997C8671E703E3EB3DC971FAED522D4D189300E9E4A82BAD32514DDDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476549, "uuid": "900e1d8c-7a5e-4c54-821e-4bfdf72d585d", "value": "384:jlDNhLEb4WcaQdRShVRg/1ZaUP8SOrCmg6ATqGdlN7S0gatyyd:zWRQdRS7KOBrCm7AeGPJS3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773476549, "uuid": "ba1f8f13-eeb4-4626-9178-534fa6833ad3", "value": 22500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773476549, "uuid": "54d1b8d5-1f14-46da-b3a1-4cce970135cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773476549, "uuid": "0cc30a27-9b3d-45f0-8bf5-441bea141e17", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077d8652-1fa0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773490760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773490760, "uuid": "1df9f9cc-32cd-4afe-8b4f-12708dae10f2", "comment": "Malware payload", "value": "2799a3bad3d9a5f6403545624b4fcf2f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773490760, "uuid": "9c9767bc-e99c-4eda-a292-16f9723b227b", "comment": "Malware payload", "value": "d3c13cea432e166347783518ebc972d0ec217c6f409d82be376312f8b9fa41ca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773490760, "uuid": "df44ff45-cdab-418d-8b2a-cc3969c08ae8", "comment": "Malware payload", "value": "b4c7b986fe6bba72f88516f40cd1b2ab09899678", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773490760, "uuid": "f6576880-3a0a-4098-921a-358f18fdfe00", "comment": "Malware payload", "value": "dcb99d9de915702dfe89c0a72516c3cbec04d99ea271b14c3bcdfe591d8463c1988e646f9af02fd6e67cf5bc21d48ba6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773490760, "uuid": "dc7c40ff-2e1b-4f31-a820-d8ec72b1276a", "value": "T158A5390BBCA109FAC4AE9231897665567B71BC450F3163D72EA0B3382FB2BE05D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773490760, "uuid": "0850f4b8-21e2-4430-9c8f-1d6b4b61e618", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773490760, "uuid": "36aa9f15-1872-4f08-abac-b996bfc6c3d9", "value": "24576:wEzivcK0pwzrs8uHaqrvdPnfudZ35UV2VOPOJI6eleX3KD1PqQwmy:wEzNtpC5ufrvxWdZ35UV2VTOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773490760, "uuid": "fdb0b46d-1641-44b7-8547-fc1a7ed06892", "value": 2108928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773490760, "uuid": "e9d5ffb8-1ea8-481a-af17-7c4899375f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773490760, "uuid": "f4a2c260-0861-4324-89a5-ebfd2450153b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c415311-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486500, "uuid": "254fd440-b02b-440e-acd8-63a01b05104b", "comment": "Malware payload", "value": "020226afd95c1b8a8e8fc8e8c91a2442", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486500, "uuid": "7e4393c9-0818-47f7-9140-297d581bb1e3", "comment": "Malware payload", "value": "d6b76dc66435f7189a8d617ade5674be4008ade2cacfa87ad7d243b7f8020b9f", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486500, "uuid": "1fb7809a-6443-420c-8cff-a37975c937e5", "comment": "Malware payload", "value": "961ea3fb4cbfb1d323b474d86dc1975750a6e6c0", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486500, "uuid": "687bbeea-8131-49bd-a804-d4f060cd0201", "comment": "Malware payload", "value": "ac1aa5665a1295ad40915f5b86e190ed32c84cff8a3fba7a3fee877141c713ffd9f2dfa32720125d4f26839bf8193759", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486500, "uuid": "aec49419-a487-4944-ae17-f81efc46b921", "value": "T19AF05C248330F560039DB09055357E8F20852F529BB25BADD52218957DA17D6FF2B24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486500, "uuid": "8cdfcf44-34cf-4fd8-9d42-715f4605d4ca", "value": "12:s8hZGrO6hTeRLa+lIhl7btpsCoMADXtQFjohognia9kM:rZGrf27lIjbtpRoMAGF0hognZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486500, "uuid": "a3276864-b577-489c-9f10-9bb94a674733", "value": 445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486500, "uuid": "ad98e4d9-fa39-42f1-abd6-77af378f6944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486500, "uuid": "4c93a09c-9a3e-4ee9-92ab-bb8a139433bf", "value": "9ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291a73e4-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515727, "uuid": "7f09a69e-0cf9-4e69-af6c-230e8a414d99", "comment": "Malware payload", "value": "c49fa805da48c74dbc6716487c4c85e0", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515727, "uuid": "caa0f9b7-3371-413b-95cb-ae3c3e51f7c5", "comment": "Malware payload", "value": "d6f8569a5a2b20639be78b11f9e45d4433215bbe408d350b5c57307cebe4b9b7", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515727, "uuid": "554e43c9-7a65-4263-9acb-01ded91af2aa", "comment": "Malware payload", "value": "a67a8b78184f18e8039e12198f45d0bad8143f14", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515727, "uuid": "06404223-5b94-440f-9a39-6829cdaa0f8a", "comment": "Malware payload", "value": "d970b38ab232d265f8fb8abc7d041e3344bbaaec4081d379a8cc8e8e068cf62d38f449a8fd7f44f5c06662d639ba804b", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515727, "uuid": "89246b59-c44b-4036-b342-034fc0e92983", "value": "T1BE350A000E44DD6F38A2B6A533B938F125445D3D8439BB5B442A29EAE85EC17FAC477F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515727, "uuid": "947184dc-2530-46bd-8aa0-4a190e40db11", "value": "384:oVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVL:AXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515727, "uuid": "9077cd31-abcf-419c-90d4-52f7aad1c795", "value": 1129776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515727, "uuid": "24255dca-5faf-4669-a7a2-2b78596c4afd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515727, "uuid": "7fc004a1-b82b-47bd-a0a8-884a00832f55", "value": "c49fa805da48c74dbc6716487c4c85e0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a75b5c-1f7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773475158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773475158, "uuid": "54b5080d-7cd2-41b8-8b4d-c7c85df9c9f7", "comment": "Malware payload (Vidar)", "value": "670feea5f79acee8b10f15cec05f4eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773475158, "uuid": "ee0d774a-b752-49aa-849f-fe1dc25f24bc", "comment": "Malware payload (Vidar)", "value": "d744d61b71952ad1ee848406192c9a34f8dfffb1e1e2736c0e0ba4a47fdcdd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773475158, "uuid": "52dbb909-65f7-4615-a905-6d8fd77121fd", "comment": "Malware payload (Vidar)", "value": "8c9ee0862c42c4ac426bfb7a93a1b5c255d81df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773475158, "uuid": "40073599-002b-4c93-b040-e7e83d8f4c2f", "comment": "Malware payload (Vidar)", "value": "8aa72280e73ba48893d1bc114b6f398e9a162f70e2ba5dc10244ffd3f264bcb9e930fca733b4e26485bea2a491bdd879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773475158, "uuid": "f6f20e0a-9ee5-4a8a-9b73-8552ed859e4f", "value": "T1D3B57C0BBDA918EAC06E873299B756927B70BC090B3263E31E81BA743F727D05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773475158, "uuid": "13f8398f-be9c-4481-993c-9874e8b1e34c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773475158, "uuid": "637c531b-0331-4474-8915-fd0592e5dd0d", "value": "49152:yg8tDah0vDV9kc30WQKdUrrl3D+fsPDrUC:ygXKh0c4JDFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773475158, "uuid": "22c01594-ceef-4d94-9b29-775930bb1786", "value": 2400256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773475158, "uuid": "e51900d1-04ea-494d-8de8-1127fe9a4d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773475158, "uuid": "c4ddec31-f1a3-436f-ae09-3be806e2a1d3", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5bfe88-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494317, "uuid": "0b06e9f7-792c-4321-9564-82630aa32b2d", "comment": "Malware payload (Mirai)", "value": "4dd4d571e00a1a0347e788f4c4ba2634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494317, "uuid": "c52d7b36-eae8-4873-95fe-788a2752a75d", "comment": "Malware payload (Mirai)", "value": "d7db38cf8a9ec3c4e534c2544c87a83f0deaf3e899f88b947aee909cf0c94104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494317, "uuid": "1fd6847b-98f5-4073-9c47-a113e7c8c89a", "comment": "Malware payload (Mirai)", "value": "b16d9ce170eaf2a45b4f770f0d1ba0a484d7dd68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494317, "uuid": "75612108-691d-4d3c-92c2-6b1700d7dc5c", "comment": "Malware payload (Mirai)", "value": "46f06494b5cecba659f621087bad25fd1b48e26dbe4cc512411335fb35f3a7ddc8b7bbf1664739adbb1d8ad790daecf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494317, "uuid": "8cd0b1aa-16b7-448d-bf8f-8f551a4b9a14", "value": "T1D25312229803ACBADB137D77B6F01FC3FA0D8B72B1A9143D21546188F7F9561287129B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494317, "uuid": "6ccc1058-e062-42ee-9049-493a831d9bf4", "value": "1536:L7XduYshWhq/HIEy6Og3Nwz9hAylxAKQLSM5Tfv83KJGTb6R4g:HdpssMPR9w4ylrQLXTX83K0Tb6R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494317, "uuid": "7ca41ea2-6544-4eb3-883b-0f95723336a9", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494317, "uuid": "77acb658-9ee9-4c89-ab93-09064caa6a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494317, "uuid": "b008dd66-b439-4780-b025-0240e086281f", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8656a90d-1f6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773469928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469928, "uuid": "ef2f10a8-d690-4dc9-bdc2-6bf81628271e", "comment": "Malware payload", "value": "bb587c17763f0ac73356216a1d9b22bd", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469928, "uuid": "25ff412a-55d0-4f89-8a3e-961fc292dea2", "comment": "Malware payload", "value": "d824029a485fc06ae3a26f8936ad20b9cefee5ded05754f8d5468177855ed3bc", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469928, "uuid": "e8e57d44-ffd0-450d-87b0-b1bcf7fb3099", "comment": "Malware payload", "value": "1217f3ffea54caa400de6ebd0de775d2df38c3c6", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469928, "uuid": "e81a028d-1865-4990-983a-30c8eacd9943", "comment": "Malware payload", "value": "c3629f02b766f0b1354e93dab279a77d9c0d10672ef24a7c253ac425cda38b13a4e1005691f42d2b254270eec8d18955", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469928, "uuid": "65a27294-95b0-41d3-bd25-d24c7761bcb2", "value": "T12D33C6FA9F6B7E6D9C573677C4820FF66EDBF0D14883333294E8921768A18E41096C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469928, "uuid": "6013125f-f718-4d7f-8a7c-fc5d9367433f", "value": "1536:kjtoT1Lxy3s5EgvAzXD4GbhJ7+C12CIemQGqrQzHFM5gi11QE3+Q370xQaSbaT:kjtoT1l0s5EgIzD4GbhR+CsCIKGLbFM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773469928, "uuid": "28322eb0-74b8-4dd0-986f-a156cb1d312d", "value": 53866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773469928, "uuid": "9f9c452b-9ef1-4b43-85c3-f3cede347eea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469928, "uuid": "ef39045b-a92c-4278-aa78-1d449af33819", "value": "d824029a485fc06ae3a26f8936ad20b9cefee5ded05754f8d5468177855ed3bc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5150e22b-1fd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773513218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513218, "uuid": "6d2a070e-4d47-4dbe-be4f-13f170947231", "comment": "Malware payload", "value": "e5d4d6c8bb32e59ceaa0b41f6434dc00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513218, "uuid": "7d9b7b3d-3dc3-445d-b4be-e4221f066ef5", "comment": "Malware payload", "value": "d864acfeeb54dc02ce2fa6276938302926d88f6facf26f54cdd40924343cc53d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513218, "uuid": "ef566c59-d841-4c88-a19f-82cdfe768c95", "comment": "Malware payload", "value": "e0a6bf6060cf1369fdaf5b63d35f2147fb5c90de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773513218, "uuid": "784325b2-bf94-42f2-a60a-d9c3f6aefd60", "comment": "Malware payload", "value": "4f1250c031e354eb9cd7cd7c0017341e143a9d9c7fc23f26fe38f1931ab439b0a5559cafa5347211bd645014c25764ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513218, "uuid": "6205e8f8-4379-4b0f-bbc9-bbe9022d9463", "value": "T14A55339A6307B489FFD6D7DAF76860BE6A530850AF02D2B9A74DF5088C420F5B4D4BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513218, "uuid": "882bc869-0562-4dd3-9998-7bc34bb5566d", "value": "24576:FTF03h2xBK7DEDC39Ygq0tgnJjEeSoYhxssq/rIkgfaj6uxO:FTS2xBKE+qgq0tpeShxr6rxgg6uxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773513218, "uuid": "a81239b3-02a5-461f-af41-846225957def", "value": 1361176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773513218, "uuid": "126faae4-39a8-4f01-892c-15b8253883e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773513218, "uuid": "06884c6a-d9b2-4728-a0d9-bc747422b4c4", "value": "e5d4d6c8bb32e59ceaa0b41f6434dc00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d00ec36-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773515734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515734, "uuid": "826cff10-ea47-42fd-ba32-85a98cc2ba25", "comment": "Malware payload (RemcosRAT)", "value": "65bacaae423a62eca6a604c38e115d79", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515734, "uuid": "6d1b6f0e-927e-4bbd-83ae-a2898229abc3", "comment": "Malware payload (RemcosRAT)", "value": "d89e1d28b8b4282aea319ea5abf962b2c58f7a8adfee9f5ae1c4516fd1414148", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515734, "uuid": "b2a27efc-582a-42ad-8b8d-0dc6c5839af6", "comment": "Malware payload (RemcosRAT)", "value": "15c1475d91a0f54cfd06e5a6682feb9a4dbe1bdf", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515734, "uuid": "8888398e-84c6-44c4-9000-6d1636833fd6", "comment": "Malware payload (RemcosRAT)", "value": "b5aead531cd20560e4a6e6737aecf9ed3205aa491ac00631d068030abe9daa4e5eece74511c6e9fceeaafaee859d069d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515734, "uuid": "9a94b06c-04d1-4f53-8854-01bd23a15030", "value": "T12241D5082BDE6B34D7F78A7FA8A6E221867A7849FEB1CF1D029195951812110F431F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515734, "uuid": "24997822-1f87-48a8-9ad9-897b382bce28", "value": "24:8Wq/JWSydM+ScI/AJe+/4FJTOR00wRpJ4MpcQgDpc5fk4o0aH/dqq:8WpSydOWAw9c4xQTZoldV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515734, "uuid": "52b62d1f-b026-4510-900d-edc81ad1342a", "value": 2144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515734, "uuid": "47d26b6f-bea7-4e10-8114-894142957d91", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515734, "uuid": "7a2dee8e-3c15-4b86-8751-cde9466f6e44", "value": "65bacaae423a62eca6a604c38e115d79.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b865710f-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491486, "uuid": "d4ff77d7-c181-4d67-9e6e-708785a310eb", "comment": "Malware payload (Mirai)", "value": "fddb81912c8f7a9f988781b563242324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491486, "uuid": "613d4efa-6c37-49e1-b194-89ea8bc4a694", "comment": "Malware payload (Mirai)", "value": "d8a4b9c89ae08035d2dfa3f3561361b41318a45ab3ce7a7524365b98fe8429cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491486, "uuid": "834a0913-1050-4e8a-8ce3-fc4e69981964", "comment": "Malware payload (Mirai)", "value": "5f2a07a040ff05e4e3505b9fec165612bbd32fb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491486, "uuid": "e0b93e1a-68f0-4bf4-a304-f7ee2da1fd17", "comment": "Malware payload (Mirai)", "value": "0d593c44f26246cba00768e33f41d3fc656bfac778939658ee66ec0dabe19839268f230966aad8e79047c7fa373aebc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491486, "uuid": "94351c46-7aab-40e5-ae28-b92f673dd708", "value": "T14AF47C633711CFA4D314D67009F3C6559AE425A21AE250CAB37CD32CBE6162E2D5FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491486, "uuid": "72fac2de-afbd-45e1-904d-6b340d189597", "value": "12288:sfNrY4ly5iiNrm8c14XrSzEkWkQRPbmySbphBI6LjgM8p8+JZEiP7:s1M4lyBNrlbSAkWkQNbmBbprIQqJZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491486, "uuid": "52a0da0a-73a3-43b0-84e6-67b4c4c50641", "value": 753396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491486, "uuid": "b2703cb4-2260-4e6f-8be6-00b4477551b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491486, "uuid": "0486d2a6-1fef-4970-8067-619ded3b5fcc", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82b231f-1fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773501874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501874, "uuid": "6c3aec27-c309-49db-8c2b-3c77022a913a", "comment": "Malware payload (ACRStealer)", "value": "c045a48123dddaca1656bb5d389d3509", "object_relation": "md5", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501874, "uuid": "71206642-b762-4874-8fe3-a581ea34182f", "comment": "Malware payload (ACRStealer)", "value": "d955546f64e68c8e9f70b08608b414ee6993dc0ecd8a362a94271160c208b7fe", "object_relation": "sha256", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501874, "uuid": "d09215f3-5af4-4d99-a19b-170202a57bec", "comment": "Malware payload (ACRStealer)", "value": "2a49e3000093ac28d16878d516165dc1cc763cca", "object_relation": "sha1", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501874, "uuid": "d0392462-8260-4f7b-8679-ea3a7bf69498", "comment": "Malware payload (ACRStealer)", "value": "53970214b2e4f0089a98ea7b90797e65d0971257f9ffba16fcf7637c779bead8e59459bda31830ad79c4faf66e6e18a8", "object_relation": "sha3-384", "Tag": [ { "name": "185-177-239-151", "colour": "#8BE6E9", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501874, "uuid": "d2727a91-8ea0-4efb-b331-74cea029e6a6", "value": "T10FD51282B2B00591FBB887717077045616637DFE9DA91AEF2089F53D4EB72F1403AE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501874, "uuid": "1ac6aa45-7b28-442c-87df-bfec1ed735b9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501874, "uuid": "a0af3aca-eeab-4715-a147-262234cc379d", "value": "49152:jTlJujizOh2fm7VHYgV2zrLlLlPmaOaTnLnit:jTlIiz0u4xWllPmi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501874, "uuid": "6dcd7051-b43c-444c-bc3b-fb495b4bb238", "value": 2847742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501874, "uuid": "f04008e5-e9e4-46e0-8782-26afe6798ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501874, "uuid": "6d5a7708-0dac-4937-a11c-3320f1d4aef6", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4567edc0-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773515345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515345, "uuid": "d7116656-9b2f-4921-b7c1-3cd990852373", "comment": "Malware payload (MassLogger)", "value": "b09a7be143fd8091c061034e255ed6b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515345, "uuid": "6f4b5fb5-fe52-4d32-8654-256f0346e8f2", "comment": "Malware payload (MassLogger)", "value": "d9a2553d9d3f2b8a0a9223e7042676e2400c5fa87737157220436934de3fe5b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515345, "uuid": "8e5b0b2c-e716-4f63-a755-acc5c7ed95af", "comment": "Malware payload (MassLogger)", "value": "2c543f7ad1ee2a026a17cbd20c96f71067acf82e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515345, "uuid": "09eb33a2-a5a4-459f-9806-34f4cf3a5c08", "comment": "Malware payload (MassLogger)", "value": "15982d095c6aa094762e2f07f8fe53f8579d6534b9fab5a20defd6080a2889259cfecaeb071e797f3df4156a28c5692b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515345, "uuid": "d69108c9-4e4c-4c99-b9d2-ec7403e13eb3", "value": "T14475AF41AF8D2FF09D64B819185D59072F132FED00916B5B0ABAFB2E9FAEF109D47412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515345, "uuid": "72444bb9-d507-49ce-91b3-5fb1af16ef86", "value": "49152:Hq3dLUsvfv/1bwYQsv5B/SikAI9Wm358TE18gfcyktqJc8PDwyFREHDHCqXHsL75:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515345, "uuid": "64ad4f75-c2d5-4dbf-bbe5-4067bf31c0f8", "value": 1573399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515345, "uuid": "79193495-926d-4627-a61f-3b310768705e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515345, "uuid": "6a8c1a65-903d-4e44-a61a-d10d86929f00", "value": "b09a7be143fd8091c061034e255ed6b6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c7bb4a-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495217, "uuid": "8d5f147b-d579-4bde-8336-39b6bc8085f6", "comment": "Malware payload (Mirai)", "value": "26e8bfa37aa5d0a6590ae0bbdef6328b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495217, "uuid": "16d89929-ea53-4dfc-a990-fecac161bedf", "comment": "Malware payload (Mirai)", "value": "d9b980cdff58114377d458a5e02ad148c1b8b9719d0394760b11d29064ec5b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495217, "uuid": "88865dbc-7a17-4e44-aa63-60489dcc8974", "comment": "Malware payload (Mirai)", "value": "de8dc3c1e58fc44a1ac3f847a6d51c3a356d0544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495217, "uuid": "83b258cb-398c-4ce9-825e-9919a197e391", "comment": "Malware payload (Mirai)", "value": "b04123a1c3821ee67c0a08934678bdb1b512f1dd45e79327dec76b7c0924a09ad624bde5655e0e8fe0860066e174ee2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495217, "uuid": "c04b7600-ac0f-4e83-9715-b5e58f699bf1", "value": "T14453AE77C8396E64D25581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495217, "uuid": "e18494d5-b908-4606-a82d-ffaaa5e5061e", "value": "1536:caCwtuAPFqcgdEcI5KU3AwHup+CSXHld5Zo:c58PMcgapAUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495217, "uuid": "75a41953-4e80-4211-992b-4cdfcadf63f0", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495217, "uuid": "d203282a-2d94-48e0-9ae4-01a8d52bf3f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495217, "uuid": "b62c753c-5ceb-41f3-a485-007b1b169e99", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86dedcd-1fba-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1773502224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502224, "uuid": "1f544388-80f7-4dd1-9d20-5dd3ab3eaeee", "comment": "Malware payload (Smoke Loader)", "value": "337a3807dbe06fbd5a90820c1f857a11", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502224, "uuid": "ac0e82ef-34b9-4c93-9fa6-335577a74bc4", "comment": "Malware payload (Smoke Loader)", "value": "d9e2efda04c7537fed85a0de2485003c11dad0cf715b39c529b67948c8ea3afb", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502224, "uuid": "865b7927-4a46-4d23-ac6e-69a8b218fe9c", "comment": "Malware payload (Smoke Loader)", "value": "f579f2ca20316fce95a1bb408b032aa80087a299", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502224, "uuid": "8a3f65f6-0945-4e2b-9275-b1c61c4c3516", "comment": "Malware payload (Smoke Loader)", "value": "73e878682c8ab747af315d4b09582e8568eec071f66a93477683677463eb3eea59265ee483639de466de21511073b256", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502224, "uuid": "eeb447d9-1a03-422b-8562-f86fe07dca32", "value": "T114955B067C9544B6C0AA9732C9A6A2F2BA34BC084B3263D72F917B7C3F727D05A35715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502224, "uuid": "49792777-3acd-4469-bd98-3150aa64813f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502224, "uuid": "4e0c7b5a-d2e8-4d62-8fd3-5c4792889fd2", "value": "24576:f1FglaPiOKUd4M46dl8IdVtfmkfFOGiWfKYL20CTu30:f1ilanKo84mk95/C3Tu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502224, "uuid": "927ae55d-ca09-4731-8281-440ba5ed271b", "value": 1937920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502224, "uuid": "0a568928-1f9f-4948-b1aa-a9d391c99bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502224, "uuid": "1761f28f-5107-43ff-9fa2-4a9ddeee1aba", "value": "downloadlink.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a38829-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495245, "uuid": "4ccd14b8-39e8-4393-ba44-eedbb976c153", "comment": "Malware payload (Mirai)", "value": "a9e430119fe8b39ef87692cab276933e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495245, "uuid": "f559f24a-3c5d-490e-b689-969dab6c52ec", "comment": "Malware payload (Mirai)", "value": "da1b3344918089c915331b9dce5a1127ae1a6e4135d308c12a354b8078e1f85e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495245, "uuid": "b2218d19-e475-4524-b6d7-23751f527692", "comment": "Malware payload (Mirai)", "value": "5d258a1e76ff03134af10fa22f3bc59605293e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495245, "uuid": "5b7b9975-e7bb-4efe-b9db-d84737f5025b", "comment": "Malware payload (Mirai)", "value": "1caf413aef552cdb1d5c1c2acafdba7606dfa1c380c284416951513420bc7e043c2da3e3c8d1de9a229626bd0109bb19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495245, "uuid": "b2d134c9-0f72-4e8f-9c61-57e5c5f51f0c", "value": "T129A3E81B7F21CFAEF769927007F74E20965837962AE1C685E15CEA411F603CD281FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495245, "uuid": "f68ce62e-fec4-4a21-8d77-b7c8da9a3ee1", "value": "1536:Of+/bN+KNK86H5CgHUh03NlOlMUYBu3U+RzoeehRbbwl61d65kpyv:6+z32Eh03ufYs33Rebw4cka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495245, "uuid": "e3655f29-7559-49e8-80e4-c63234807d50", "value": 106360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495245, "uuid": "f0d57b89-2777-4b05-8073-ab2583d02740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495245, "uuid": "1db9e473-afa8-4ff7-839f-c93da01a71a0", "value": "xfr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a295fef0-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495315, "uuid": "548231ee-6e3c-4d2a-9ea1-fb67aab18023", "comment": "Malware payload (Mirai)", "value": "f54a6ebf7a9d59420d0c3a82154f28ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495315, "uuid": "ffc5290d-2662-4961-8a80-e17f75d6859b", "comment": "Malware payload (Mirai)", "value": "da2a8efcf5c645dee16d38be9f919baaf2ddde7aa476064583449b888fc02f51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495315, "uuid": "66ee6d1e-47b2-4a76-8aa7-65ab8e1a6aa4", "comment": "Malware payload (Mirai)", "value": "f9081fcc88861ac64f881645dd75e3372e167acb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495315, "uuid": "7334afbd-32f1-4c78-9d5f-03299269b730", "comment": "Malware payload (Mirai)", "value": "b2a98c81925c6fbb075e58c7cf127b7bc88489ddcdaa5498e176c2b212e9eccda0d206c9de33cdb779b2458711de970f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495315, "uuid": "dcf1a315-7127-47a7-a942-fa72fb4728aa", "value": "T17AE32A46E7408A13C0D6177AB6EF42453323AB64D3DB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495315, "uuid": "e15655a6-94f6-404d-89c1-29b332d9cf9c", "value": "3072:TVu+le4XalHzbx8PogNLCz7QHE8E1LNJmM/9KIS:TVuwXalHzbx8PBNQ7sEH1LNMM/9nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495315, "uuid": "2da175f6-8f9a-48d3-960a-245c42046df0", "value": 154279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495315, "uuid": "cf7f521b-f32d-4581-8299-4cb42eccb5cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495315, "uuid": "32af9f38-5e27-42bb-91ac-a98c3a0cb584", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1446dcc6-1fc9-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773508391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508391, "uuid": "bd98db5e-48a4-4f00-adf3-1ec021238adb", "comment": "Malware payload (ACRStealer)", "value": "3753a96a19f70ea02333b05f9b2d3edd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508391, "uuid": "17b88773-00d2-4a82-a3af-de585ea006f5", "comment": "Malware payload (ACRStealer)", "value": "da4e0b6b5d8ab7ab3d527995e56acc5906b06e03200408e77cd41b1ce96b5461", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508391, "uuid": "9a891dc3-6aa3-4a43-a90c-f1606a0ca84c", "comment": "Malware payload (ACRStealer)", "value": "d9a4f6e5d3d23200bd88aa6942097332113e5b26", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508391, "uuid": "11044885-e904-4b85-acd6-3f5813bd6ff2", "comment": "Malware payload (ACRStealer)", "value": "2ec464f4f443709c6979c66ba1ca570039f622e6a8f2f95e3fa9c0275bf61d3c313747f8d2363f3a718a6ef837f9328e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508391, "uuid": "16e877ca-90fb-47e7-abfa-a90142d44e6a", "value": "T167A52B8295C356FAF63F8C724066956F232C4D98F911DA3346ACAE53B9333DB82F1542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508391, "uuid": "b0261c08-7ca7-4390-8966-ccc4af1019fa", "value": "776f77c813320473e3d8fe780c3b4c61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508391, "uuid": "b114e980-0dd8-460e-b43b-d17db59b1c14", "value": "24576:Ek66lnEXxZeOFw01SjcVkQa/KdUTkYYceLHnhryLfBA3Ooc8sHkC2eRxUjj27qBr:0x0Swsj2Dp0Hnhr6fBbUj27qByw9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508391, "uuid": "68ed08d2-8627-47cf-9cd3-2836f23a6d9d", "value": 2245632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508391, "uuid": "6cecf216-cfab-4cc4-ae45-9aa2e0d1a18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508391, "uuid": "980cf686-d16b-4e33-9b4a-c0c9883c2d3c", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936d8230-1fb2-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773498726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498726, "uuid": "635b564d-3012-4949-b438-509be875faa8", "comment": "Malware payload (CountLoader)", "value": "118d0d2ae104845e33ae634fe7e525a9", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498726, "uuid": "a9c9fa76-5baa-42df-98b9-180ab6817130", "comment": "Malware payload (CountLoader)", "value": "da68ebaee8ceb3bff2912d2c75ff22cbad56a890fd13980be2fc348fc92bde42", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498726, "uuid": "16c18186-7e8c-4fa1-b48f-edcd98df0263", "comment": "Malware payload (CountLoader)", "value": "4c155e2347368623d5febc0d853b86149476cc4a", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498726, "uuid": "59ece5ff-b825-40ea-8f90-9b899fcb5f7b", "comment": "Malware payload (CountLoader)", "value": "0435ef6faf48299118a1bc32d5d994f482cf3853a8bf196d2ebcaca136c19a3da96a1b43a9daa477b18d6c1181450f14", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498726, "uuid": "ce7c2551-ac1a-4812-94dc-08ce4999b74f", "value": "T198C32D7A139BC5E59A0764A1C5CE4986EFB44416437CC2E0FF5CFEA92F218ACE0D16C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498726, "uuid": "c685fff0-a39b-4ee3-8793-e2d731122587", "value": "1536:J8IIax5iyW7xDls+8IkcY2zz0kF67M0V91enmjFZS1a:soIkcZ0kFzmWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498726, "uuid": "f7cbf90b-79c9-4f29-96e8-2e28b90d42a9", "value": 122553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498726, "uuid": "0a6c44b5-723d-4291-b1a5-3a0bddf59f73", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498726, "uuid": "254d20cf-6836-47dc-a71e-484c4ce8e78d", "value": "Sales_Report_Monthly_3200.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687b1b1f-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495218, "uuid": "ab0c3208-638c-43e7-a446-a898751f359b", "comment": "Malware payload (Mirai)", "value": "0109aeb36d81d73a206e0d4a10045392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495218, "uuid": "5e400927-f679-4d2f-b9b1-40f332ef9ca3", "comment": "Malware payload (Mirai)", "value": "dbae0705cda13839f9594cd9bd5429253f49caf3d9a44505cef3efe2fa3d2a33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495218, "uuid": "8fcc48e0-1b5f-47bf-8692-901820dbe2ea", "comment": "Malware payload (Mirai)", "value": "21e1589934d0cb878119bc905b34ffd1e9bb3b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495218, "uuid": "ac97fb37-4aa3-4661-8290-f272c19a9d88", "comment": "Malware payload (Mirai)", "value": "59c366c3fd395871d395578ef6afb90bd1aa06c4f050b4626b35484ae60afa2be5a464cf3937c3b41057ff89f75c922b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495218, "uuid": "d8ecf954-b6b0-49e5-bbee-2a50a159f665", "value": "T1ED82D03162D665B3E3F0003ADBAE82DA537E47FDC0FA377904112174DEB11ADA2B5586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495218, "uuid": "8a63b5d5-9707-4965-94b7-22b84d5a71fb", "value": "384:3czJ2ycgX2VF8l4sdV4dRE/Bxp9V9aYzNBo4JrCD5vhymdGUop5h47:Md2TgGVF8lEda9VUYzNBojDZs3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495218, "uuid": "7997abd0-d644-4b42-acc0-bcdc7c3057ca", "value": 18032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495218, "uuid": "910ee570-53bd-4388-a0f8-a810e18e1e54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495218, "uuid": "bbcaa241-5adc-4c5e-aa8d-3db34d3b76cf", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fb01f9-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486545, "uuid": "3392485d-67d3-47b5-a7ce-35675724f8aa", "comment": "Malware payload", "value": "ad9bfc4269b3308e06003d553c60e972", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486545, "uuid": "3daa2629-5b30-4d84-a4a3-ba5159084bf2", "comment": "Malware payload", "value": "dc53c17504a25db15b830df16f1b312028f546dbce9328d8dbe5d066deb64eb4", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486545, "uuid": "c2e64f4d-6e7d-497f-b60c-50e81f1cb21b", "comment": "Malware payload", "value": "d9644ba5c547dba80c8ef0748bc5ab942617f50f", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486545, "uuid": "fe0d2dfd-19fa-4756-9841-d1e78959159e", "comment": "Malware payload", "value": "0364ad99a378cf608b3309d786dd36a119881f1923e9ce366f5c231109de32e91f32d4b0cac335d5a75c574b411103fc", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486545, "uuid": "929229f2-d420-4e68-9220-bb09cae607a3", "value": "T122F0A3395F3AF4C4431AB06055049E9921D02517D7FD6F6FF922196A7D20794DF0F14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486545, "uuid": "de55e750-4a51-4fa8-b7e7-d900184627f3", "value": "12:s8hZGrO6hsVKp1tFgRguua+ZgkzKq+P8p4:rZGrfDDZhzKvEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486545, "uuid": "d1a43515-7914-4857-9160-5d89f07e9f6b", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486545, "uuid": "e3a2116e-08f0-45be-bf66-62360a601587", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486545, "uuid": "32b67f6e-6fbc-4486-9e10-9a61b25ee4e9", "value": "5ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85096ec6-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773516311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516311, "uuid": "32906279-20fe-45d4-bdec-a8d2103afaf4", "comment": "Malware payload (AsyncRAT)", "value": "55e592599540b23f71d978a23378b118", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516311, "uuid": "199583a6-26cd-4f39-88a0-061f59b67cca", "comment": "Malware payload (AsyncRAT)", "value": "dd068eed57c2238760f2f925cdb0ce1c016c44e9ded3b064a39961df200018de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516311, "uuid": "5fe14062-2dad-42e2-b6e6-f94e9968abd2", "comment": "Malware payload (AsyncRAT)", "value": "512ca6e301c2e623affd1b9d3c32e6283a17e85f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516311, "uuid": "cfe073a4-43f0-4546-a1e5-34505b2a6186", "comment": "Malware payload (AsyncRAT)", "value": "e0ad28b00a4aa74c7139ab418ce6ad6f25c1c15d30ac946476a6ae03c695b4b9ce2b9e4167df2822c099c0f3f423debf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516311, "uuid": "3dabaca1-e396-423d-9698-384170e37c6c", "value": "T185C2B2471A45F147D07F233BF7EF69325AC2BD2111132562ADB88EDB162EBC79243984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516311, "uuid": "7c69dbcd-d8f2-4244-a24c-22e4643de48d", "value": "384:rvUES2QEkYlKxtGu3a3JCTL8KjZhDyVNB4CU4ZJYv:TUEjPCLd8Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516311, "uuid": "81d75e2b-00f7-4ee3-a702-27da15b6b302", "value": 26813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516311, "uuid": "dea8fad9-7a5c-4aba-b3e8-b552767f1196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516311, "uuid": "9352c90d-3e3d-4057-870a-bd7176d8f201", "value": "Projet20Immobilier.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481b13e6-1f8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773481420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481420, "uuid": "a2b8cbbe-1e17-439d-896e-8294c1ab1ec8", "comment": "Malware payload (Phorpiex)", "value": "0d2befc495fa9898a529262abe7013f7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481420, "uuid": "fc860304-0ace-425b-9bf3-b375f81c5d79", "comment": "Malware payload (Phorpiex)", "value": "dd156e18bca25a4332360642b182057e2b115d77157c1a544763030289fe443a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481420, "uuid": "8b6cc479-77ef-4e20-8dd6-97a4ac982290", "comment": "Malware payload (Phorpiex)", "value": "d943c939167a4a31b6f9c7e0349d27838bafcfd2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773481420, "uuid": "be3e355e-8089-4765-a84d-7ec092cfe352", "comment": "Malware payload (Phorpiex)", "value": "5699da23cba17a41b3e60c33823ef3eb653e6bb9ef3de1742d028aae4056b16396b1e5a81af0312d6e4926e61ea91064", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481420, "uuid": "9d33a0e1-3542-4587-903c-1e0cf796d000", "value": "T1DB825C0FB9814217D1D100B59A22867BDA78947233D864EFFB904AED1B686E2F83314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481420, "uuid": "a1e3d54d-3159-4b81-a0b4-79a5dcb6cc1b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481420, "uuid": "ad409d69-e41e-48b9-8667-6b3851e88cea", "value": "384:w4GIUVp9cfcPwOQxb0YSLSZWXnZ++SLZav8U9cwiY:zEifZ0pLSZKZqLZa0Uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773481420, "uuid": "31f940ec-cd79-4a6f-a5bf-7555baeb6cd9", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773481420, "uuid": "e8928b10-1aee-4d41-b57d-60bc321758de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773481420, "uuid": "32bf02c3-a1b2-4dc3-92e4-9a4e3d327a5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63889756-1fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773506376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506376, "uuid": "e32336dc-1d8b-4dec-bb2e-6eb341639f3a", "comment": "Malware payload (Vidar)", "value": "71094e06eed4951e31dc587b273a39e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506376, "uuid": "0c0bad74-380f-41f0-aadd-a1c18fc2540c", "comment": "Malware payload (Vidar)", "value": "ddb2ead258d1d7454dcb789441df27cf65fb319d5febf76da1d8fe2676ccb8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506376, "uuid": "5cccfb5d-fc92-4311-81e5-d60d20c67b9a", "comment": "Malware payload (Vidar)", "value": "cf3356732126878297c333f05f604e3994310f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506376, "uuid": "59137b49-3015-44c0-82d1-de4ed7b33e93", "comment": "Malware payload (Vidar)", "value": "b335fcd05b34ba451ecc22931378ed17985a357981caa970b56a9fc669895b1273e9a95f1912720334b3bf7bc7ad074b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506376, "uuid": "77c3e00c-42cf-432b-b829-a85e98b712a3", "value": "T1C566F62B22518769F10F923AF5B28A70E5F760FD0BF385DF46950329CB96CC54E7A260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506376, "uuid": "4da31a89-faf2-45e9-91e3-9343d2dcec1f", "value": "00d782a7ded6a3c43266f1a10c5d7773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506376, "uuid": "33fe62aa-dd59-4daa-aff5-9cc042b52dbe", "value": "98304:7IoZyQ01KG5KKMv9fZE3zo5tMJbh6eQzZAyBnNx:bTRNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506376, "uuid": "e449525b-1853-4de2-8836-f920939700c1", "value": 6577152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506376, "uuid": "90631546-50d4-4ced-a2cc-eed06d99200f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506376, "uuid": "aea86aa9-f88a-491d-8225-4217b94dadd8", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd83d3c-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493777, "uuid": "1d73652e-2f39-493a-a75f-72e4cba1b94d", "comment": "Malware payload (Mirai)", "value": "1a5ff40d300aa3a6a881e02e61a99dea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493777, "uuid": "f6618b6e-e627-4aa1-ab69-09684c9ad30e", "comment": "Malware payload (Mirai)", "value": "de732f8df88ada0509bdece86f81360ac19c217398229985ab64a1fa80a60eed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493777, "uuid": "1b92e91a-721a-4437-941a-4c40cf106cfc", "comment": "Malware payload (Mirai)", "value": "6a1147b4e307f083a62f9a905064e8f8aff3e685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493777, "uuid": "2073d38a-cfd2-4eb0-87df-ef2c5a30e18d", "comment": "Malware payload (Mirai)", "value": "bfe6d85fb59e30c166b5fda0894f463e4ea050c1709a419e32e7080a97c76eed6832a03eb48f0f56420f4c7da306e13f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493777, "uuid": "7dbbced6-4969-4fa1-917c-025688dfb318", "value": "T104F47D63B7318F64D3E1D27405F38B219A9921A20BE351C6A37CC6207A6076D6C6FFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493777, "uuid": "fdd13b60-592b-45d8-9554-a11c812e29b8", "value": "12288:jFHNmndkP86mXvXWw+6Hm6qQ4694iSGAUIQCe2KjnMgpk6tYouYlaoVZpYqS68:5HNmndkP86mfXWw+KL4iSGLIherjdGoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493777, "uuid": "e44fe9da-29af-4500-ba93-8e31ecbd4b2a", "value": 724020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493777, "uuid": "cd4d002e-62f6-4a7f-a585-f434710e8e8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493777, "uuid": "a8bd3d86-3aa9-4316-90ca-beb888abcb0f", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945680e8-1fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515048, "uuid": "256b3a0f-0cdf-4df5-b7aa-5d45696cf55d", "comment": "Malware payload", "value": "152c5dafd6c112d11c2ef9a8d3faeeab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515048, "uuid": "83dba22f-ad35-48a0-a614-54ee88fcd377", "comment": "Malware payload", "value": "de85c342ac6c0fe0c18cf02ff585bc1604fadb123c3a9bcd23a03adef7c00688", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515048, "uuid": "c70e8ff7-8271-45a9-8969-0ed0006b8c03", "comment": "Malware payload", "value": "2cba24aece65578d49f52d96cdc826ff2b027c44", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515048, "uuid": "077536a0-3972-47dd-8308-84e32673182c", "comment": "Malware payload", "value": "0534e4619d43a936c264ddc7e24072547621fe932b0d5663d0646fca53c52106523d0ae46116b459f81471b40c3f897e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515048, "uuid": "68ae355f-e464-406f-ad91-d2e44bc7a29b", "value": "T1E0141E446AC4784417471B7B3B1FF8E9F86F0DAA3848484BD155FCA0E1BA706F9E1A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515048, "uuid": "d9bd1368-61da-42b2-b3d6-3d7d9e3125f0", "value": "1536:0vDutB8rQYh4DrjakkatHsko6KgXy5K4m6CRG3L6YJk1rqGu4+wfjiRja8vPIfBn:PWg3o1Lkm4Q6KUUejm1jbfl+imZjH+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515048, "uuid": "4ed484a3-fdcf-48d6-b96c-379c1759bdf7", "value": 193068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515048, "uuid": "9d490472-15fd-4722-8d96-9acfa75f8060", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515048, "uuid": "e5d0374e-1d6c-4971-a4c3-cb3069c02023", "value": "152c5dafd6c112d11c2ef9a8d3faeeab.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ffce64-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503772, "uuid": "5c6de51b-e4a9-4056-84ef-f004878e51db", "comment": "Malware payload", "value": "7aec50f6cec00e98c997a148b0382125", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503772, "uuid": "036ed41b-b358-4796-8e86-4fd4d8c26482", "comment": "Malware payload", "value": "e05dcd36b3b4eee9a8a96bf0efb18eb094fc62cd2dd5dd38bf276c7982c17271", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503772, "uuid": "8e76d491-a000-4f60-a9e0-b9f901c57b33", "comment": "Malware payload", "value": "a436d06bd3fa34d80002ba9dd8bee1d05001fb4e", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503772, "uuid": "1d3446f1-9679-4fc6-9b95-4b760e73a400", "comment": "Malware payload", "value": "9cc2f05d6cb23653c5cb4ac2b6808a031e346311337fb40869aee62a7d2ae7a838ee27de12710e494973bbf135233fe3", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503772, "uuid": "b51d270f-a0af-48c6-830a-12e449af2276", "value": "T16F7219B9E74B8BACA46ECE786DDD3C0830F42D9F1047E584C73EE9E169A6313408E558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503772, "uuid": "afe4be87-a6ea-4a8b-89e2-bebc0d4271a1", "value": "384:XWcxFFSIfBJHsoW0i6ORVE7dQRxdbFKfRpUfp2T7miIWmZhRVU:mcLRxK0si7dQR3x4pUfThnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503772, "uuid": "708e5595-2156-4e88-b44c-04d76fb3a5bd", "value": 17499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503772, "uuid": "81fb529f-e51c-4f34-95c2-f57e64ec8cb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503772, "uuid": "58aa8c64-b621-47da-8490-95e7bea0b921", "value": "mrllvd_clickfix.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffea3ede-1fba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773502344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502344, "uuid": "a708e695-e97f-458e-88af-b4dfbc2b9333", "comment": "Malware payload", "value": "a511adf3be7795165a6c9bc2f7bfd773", "object_relation": "md5", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502344, "uuid": "8d138457-731e-486c-b6da-9b0a1040924c", "comment": "Malware payload", "value": "e08e97fc49ff9dde2a9fb504d37ea7bb6b15df267de1b7686a17795f1990b266", "object_relation": "sha256", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502344, "uuid": "d4ab6792-1f91-4c8e-8da0-615164a5f3d9", "comment": "Malware payload", "value": "c96014235d7f33203c6793d6fe1e6d33bff77547", "object_relation": "sha1", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502344, "uuid": "07f3ff73-eb05-4c0a-944a-df0de4f66fca", "comment": "Malware payload", "value": "162df0e717df495fdd19a86c9f8da90eae45628f359824d0578504f8441c3ca165118e09e69f3ef356353945d7ac8ac1", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-53-10", "colour": "#548DE7", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502344, "uuid": "a8f2fd87-633e-4164-a0f5-a9050b78f3c7", "value": "T1DD773354C75E0BC2F347F27C71D76646EA359AB93548A2DE6B3060E86CE3ED01B0721A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502344, "uuid": "a8d2c3bd-7ee9-4626-8319-9b8237576ae1", "value": "786432:/okgzm8sZ0ADPns0P5vtlt98udSIkPix+zmcx1KnOj:AkgzYZVDPnnZ8uEIkP8+CcbDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502344, "uuid": "a3c5f31a-b36c-41c8-aa4b-52e6f005c744", "value": 34482432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502344, "uuid": "78dac5f0-4dcb-4be7-ad43-e9ac5f7b001b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502344, "uuid": "3aa48d06-a1c0-41a5-8150-7181d1226589", "value": "Free Download File.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c220e1f-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516216, "uuid": "c2d04089-2470-4910-9bae-bacb946d10f7", "comment": "Malware payload (XWorm)", "value": "3b27530c656659cbf8037dd0aa15cfa4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516216, "uuid": "ecc4d62e-3ae7-4b21-815d-f75d5239d585", "comment": "Malware payload (XWorm)", "value": "e0dcf89f51f899264ba6e594793b482b84fb14a25a5712fc0616d46aeee2e65b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516216, "uuid": "78be0221-ffb8-4203-b6a3-e0c32795421a", "comment": "Malware payload (XWorm)", "value": "333f3414fc54115f2deac3518070a039a96dfd19", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516216, "uuid": "5c8a2508-7c1c-49c1-a8f7-194312d251ce", "comment": "Malware payload (XWorm)", "value": "0f2d1f47e0611ceb068fe90780dab5147e76cb71990f6c68f77823c6e41edd4b5d3792cb5fe2125bf72db1e54ae7adde", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516216, "uuid": "d51bf1a5-5047-43e1-baa7-439b486f522b", "value": "T15AA20D3EC9859FF00B6A31E1A56F7A1665140363B9383A4C79CBC0993B3A650CFB51ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516216, "uuid": "30f1cbaa-8426-4309-97c0-e1424bb4e904", "value": "384:KVaOU9cGp/N5MjocSbB0j/hW97fvuphex4WeS1Z+9Rda5EzZmClF/SpeaTi4HkR3:KVsNOjP3OLRy3FaeYmjBSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516216, "uuid": "4ea51b32-f73e-4689-bfd1-d75969e25171", "value": 21809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516216, "uuid": "cc39760e-e9d0-40fa-80a8-fb662d0b84e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516216, "uuid": "97be5583-0006-4b58-b2bd-5b26c301ac0f", "value": "3b27530c656659cbf8037dd0aa15cfa4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812339a0-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495259, "uuid": "ad5e70c9-7b1b-407c-b2fd-96fc95d96054", "comment": "Malware payload (Mirai)", "value": "6c976c1a95ef5067e01e03a4d6137fc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495259, "uuid": "71a5da5f-6268-4d6c-afaa-1b6b1b0ef8fc", "comment": "Malware payload (Mirai)", "value": "e0e3fb31627bd11d252a8e2e0eee86a37333c32bc095c1affafcd3bf2246c859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495259, "uuid": "7fc845da-72d7-451d-8f2a-a12dc65a8f00", "comment": "Malware payload (Mirai)", "value": "a8b2613354ce2e9052f1d0079fdfd9b5e6b8ac29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495259, "uuid": "b7195a80-3906-4ebf-9050-3556108d2133", "comment": "Malware payload (Mirai)", "value": "451c2c31be9f090921fc3c965cfff008980127212aae6137d727c7777db053f9f642c747dc30ce4be85b4a9e2307aa68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495259, "uuid": "cb031297-c7f5-4218-b5a6-79f22bd6605c", "value": "T171361997B8824A42C4E43677BCBD80C433A75EB99B9752676D04FE3C3ABE1990E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495259, "uuid": "1ac6041f-6a82-40c3-9143-58f100b95db0", "value": "24576:wxkTtTiQ7t5Wz0bnlDVfl1IZT+rOYXJod0WBTb8Tpr85MScnOkEIbU8cDdyhqv7i:nigGUB/qs14S2ZKQA+V+1INE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495259, "uuid": "fc9edb0c-7d35-4258-9b4d-5f4128d05dc9", "value": 5177496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495259, "uuid": "5d8b61e6-b45c-4a2c-8c8b-b9bafeb2b547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495259, "uuid": "170e6e1d-31c2-48b6-8692-47caea07d703", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0e0b08-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773507332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507332, "uuid": "624a5da3-4156-446b-b44d-377813da1f00", "comment": "Malware payload", "value": "ae67890ab62862a00133e6186d99e50e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507332, "uuid": "8a875364-27d5-49c0-8d99-52784a3916de", "comment": "Malware payload", "value": "e181f6b60a72c23d3c6e7960ce51256a0f48775562dc57c5f85ecce82f321ef1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507332, "uuid": "f94fc037-1cfc-4fa3-8ddd-ce1cb11447e3", "comment": "Malware payload", "value": "1149a35e24a708fff899c56a2230135c2e36015b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507332, "uuid": "90fd5ed7-d427-468c-bfbd-d807d8da1f51", "comment": "Malware payload", "value": "d489b971240342a2ed8abe68b5d326627d52fa6b4648d5f82a621b07a1d2b08b053cccd7860f89bce1c8b4c43ddfa993", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507332, "uuid": "05e32d98-bd7e-4adf-b6f7-a77e95903814", "value": "T1626423D14FA2B46196A0827948FF28AC53620BE9D50C209D36BC77A3FF16F5E94C509F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507332, "uuid": "3dec9fb4-c958-491d-a137-b4bca92e3738", "value": "6144:jbpXFa9vz6E3tOsyUmtsLaM86uZd1p/4lyly13EMjAfbwbYAn6VZZnW3Q8Wa:NFuz6StItsu5jZdXQlylwefbwbcVbn89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507332, "uuid": "bf6f0e42-a47b-45ac-9d24-7d25ca20610d", "value": 321107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507332, "uuid": "6169ea14-3341-475a-9517-ac7e44076c91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507332, "uuid": "31b02b78-53c9-4bc8-941c-1f9340b3693b", "value": "e181f6b60a72c23d3c6e7960ce51256a0f48775562dc57c5f85ecce82f321ef1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa254403-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507488, "uuid": "8172a001-3591-4857-be64-220aa0fc3827", "comment": "Malware payload (ACRStealer)", "value": "9a5934db9507b7b8c4c376173dbd0d8f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507488, "uuid": "bf162c32-5da7-4f1e-bdee-8259f80811ec", "comment": "Malware payload (ACRStealer)", "value": "e182459038a4e201ff0ba71268658db650d96a41007dc09958b69d1fdd704d0d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507488, "uuid": "db8f9e16-1610-4da6-8e13-4549c997d9c9", "comment": "Malware payload (ACRStealer)", "value": "27f68f33d6c7f8ebc629f271bd328fbeb31c3c3b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507488, "uuid": "a68a8eaf-9c9d-4a72-bbc7-2fc72ac1744a", "comment": "Malware payload (ACRStealer)", "value": "03e524477ca219f3e6ea12e9d53a3ed7b319bca4c2a0b84ac640d5c9c0db222e1bcdd49c1e836ef02c8e6e2992c606eb", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507488, "uuid": "85202bfa-fc42-43ff-b649-444b9a8c8a09", "value": "T140B54BDA59CF03F5F703B938026A621FB335A1444F20CAD7A6709EAF9763BD41139662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507488, "uuid": "1c64d615-5314-45d4-bc97-d26d40ea055a", "value": "9169f287a06b0b2e7fa589091ee43342", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507488, "uuid": "b0e14199-1f64-4240-8468-0fa6ddcd8c83", "value": "49152:1Qtys4PTTioFzPFjgYkKv8TYh/tFh0+S9hRH:10t6Tvph0+S9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507488, "uuid": "9c60467d-b24c-4b51-bf15-26c7d8bc9562", "value": 2327040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507488, "uuid": "44ce357a-87b9-4f5b-ab45-faa0fc6a3da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507488, "uuid": "dd58a89a-1a60-4013-9420-ff54a4eea63e", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e815c76e-1fbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503592, "uuid": "c49d9592-c322-4942-bd84-3fcc2e8e2d17", "comment": "Malware payload", "value": "21e6e420c80bf1666c2acf59c7a2a42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503592, "uuid": "3d78d5a2-48a5-4c63-ad6e-355df82e9684", "comment": "Malware payload", "value": "e19390739992db79b2e2e56d4b7ec836ffcbfc99f7b527c6819b6c3f2afb963f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503592, "uuid": "d43c4466-6500-4998-9074-02cf5f30549e", "comment": "Malware payload", "value": "43bb2f3956241d29f68798f90eb4d7ad5f0e6dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503592, "uuid": "4ae316da-16da-4eaf-a169-f770d9e46e86", "comment": "Malware payload", "value": "71fa578c020fcf942a918948fd6c47c698c39d3e4776d38371f42b2fdc912544277c844e547ce9660d32ca808d88145b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503592, "uuid": "b566fdb0-5cfb-401c-9b6c-a7821c5ecf3b", "value": "T16E65020427A7EC03C1B64BB089F1D27052F44E49D922D2079FFA7DE77A26B8929C5397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503592, "uuid": "3041a4fe-4ffd-4afe-8416-2cf6e6c127ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503592, "uuid": "7f362dd9-b556-4201-b9dd-ffc9c65e8523", "value": "24576:B7BcxW1UciapvMfv4iHut7HQAnDsBbvVbxHQ/fyjDHOQCEsNu0eySZFywZlaoSzC:B7BcImcDvwy7HQAnAbvDHQ/fy/HOQCEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503592, "uuid": "af3a10d9-3ca5-44d0-ad25-4e5af497398d", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503592, "uuid": "09ca0c50-dd9c-464e-9038-b42d29275b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503592, "uuid": "58f5bd6f-b266-46dd-bb6b-1868239edbc2", "value": "21e6e420c80bf1666c2acf59c7a2a42a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba99c4a-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515732, "uuid": "abbd3cd2-84da-4cfd-8bcd-7989fbeec88d", "comment": "Malware payload", "value": "e073e56c401dcafc238c3064df1e243c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515732, "uuid": "b03ed50f-630b-422b-bb46-eb7e3658c6c6", "comment": "Malware payload", "value": "e1e1f9859b0ec38187cffe24306d006611bc66bff518592f14c1ab4c9854f0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515732, "uuid": "c14bb4c5-a5d7-4920-ae7b-535d584b6a6a", "comment": "Malware payload", "value": "af1264c17d509c6aedb727561622871e466782fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515732, "uuid": "9dfc8b2c-692b-4bd5-910a-03e68c8d167b", "comment": "Malware payload", "value": "a04741d1b9444a0c519c05737cd90cdc2ecf8a31627fd3d992fa9c178e3dc59b423f04f453fe2dfd134d2e6951b22e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515732, "uuid": "f2521653-beb2-4c78-85b6-633e6ebb90ea", "value": "T1931733B13618CCB7C2794DF2CC642952CA366B17CE6C95F82E2704805DEE7B6A0D2B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515732, "uuid": "961a0e64-9ad9-4d8c-9eb1-4f6bbb8cd6f5", "value": "393216:Z6KMS04WDN7vUEM/h7FPGVdMNVDR1M8KOkCL:Z6KMS04WpTU3JR2waUkCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515732, "uuid": "aba32752-a4f1-403a-ba58-d80bd65406e8", "value": 18480160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515732, "uuid": "8829a2a0-552c-4f88-9089-2020fa07ef74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515732, "uuid": "7075e9b8-071b-44ab-b390-02c25ebbdb1a", "value": "DEKKINGSTORE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087f049d-1f81-11f1-a769-42010a9c0008", "comment": "Malware payload (BillGates)", "timestamp": 1773477447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477447, "uuid": "53d2eb95-2afe-4c80-8a8a-0c214bc3eaa3", "comment": "Malware payload (BillGates)", "value": "17b5f870a6d4d48a8eb375b3345f0ef1", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477447, "uuid": "e114362e-dc92-4a6f-8953-c15d4f820dda", "comment": "Malware payload (BillGates)", "value": "e22c02215fe8dff35ab424e915a72af26ac0013ff5dae11af08bc7e9e23a440a", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477447, "uuid": "fc8b54ad-c909-4926-9579-4a204380e9fc", "comment": "Malware payload (BillGates)", "value": "b3e36e9947f1b23c92e2c13cef6f62e5b038f429", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477447, "uuid": "2976c9cd-a65f-4a1f-9028-571a62b1674c", "comment": "Malware payload (BillGates)", "value": "3bce42ccc5ca75ab877bbb5cc924669db0a7d18ec1e75b3e9ab2543d480eda21e080e9cae96f8030c237fcbe860439cc", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477447, "uuid": "c7340bd5-6133-4b01-8180-e5cb88a0e9db", "value": "T17FE55C11FEC68CF2E4031A7104AF967F53329D169F26DB8BD644BE28FB365C11926329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477447, "uuid": "fe36e38b-b697-4f88-b6a7-c10c7967cd96", "value": "49152:WScj/7P9XJm45vRVJKGtSA0VWeonu9pwDev:W/j/7lXJRVJK0SzVW1u9p7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477447, "uuid": "f3484063-efde-4ef5-adbb-bdc9fc99c01d", "value": 3023010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477447, "uuid": "6c209c96-de93-4397-ae3d-584d79f2d14d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477447, "uuid": "6e4be893-2aac-40cc-a53b-03f6e61c24b0", "value": "kal32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6fc597-1fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773504591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504591, "uuid": "10b46c37-65f6-43af-8fa9-87f4d27abe61", "comment": "Malware payload (RustyStealer)", "value": "8c572373e03d677c031574315766b7bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504591, "uuid": "621e325b-ceaa-40b7-b804-add668419503", "comment": "Malware payload (RustyStealer)", "value": "e29137b9d2970f5f3cf06c053b6e4878f2af44f8192a17c538f6a891bff5b10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504591, "uuid": "907451ef-2a27-486c-8a5f-f25eb16fe8da", "comment": "Malware payload (RustyStealer)", "value": "5b74b7b217d8ba72d0d9289ce06e5d06d6b267fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504591, "uuid": "930c64c2-3283-4b98-97f8-eb2c49cd6dbb", "comment": "Malware payload (RustyStealer)", "value": "036a6eb6ef8a1cbbe59294f3e1f4317ab5aa92f098407d432da88b210dd151cf6cd49f1e74ecb83c48a571ee970f0e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504591, "uuid": "32e2f911-ae2b-42bd-81af-3189593d9a71", "value": "T129063342F9D08DB9D4AB11F41868C3AC862DF4014B34ACFFA3E44D7ADE7D6D106B4996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504591, "uuid": "0cbc70e9-959a-4eb2-a634-a9db1b2d7592", "value": "ac91ad569465ba70fbdeb7f528ee1f6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504591, "uuid": "a41695d0-1650-4fe2-b71c-eb18c232271e", "value": "98304:M0/3fLBVteqCaj4IN+ZXRJj47378dXpQqD:McDkfa2XtdXxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504591, "uuid": "a16ff870-4f59-4472-9455-a08079908018", "value": 3842328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504591, "uuid": "1f04277e-78ee-432c-9f9e-76a71e46bb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504591, "uuid": "c369195f-5a83-45bf-9dd8-1ff4f527d33c", "value": "winwsdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a5fbba-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773516069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516069, "uuid": "4915c0b7-2efd-4303-b675-1b6b862f00d1", "comment": "Malware payload", "value": "7c3ac887433d2424ae46ebebbd70b52e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516069, "uuid": "5f93c1ce-780f-40b0-af3a-be5651c7af4e", "comment": "Malware payload", "value": "e2d2a26776466619bda41eadb5728cc12097c0c9839e60a2152254b895fdedf2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516069, "uuid": "118bf87c-b018-475e-98cf-e37345e9ad62", "comment": "Malware payload", "value": "9b009d6921ab003e99b00e9cc7f5df536f801ab3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516069, "uuid": "43ee91cb-4eb5-4756-947c-3d36dc90bd30", "comment": "Malware payload", "value": "b929ce2ee8eafc70b700ea317cabf00d1a3cbebeb86028349afa779aec3daf50f12eb72acb9868face9264f0b2b11e81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516069, "uuid": "f1a26b89-8711-448c-93aa-23c2e7260304", "value": "T16235150916C88DD338E547BB29957CDC9F3999CF532273B9DA0240C6FC1160A3BAE769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516069, "uuid": "09cd8a46-9be0-4e9b-96b1-ed7de7d2cd3b", "value": "96:DRTUx5zvi9xWLmeJhSF2hzvMoOCB8fygMD0AQmY/SB7cOslRt7mUPVTGsyVT63jf:Dy68Raxa3bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516069, "uuid": "45246874-2566-41b8-99a5-57fbcb721be1", "value": 1149862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516069, "uuid": "5878babd-62f8-4e9f-89f1-a613a7db31fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516069, "uuid": "f2739bd8-83d6-4f9b-b887-4cfe843cd54a", "value": "7c3ac887433d2424ae46ebebbd70b52e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604b7229-1f51-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773456979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456979, "uuid": "e25f0104-bf34-45da-befe-85a0c66c4835", "comment": "Malware payload (Mirai)", "value": "5bf5586123e76da7822bbf70d4bb9889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456979, "uuid": "84a9d653-2185-4035-afa4-3bae810c5162", "comment": "Malware payload (Mirai)", "value": "e33d9882edde6a44eb51e7baecb1f763461403f62ece06bf39fadc650f63bcd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456979, "uuid": "0bde9561-11f2-44af-9a8a-3f106a89adf0", "comment": "Malware payload (Mirai)", "value": "d9af02b395ad52620dadbe4a12928f030146e6db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456979, "uuid": "cc53f55d-5660-4aba-91c7-b737b92ade11", "comment": "Malware payload (Mirai)", "value": "9a61dac23b9ae6b8043b53734cf335460169dc6965144c463c849f498270cdc012af3535dc8248510fff5e312a4b95f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456979, "uuid": "44dc655e-1631-4e0e-8122-dac2fc39ea8b", "value": "T1E9F3F845F8419F12C6C6127BFF5E828D3B2627A8D2EE3203B9255F6C378755B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456979, "uuid": "48759f91-33df-4488-a3d1-9582a8b89fe0", "value": "3072:5O3GKNxbLddB604SzP1LwoZkElhCjCR8EF:5OtxbL3E04SD1LwDuhsClF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773456979, "uuid": "805289bf-99ee-43ef-bd6a-a28aca7e5271", "value": 158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773456979, "uuid": "9106a831-ddd9-47a0-9f4e-dc032663ef5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456979, "uuid": "e78e6a5d-38b0-423c-8168-680e3e9e0c2b", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27d08e7-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773515582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515582, "uuid": "9d5341af-f4d3-4ba2-b159-60aaa78533ba", "comment": "Malware payload (AgentTesla)", "value": "94d59af5554680888c29aef9f6d12ddf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515582, "uuid": "a20155d8-d2cc-43c9-b492-6c1908f8f5d7", "comment": "Malware payload (AgentTesla)", "value": "e342f64a53f09094060c6f7245f7b59d795623ea657ba03da6673189cf973908", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515582, "uuid": "bde72103-96fd-4a98-87f3-18df9fa91614", "comment": "Malware payload (AgentTesla)", "value": "7833334416c7588e25b452fe569379e387c7e33b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515582, "uuid": "7ef74530-7ce1-4dea-ba2b-6040d6cfb996", "comment": "Malware payload (AgentTesla)", "value": "b63518d2bcc11d24c694aeccec091d3cb297167e969b167574b930c460b2142d148ee7f37d815a12fc181572005e5600", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515582, "uuid": "98ff292a-8633-4b0c-ba84-2767f258b8c5", "value": "T1A053014558CC0B6BAFA9E90264FF3A43016197D6F6FBB34FE952749B93F850204E8478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515582, "uuid": "0baaa9ff-2e85-4b16-935d-0c161d44a1cf", "value": "1536:sZIS+NqyE4/8HY/bP/FMVh7VjPh67bSjrUV6PRxJNFMOGTIbvmRh2Wo7WDHqQsxW:sZIS+NqyE4/8HY/bP/FMVh7VjPh67bSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515582, "uuid": "0e0bdf2e-9730-427e-898a-67c4cf95532c", "value": 61798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515582, "uuid": "c1e502ed-2df9-4e99-97c6-355a87817402", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515582, "uuid": "e3d7fd00-0ff9-42f1-94d2-4a0ac10ec9c8", "value": "94d59af5554680888c29aef9f6d12ddf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765842fc-1fb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773501254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501254, "uuid": "1a5cb5f9-74e9-4939-a916-9c11777de282", "comment": "Malware payload", "value": "515d476d2026dfa5f525cb94d6f40636", "object_relation": "md5", "Tag": [ { "name": "https://tabbysbakescodes.ws/CNB/gate.php", "colour": "#131A4F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501254, "uuid": "e71ddc25-c9d6-4712-88d6-452745935c6b", "comment": "Malware payload", "value": "e44250c76f444640ca1e8360ee8fb9e80dec183555b620a46d16e78f53557aba", "object_relation": "sha256", "Tag": [ { "name": "https://tabbysbakescodes.ws/CNB/gate.php", "colour": "#131A4F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501254, "uuid": "f6feb5bd-0ddc-4116-8d13-8fef0dd6c6fa", "comment": "Malware payload", "value": "4d483f718cbe30ed2671570846ebd28a6c84600f", "object_relation": "sha1", "Tag": [ { "name": "https://tabbysbakescodes.ws/CNB/gate.php", "colour": "#131A4F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773501254, "uuid": "27abec06-12f4-4a2d-a6cc-989000280d91", "comment": "Malware payload", "value": "118b6d5b1f9f568cc43555d435189beac6b7ce71f8d43cbc092980cf76f53529a2088735b1005137489cca814253226f", "object_relation": "sha3-384", "Tag": [ { "name": "https://tabbysbakescodes.ws/CNB/gate.php", "colour": "#131A4F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501254, "uuid": "cdec5419-1a40-4bec-a9e0-ae550ea5c449", "value": "T137F633556F93F0D1C50F8A7B1B820445D7B21E2DBA9E240B770D3B9523B96E7CF18AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501254, "uuid": "9eb79661-0bc7-4d81-9b01-76a585448415", "value": "196608:UQWbvGzcyUETU0oaM3oD2srGTtLkPY8EmU+/1BEDORwEriGNY11hGKLU9PLyTn2L:ajzCjMeWLAxU+vEDsiGNW1h2PLQhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773501254, "uuid": "562cf2a3-8ba7-428f-9fda-aa840285ec78", "value": 15273984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773501254, "uuid": "246be55d-475a-4d32-bbe8-a641c9bea72b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773501254, "uuid": "70a93f0f-d693-4713-8cae-1818626e8bab", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f035ab0f-1f84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773479125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479125, "uuid": "8ddeec72-6f23-4260-9844-5f138e607286", "comment": "Malware payload", "value": "2955b8b3a06bfb7ae3fe0547f34a1819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479125, "uuid": "c2555e5f-9df8-434d-80f7-e4e87e5905dd", "comment": "Malware payload", "value": "e465ead881650901d015ad08cfb1d5b08be61adfddfb5dc044c707472050316b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479125, "uuid": "d080c60f-de9c-403b-8c7b-7fd171672922", "comment": "Malware payload", "value": "6b3942c0f0eb744f96e9e29fd9d6ecae764e9cc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773479125, "uuid": "2c9879fa-a620-4284-b9a4-9b872456f546", "comment": "Malware payload", "value": "87b42a343b1c647a7295a3dc0baefe6fbcf1a84a277ca16ff9d3ce9d3785c8968ab40079b54b2e17238f0d83a0612d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479125, "uuid": "f71a8e66-586e-4e8c-be5e-2ac381f3e6fd", "value": "T1E0D2B70AEFB44EA7EC7FDC7309DA0B02359D520A15A87F2A6574DC28F26E18746D3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479125, "uuid": "57740c89-d50d-4988-8070-cf544a04af5c", "value": "768:ArUwgrsrsi/eHyeltkH5NZz0SQeXiMxeuzSedMw:Ar7grasi/eH7ltUTZzWGPzSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773479125, "uuid": "0a70e6e9-1503-49bf-843a-505d8c3ff66f", "value": 28856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773479125, "uuid": "ea1232a1-dc0b-4ebf-bdd4-722a04c31730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773479125, "uuid": "74f0642e-b73d-4e09-9636-a4900494d64b", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25b5d8f-1fb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773500898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500898, "uuid": "e8725149-8060-47f6-a504-a8a95f547f47", "comment": "Malware payload (Mirai)", "value": "8ff8a7406bb903306886fff4c7190224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500898, "uuid": "72a6cad7-7652-47ba-85b1-adcb15f8d381", "comment": "Malware payload (Mirai)", "value": "e477d3b2cfc601432d7c2ac053c915f7267567900e7ab0917a4ab46a17d470e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500898, "uuid": "582346cb-40c0-4e47-af16-238d1727cb71", "comment": "Malware payload (Mirai)", "value": "97c79814229fe4c3420ed77cadf0a663c79f9145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773500898, "uuid": "d3dccbe2-0ac0-428b-a8dd-44242eb4e7d0", "comment": "Malware payload (Mirai)", "value": "26c9a1e1bb248843c2a465fd87f5b7adf6a58c67cd98bbb1d98cc43fc109be068195ca6547d0caa94bf0d15c2f7658e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500898, "uuid": "1a9b6d4b-44fb-43f5-aab9-c24d14bb4bcd", "value": "T10534931F2E128F6EF769867047B78E20975C36D736E1C681E1ADDA105E602CD241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500898, "uuid": "a8c719fa-fc28-4987-bf5e-774f453b8ca0", "value": "6144:qRH6TT/ODcJW7+Gwq3i6AazU8Hn8XlrpfKTd:qRHW/6s87d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773500898, "uuid": "4e6255d4-90cf-4111-bd9f-1e5e321c6388", "value": 244096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773500898, "uuid": "8ea83ada-07e8-4a69-bc56-8561bb70c265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773500898, "uuid": "09e184ee-ec97-45e5-8225-921b6a5c562a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6db1356-1f3d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773448534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773448534, "uuid": "3f91dd77-af5d-4675-aef6-5a055c6da5e1", "comment": "Malware payload", "value": "3bc4be5020a6cfb26eaf8f61f011557c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773448534, "uuid": "4b08e03f-8f74-4ac9-9841-d3eb0af9f5f6", "comment": "Malware payload", "value": "e71cb65de592d4bb93dd3fd515185f4078c8cf845e8bd36cdd02520a7db728be", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773448534, "uuid": "f18c0561-243f-48d0-8a79-10b9e2e9a3fb", "comment": "Malware payload", "value": "11c6eea00095e8b926a083f9f8a1c02e43edc4f8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773448534, "uuid": "7c107819-db3f-4a06-a67c-0b2fb23e20df", "comment": "Malware payload", "value": "4cc5bee4e83907575e5020eaa7dfcaa77f475624935c844e9b1da104c2bd62a77c3f74887ae3b7999c58aad7edd34985", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773448534, "uuid": "6d78f17a-89f6-4618-956c-b515b1e3e15b", "value": "T188F6BC23F50529AADDC6A134F5E7179177301E440793A329261FF02AFDB25DECA27AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773448534, "uuid": "8eaf315d-a145-4b5f-a162-1ec20269e221", "value": "393216:Am9qbSWGe5U6V2v2lAazmUEmvgsP+aRtcOY6J:B9qWWR512ulu9cgmBR2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773448534, "uuid": "46944f19-59d0-4505-afa9-78e483cf425f", "value": 15716982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773448534, "uuid": "28dd349f-444b-42ea-bb9b-f81b73945f5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773448534, "uuid": "db1b8775-4b89-4edb-9adc-edf7d3e8b4da", "value": "Axis Credit Card.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bb1006-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773503775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503775, "uuid": "8b01857a-06ce-40c2-9485-3ed528809745", "comment": "Malware payload (CountLoader)", "value": "dc4192bd44c884bace9dd4e8d78ec81d", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503775, "uuid": "b0b11954-4174-452f-97a2-af84f89d64dc", "comment": "Malware payload (CountLoader)", "value": "e7886ec29eacf22845634e0d98aa3b5233bfab8c9f3fb0c8d8d767f3b4f77f41", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503775, "uuid": "19580774-fe7d-4c60-b929-00dfb8ff7dbc", "comment": "Malware payload (CountLoader)", "value": "45e66c3ee9aa6ec51b44f10c7460de5962270368", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503775, "uuid": "727b95c6-c565-40bc-aa09-3ca71a2cb18d", "comment": "Malware payload (CountLoader)", "value": "1b0222eda43c761f065886d1cdaf2b2ec475f64e94c6963a11993c5c1779ace9506ab0af5f16b24de7efc88c262246d8", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "geo-foundation-vg", "colour": "#7D8F74", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503775, "uuid": "eb722c21-ff02-47fc-bea6-5fe0d91a02e3", "value": "T1BDC1C62AA5CB1DE547C3E7D3F3E2D7ACAE2950CCC4123680B6ACF2045395E651394E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503775, "uuid": "0c13df83-a3db-4949-9216-620413183ce6", "value": "96:49xQwJZXtBEa7Ps/LZrcbcd/JeBwa9AFWD4gtyoQRIOSJuIGw4:mew/UMwp8kP5S46ODe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503775, "uuid": "8d6e5802-716b-482d-9bb4-aa38a517e7e2", "value": 5791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503775, "uuid": "56683121-9478-451e-9986-db63cc7f3f1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503775, "uuid": "9c3bae33-236c-4938-80cb-6a32ae2bd2cb", "value": "police.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f7dee1-1fdb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773516229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516229, "uuid": "7da67926-dcbe-46e2-b6df-9f470bd32762", "comment": "Malware payload (XWorm)", "value": "3e9d5dcf55dc14d2ed4ead550b4be94e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516229, "uuid": "cb88631b-1e89-43d6-ba95-46e51bee32af", "comment": "Malware payload (XWorm)", "value": "e806df0aa530bfebb8530895ae8b884df915c9e76a96cedf2d8d4ad1c3dc8b4e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516229, "uuid": "7796aeba-0ca8-479c-8c29-707266fbf3a9", "comment": "Malware payload (XWorm)", "value": "9bb7e2819ebf50464692b7044f7d0ed05309f06b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516229, "uuid": "3879354e-c070-4fe6-be1d-fe7f556bd853", "comment": "Malware payload (XWorm)", "value": "49b5e9842a640d2e75bf75cb54f332bf7fce026c22db55ce27365c9f7069723f7c907a94cfe367fa97778ad40428571a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516229, "uuid": "4ddf05d5-b97c-4fb3-9b3b-5a100b589e59", "value": "T14045121ABC1F82E90D8EC417F88A37569969310459325DBBF559CC7636FAEA3F2C2003", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516229, "uuid": "e98ce4dd-0cdf-426b-8f63-bb620558e119", "value": "96:VpBbhi/1KNBPCxp/Bo+Hwio19sZzkksmwjDG1z3:VpVrKz/BNHwijms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516229, "uuid": "044afc9f-8bbe-4f04-b950-0250300d1863", "value": 1252736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516229, "uuid": "272c0442-a135-46bf-ac58-1e47ae4a55e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516229, "uuid": "6f8f9c0a-cead-458d-92fb-36e1e747500e", "value": "3e9d5dcf55dc14d2ed4ead550b4be94e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f991c7-1fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773491479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491479, "uuid": "33599fc3-89d6-490d-99e3-6afb65606b72", "comment": "Malware payload (Mirai)", "value": "ee5acea9af46692de50c9a3451641966", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491479, "uuid": "dad79ef9-f7da-4ada-a09b-8f3ede7dd7bd", "comment": "Malware payload (Mirai)", "value": "e898ef632f760d3831aa2be318e24a283f167b80e29fc985cb0d8bdd235c7d6a", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491479, "uuid": "124a2a1d-cace-4f14-8393-60c69f799c16", "comment": "Malware payload (Mirai)", "value": "7e9deffba8aeb77742dd6e94abcb44c2d18cf82c", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773491479, "uuid": "b8c2adcd-9685-4353-838a-cbbe7d63408f", "comment": "Malware payload (Mirai)", "value": "0eb9b56d644709cd7a7bebb6812bb80ccaa598815e7d3427e8032f39bee6e13298643371c7efd1fa515cb804cfa53732", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491479, "uuid": "1c072539-82bd-4bc9-b21f-626335938096", "value": "T198E48D99FE4E3C42D2DBE33CDB4983E1632B75D0E32352627941521CD4D6AE9CBE1A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491479, "uuid": "e7ac8ce9-9c33-41cd-ac0a-3a32b4546761", "value": "12288:Va+UaYYtVwmjAufTDtWMyten+/rdcs5FVql93Rsv:M1RmvfTDktJjq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773491479, "uuid": "15be7a21-be76-4b6d-900f-e26804c08bf5", "value": 666048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773491479, "uuid": "a8e6ad57-55bd-4cf2-9c68-4aef33c6b9e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773491479, "uuid": "3882945f-011a-4b7e-980a-53e910bde47d", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739832a6-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495236, "uuid": "b17e6502-adb7-45ff-a44f-8f03717dd61e", "comment": "Malware payload (Mirai)", "value": "bbda4ded2d4c08c27a59e795a1767464", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495236, "uuid": "0ea2c833-ad09-40f5-b6a9-7812a39e3b8a", "comment": "Malware payload (Mirai)", "value": "ea4e6b0d1a6680081f8006ba3ec9562ae795510f1d82ec39e0ac3d1f5ddc18ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495236, "uuid": "1e45cdd2-6d26-42d1-8b11-4af9840ba6e3", "comment": "Malware payload (Mirai)", "value": "2da2ae84f52bf7c49ea96830420e7f20e896e5cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495236, "uuid": "dbf64e0b-04e8-476f-8777-4bb200aa7abb", "comment": "Malware payload (Mirai)", "value": "b23c9114a903c32699e5d7be5cb02d0cdf5d0486412a5edd2f62c0d759b06a747ca6a66ed4cdbd7bffa66945f1c89d3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495236, "uuid": "408535e4-908e-4081-8aed-483c5bb2aca9", "value": "T151365B98BC2D7462D9CC7AB82B2542D4B239FC899F81C7277514F7ADA9F23548F12270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495236, "uuid": "f29881e0-00ea-4bc6-805a-1928e8612e62", "value": "49152:HK2om/zZHX87T3tY6MMw6jvM1pAg5EoFa/72ZKSZF:H1omrZX6T3tLMMw6jvM1TE7uZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495236, "uuid": "faa91cd5-7aa9-4e58-9b3c-eec55061de15", "value": 5111960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495236, "uuid": "8686be96-19ce-46f5-93dd-27ad8e1c25e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495236, "uuid": "8cc7b4ab-c130-4490-af3f-ca819739d78f", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297d7bbe-1f96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773486522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486522, "uuid": "aba05edc-c8c6-480c-a7ca-46ffe6f057cc", "comment": "Malware payload", "value": "dec7b9e10289d88516a667342afacabb", "object_relation": "md5", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486522, "uuid": "5912c873-3f94-4931-aadf-e71b219a43e9", "comment": "Malware payload", "value": "ea5703802c1b7016bda1dd3ece341f24bc044f635c5fad50ca8109636e8ff629", "object_relation": "sha256", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486522, "uuid": "c29fb0df-608d-4416-acc8-48c3cf9a7a28", "comment": "Malware payload", "value": "ec6746a65fd101b38dc66079199a7142a7f874d9", "object_relation": "sha1", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773486522, "uuid": "7e189ee8-cc42-47a9-adc6-430042c254c0", "comment": "Malware payload", "value": "294fa65a99362906467b4ba521f19fe5e0327a5b0a9bb82209e79c03c0017347838c21f348a34c9d2c1c515215d2449c", "object_relation": "sha3-384", "Tag": [ { "name": "iqehqqh--outlook-com", "colour": "#70A31E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486522, "uuid": "d4e1ff48-e29f-4926-ba3e-a72cb90201a1", "value": "T16DF05C395B3AF4C4430AB06055049D9921902516D7BD6E6FF92219AA6920294DF0F14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486522, "uuid": "f0e555e6-5d30-4b5b-aefb-514e067eaa34", "value": "6:s8bloOVsukO6hsVYnAGCu17w0kTZz0g6eMiNQhkac/VZgkznKqr/q16Atap4:s8hZGrO6hsVKp1pRguua+ZgkzKq+P8p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773486522, "uuid": "6b386102-17d0-4116-b07b-145505e967c6", "value": 441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773486522, "uuid": "84736104-8683-4a11-b80a-33a5c0affda2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773486522, "uuid": "0c4c3aab-d54c-4e8a-ab81-0dd100b9b9a5", "value": "7ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c6a07-1fbc-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773502900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502900, "uuid": "e201d895-54ca-4867-91f1-61198b0db54a", "comment": "Malware payload (CountLoader)", "value": "21a5240da348228ecf43d7009817dced", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502900, "uuid": "44ce0a38-bff7-4ffd-88e0-45784884a707", "comment": "Malware payload (CountLoader)", "value": "ea750174cdd4ee7ea3ef6d7699b06f59647589201b5ac136aa98782eb5327d6a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502900, "uuid": "85b5bbfe-44f8-49b6-add1-bf967bce0ab5", "comment": "Malware payload (CountLoader)", "value": "c126f4deff6e3c166ea8967b96d223a6e45a31f6", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502900, "uuid": "b971c2a1-5482-4af1-8c4a-84bf2498f05d", "comment": "Malware payload (CountLoader)", "value": "522731c3a8bb6658317eab24457f698ebc5a19ea51a53a9f81fed32e5e95376b591cfaa30d362fb45bc98ba7b5ff8b31", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502900, "uuid": "4ac4ce02-30ff-4d0f-8a29-5152ba9f2af7", "value": "T108C3F08E481F44B00C4B2C62666B764ADF7453D74F4DE0C836ACD2AC7F2235AA1D76E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502900, "uuid": "98c18f97-dfd7-4bc4-b784-c9012911b441", "value": "1536:OP+pSWJ1GzZtWw81hhjCa2MkYh/y4yxofXGsQB1U/IQ/zNkv83Mt6bioe5b5LQVy:phmPWe5VLQOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502900, "uuid": "c84c045a-00a3-469e-8e54-c8e8ff766813", "value": 124678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502900, "uuid": "d6cf7742-b1be-46e6-8e75-6e377b2095e6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502900, "uuid": "196a5417-8fcc-4b0d-b65e-235549a168a7", "value": "Archive_Primary_v6.8.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d2d42d-1fc6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773507259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507259, "uuid": "a4439785-c2b6-4b26-b67d-871ecc32c217", "comment": "Malware payload (ACRStealer)", "value": "1f74614cd8e490529a4463586f0f245e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507259, "uuid": "85581c2f-eda6-49d6-9914-6c5c5c958116", "comment": "Malware payload (ACRStealer)", "value": "ea8133fbebc796c13a34cd3b772c76f18096f86a17a5d794345e27e765e95a65", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507259, "uuid": "088ed5f8-cd82-401d-8a56-3819a7a8cb6a", "comment": "Malware payload (ACRStealer)", "value": "28cf73a349b6c9afc05aa7385a20469f6189e968", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773507259, "uuid": "74e5e237-33be-4708-b16b-7c05f6e5e4b5", "comment": "Malware payload (ACRStealer)", "value": "6575d4fe33c28a795bb99f8ac57e37771eeef369169d52f9c1553d75a5decdaf9287f8f592fc46658ac459e0617202d5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507259, "uuid": "6317ee02-542c-4863-b26c-e3a187501f0d", "value": "T138A50695414303FEFB0FCA33822A821FA75452084B74CBD793A16F9B9E62BD74739A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507259, "uuid": "2f0b7249-784c-4907-a65f-dc7d634f3592", "value": "cd4c2edd86ac60baaa9efb914357193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507259, "uuid": "74954efa-4dc8-40fc-9cab-454d5f3e1005", "value": "24576:h+4T4JlCpZk7GB8e/UK8pMZ/h3w+teHNPM1kjSGAIsCoyhKtryEiiT3ztC:5bpbkjdsCoyey4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773507259, "uuid": "76cf53e0-d01f-47e4-b56f-019635b51915", "value": 2065408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773507259, "uuid": "466e4f18-864d-4ae6-a95b-5fa8870e4172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773507259, "uuid": "1269a4fa-84b3-43c1-b09d-05b8588b6ca7", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fec4e7b-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495257, "uuid": "ecb9c38a-3db5-41f4-9fae-7189e081be57", "comment": "Malware payload (Mirai)", "value": "9fc6d592d8615ac2eba990ffe46bb47c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495257, "uuid": "4d77cec6-e4ae-4f21-953d-f2cc13ce725a", "comment": "Malware payload (Mirai)", "value": "eaa48498cd2bb316c2b81b2f7685d083f4438514152b1f615eeb8930a56ea577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495257, "uuid": "10f68c59-c638-43d4-9937-baad861a3e55", "comment": "Malware payload (Mirai)", "value": "4bb509c657c66b6886b5df3ef02c223f5396b6e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495257, "uuid": "61a588dd-0fd8-4f83-8f84-9b14d1961fe9", "comment": "Malware payload (Mirai)", "value": "5b2bc88840aecad6a21462ba605bcf2e47cd2e354b9911faad7599edffe4384191aba4a247756c7683f006b056c41a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495257, "uuid": "adcddac9-cad3-4f68-8834-2f0b783053c2", "value": "T127362997B8924A43C4E43637BCBD81C433A34EB99B9752666D04FE3C3ABE5990E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495257, "uuid": "b4e3a2f6-aa73-4cbf-9891-78e6fb095c9e", "value": "24576:PHC3q2ku4YMrg2CaKPmWTTyzU/+bYMOcw4ktsbL7jZZsWOdHu8ndSExZsayU1ShK:WshBzNHBImoqXKWASL4oeUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495257, "uuid": "686264b8-215c-43fa-b91b-0ba0c9e1717b", "value": 5177496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495257, "uuid": "39defed8-31f4-4062-93fd-7c61532aa1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495257, "uuid": "94f85c97-9a8d-47ab-9e54-86da1f384ed5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0c28de-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494395, "uuid": "2f989c7f-87ae-4f3a-b79d-7933bbe83663", "comment": "Malware payload (Mirai)", "value": "d934a52afccbeb4a2dae8afb640f64ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494395, "uuid": "44079ec2-8f16-4f6c-9e07-d0edf1d3e3dc", "comment": "Malware payload (Mirai)", "value": "eacaf55693e5881f511fe0985762937cf0d9f54671fd40a6ebea235a99bc1e32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494395, "uuid": "f8e91b10-cb2c-4951-a089-ed116f8ff4b0", "comment": "Malware payload (Mirai)", "value": "e26e785d8de042235299b138c2b41f1a59cfa0a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494395, "uuid": "71151204-9444-4bc9-bb27-6807c50a695a", "comment": "Malware payload (Mirai)", "value": "94071375dc27a4a95fd831d618228152371abd8c940df08ae4ff5d77f1797ccad1c93676d20016998291548ecf143753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494395, "uuid": "5fc5958a-bb15-45e3-a89a-10058f710f53", "value": "T1A7733985F987C6F2D407483042ABFB3FCB32D8A511B19B4DDF569F35DA33502AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494395, "uuid": "9800472e-edd6-4f8e-8670-8c5858bd0e36", "value": "1536:8A9Uqtm/qzBpeKm2XpQmj7qWSICRzBbkivom3aJ2odLNn:8A9U7KBcKm2Xp3jnrCRzBbVvfodLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494395, "uuid": "068fc865-dc44-4635-bede-e90d43b40c4d", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494395, "uuid": "9e3f0d12-1c25-4503-bf3c-cbe29aacfc58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494395, "uuid": "56947689-ae20-4ed2-ab0b-629e448fc374", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fd1214-1f43-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773451026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451026, "uuid": "6da5befb-e528-4745-a3e5-59be74d87839", "comment": "Malware payload (Mirai)", "value": "8a57e4b1b5823eb69ecbd1f2291c841c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451026, "uuid": "abb432bf-cd0c-4ef2-8558-a550cb31f1f9", "comment": "Malware payload (Mirai)", "value": "eaef59e21e4e6a5f100b887d56b85e3bc34c2925266b57618da55f374f811b69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451026, "uuid": "95546066-b168-4b9e-b2e0-cc8587c857a6", "comment": "Malware payload (Mirai)", "value": "57f556ae31e3b70202972f002a6acd13baeaefff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451026, "uuid": "b3a3f36e-0531-43b2-a75e-e8a1912c2d3a", "comment": "Malware payload (Mirai)", "value": "d2551287b7c59d01954e20f3c7b5a6dc0b5bf60139bbd72df52303fb6a720aeaa12ec371c1e804fd7c1b74924392a2db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451026, "uuid": "e6dbf5d3-81bf-4c70-93ef-68c512ea35bf", "value": "T122736DC5E6C3E8F5DC1649352177EB335A76E43E2029EF82D7A8A932AD42601E50739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451026, "uuid": "539f60fa-dc79-41cc-b770-4aa077f0bcc7", "value": "1536:498Rr7ImHW42hTGUnBImXAPzeTrGe/Zb2vrTHkRGeUgzEq4S07Sg3:4Gi8W42ha2emXAPze2e/Zb2jzkMeTYhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773451026, "uuid": "b4da31a6-dc9f-4723-83e3-3336828b6206", "value": 78736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773451026, "uuid": "4daf3a32-824a-4c80-9df4-be67347a9ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451026, "uuid": "90bf31c3-8f32-44ce-b179-91ab57a13f7d", "value": "SecuriteInfo.com.Linux.Mirai.9774.13746.14987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c1cd6b-1fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1773506727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506727, "uuid": "11de94f8-c7ef-434c-aa35-16303c4cad57", "comment": "Malware payload (WallStealer)", "value": "3cf11d58a6788eb72d8ffd3f7187cf77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506727, "uuid": "ad6f2404-d096-497c-b09b-bcb006d7eefb", "comment": "Malware payload (WallStealer)", "value": "ec753927343b794fa469c748af062ebf8cbe7418a8a734990a4e2d378416fcd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506727, "uuid": "80efcc03-fef1-4b53-bd72-375ae1be7755", "comment": "Malware payload (WallStealer)", "value": "f9d587b137e99eb3ed5883b7798d63fe39544787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773506727, "uuid": "8c172af5-788a-463b-972d-da712d7aed3e", "comment": "Malware payload (WallStealer)", "value": "463668582c7695e0e6b699a3a612f243104177043d7020a5ff092c3afc475182094cae4eb95de13fecc2be239cf256ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506727, "uuid": "8244520e-8818-4a98-9469-c3ee09eb6537", "value": "T17CD47B0DA7A581F9D1B7D0B4CD038517EB72FC564732669B43E04A862F2BAA49F3DB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506727, "uuid": "d555bde5-e1a5-40d8-a950-7486a8b0e0a9", "value": "a330d858063c312aaac6d9eaeb29a36b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506727, "uuid": "1a94d332-3cad-404b-bec4-e5fe14582b0e", "value": "6144:6/FAnFeGb74gQ/Dmeqxt8UDRiiVxdB8+CbTrK9ZgnRs1VzYXWjPCAWzfO6rn:WA0sJQ/Zqb8RaxXaYQRkVk3THrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773506727, "uuid": "d91c6a88-c808-40fd-bb15-bff634ee56bc", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773506727, "uuid": "56238966-ff1f-4e61-8e48-9b4e9f4cbf25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773506727, "uuid": "a94ddd48-115f-4bf3-938a-7816dc741f09", "value": "3cf11d58a6788eb72d8ffd3f7187cf77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d80a16d-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503762, "uuid": "ec27cbf3-ee97-445a-8d8f-148467b29101", "comment": "Malware payload", "value": "552d8ad265fdc49916d7ca4528f5800c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503762, "uuid": "b5fc31d3-9e46-4f77-a4cd-24cfa68343c9", "comment": "Malware payload", "value": "ed1df47c2a893f2fa18dda2226cc65c024969217efc6739fa6a05fcd80124e44", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503762, "uuid": "ef2b24d8-1059-4f6b-8a58-44a2cb57d4b0", "comment": "Malware payload", "value": "91fe93b3ac9f96c402d9464b0ba8985540a359fd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503762, "uuid": "a4421d32-5906-4332-8bb4-f2248d8c8b19", "comment": "Malware payload", "value": "71e2524630a3b413648fbb811956aba3420e264facd9548b833a7822d24fd3d9d531b85562c54714d2517bc998346a44", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "iclickfix", "colour": "#F73422", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503762, "uuid": "7c169e1d-15cd-40f7-a69b-87b5f437d678", "value": "T12A41AC587FC51A0C23AB25DB373363D4F6158D5B77A680C5E435C88CBA10D29D3A363A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503762, "uuid": "819abdc6-6bd7-47c8-bfbb-59e2842f3af5", "value": "48:VD+t2bcJNT8PlUwpBbIgORpL7NnX0rVtM9x094eoTc2W:V6JN8PVpBb6nGVWx0uLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503762, "uuid": "54af4bba-0631-4ba1-9a91-bcdc705b1be3", "value": 2310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503762, "uuid": "0c4b2592-1f37-42ed-8eba-0756fa7edbd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503762, "uuid": "e401e13c-91a4-4eef-9e2e-e95b353a7a0c", "value": "firmkoacocos_iclickfix.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023a7ca1-1fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773504495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504495, "uuid": "80261df1-6044-44bf-af62-41e5f244ad59", "comment": "Malware payload (Vidar)", "value": "73c6cc9eded14e7949f47f963f102f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504495, "uuid": "e841bdd5-b90e-411f-a4cd-3926457bd4c6", "comment": "Malware payload (Vidar)", "value": "f148837e193bf014b790cc500a0848eac1501a7d571ed5cb0cf0cc2979fcc074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504495, "uuid": "780a516c-35b4-490b-93c1-6c932e193ec3", "comment": "Malware payload (Vidar)", "value": "e870229eb9629cb544d1b62bb617f383a91b0b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773504495, "uuid": "e69793f9-a7d8-47f3-88db-bbc7619c9b97", "comment": "Malware payload (Vidar)", "value": "24ecee1c84bf5b40325bef1736fab1f6185b543a17f05d9e82cee530e975e1e9c31784dc621542e6fdabae29fcdac5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504495, "uuid": "06b6ef48-9f2e-48f9-a9c8-f436f39cef5d", "value": "T1C6A58D5BBCD144BAC46A933289B692A2BB34FC091B3223D72F516BB82F767D04D35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504495, "uuid": "afb6ffda-c781-4b95-8d3d-b21d6c80b793", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504495, "uuid": "3235d44b-d123-4eb4-9a5a-b18421989a7c", "value": "24576:PcMbrnJ+MUdiiekw3ABVdmzMW2SEEgVIukxqk6/+bn+nGpVOGiWfKLwYjurGb:PcM/nJCEIhvEfuxi95/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773504495, "uuid": "46438852-1f64-4c33-84b9-56c0146af500", "value": 2221056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773504495, "uuid": "24452f37-b512-4f32-995f-d128842860ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773504495, "uuid": "d18b2da8-2cd9-422e-bbb6-385151dea458", "value": "V\u0435b\u043e\u043et v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9294be48-1fc8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773508173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508173, "uuid": "0b3c654e-6a3c-43de-969a-733256caeaf3", "comment": "Malware payload", "value": "28d468d05486cfb408a94aa6f845b376", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508173, "uuid": "de844ce5-a376-42dc-85c9-e81ee790a33d", "comment": "Malware payload", "value": "f1d81bbc99d7276d8116eb976013c0ba6dbaf1fbe21d5e80fbe6979f649b951f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508173, "uuid": "6bcf89ff-25ed-4d28-b093-17520d48be20", "comment": "Malware payload", "value": "afdd24e47715e2a4ffbd86aa9f9dc71156724524", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773508173, "uuid": "9e82702e-9330-4450-ae97-8ee04403a1d3", "comment": "Malware payload", "value": "b2a3c0d4f78227b8943f1b5c93e5239a91df25608ec57527ee7fc7a17610edccedb0b5cb5eb74d5a3131a08715ff8195", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508173, "uuid": "d5869c55-d392-4142-9c8b-3ce213c0cf9f", "value": "T10A6423220EA07F944CAEC9BA2D851BD907546BE76C19C0367F3C7BD5A749BCB064F428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508173, "uuid": "4b763252-6025-4f9c-90bc-e6f7898f330f", "value": "6144:tou2WY/+eEmXL/y4wQBBveGaFTxcOa1jO+dIytOw85KqxRX:V5YmeEEyKBBmGa/a1jxCytOw80yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773508173, "uuid": "5225ba8c-7666-450b-bab1-13e444132366", "value": 321153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773508173, "uuid": "44d9b017-9a44-42ba-8808-47295e40a181", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773508173, "uuid": "ad785877-9fe3-47a6-9322-603c3ed1bfc4", "value": "f1d81bbc99d7276d8116eb976013c0ba6dbaf1fbe21d5e80fbe6979f649b951f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35fac49-1f70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773470406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470406, "uuid": "0cd9d8d0-f34f-4cc3-9476-64a823098052", "comment": "Malware payload", "value": "ab41b0adcfee2182cb07474042e1ca11", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470406, "uuid": "6cccd44d-8030-4123-b248-bbee91cbb446", "comment": "Malware payload", "value": "f21531ccd8db7e90093bec914bf74f7c6f4a6f97922b70754f8a222dd8495ca4", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470406, "uuid": "061cd72c-2ed3-4318-b4a6-8e30ff4e2be4", "comment": "Malware payload", "value": "e4408378ae7933514a4f67c052fa505b7b7d358d", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773470406, "uuid": "3391449c-501f-4eda-bdb2-7bca81742130", "comment": "Malware payload", "value": "ca862969d026644aa6f26a1bcb92766afbff002931c1502522eed49977653c426b6b184c32a61930dfb9a1a142af1b01", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470406, "uuid": "6f4c83f3-ea6a-46f2-a7b8-7db44a61a99d", "value": "T19B67AD1993E505B2D42BC638CA95C333CEB1BD938636850F385DE6821F779528F6FA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470406, "uuid": "7faa6a87-ccb1-466d-b44e-85832d75fc3b", "value": "29adfac45afd49d83cd3fa81acdd8a7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470406, "uuid": "277dc004-527b-4cce-8f45-a13ec63f623c", "value": "393216:Lfmmq98h+3uGjwmulDeip68WzAj0t+hTjd/5bJYz/S8mf1g//4GzOr6:H+3/qN6EZ/C7SO//T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773470406, "uuid": "7734a2aa-6898-4f89-b3c7-ec86e5090d59", "value": 31359488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773470406, "uuid": "10ced528-fcc0-4692-a917-6aa1136a2eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773470406, "uuid": "cfc08a44-5c26-4dac-ad63-a65c73179ce4", "value": "f21531ccd8db7e90093bec914bf74f7c6f4a6f97922b70754f8a222dd8495ca4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de259b0-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515494, "uuid": "6ba27984-8a92-4a54-9889-464aaba7b83e", "comment": "Malware payload", "value": "a4298180c66e373cbd919d2c1d51615e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515494, "uuid": "6bffc4e9-f992-4150-a81e-bd2277420a3f", "comment": "Malware payload", "value": "f21ddb16b09b33214889cd3ebe718ecd108500d6c7d25a4b954f0a6bd3b1358a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515494, "uuid": "b2715f70-785e-428b-ab1d-48622583ec4d", "comment": "Malware payload", "value": "5c1d2c559c01172e4d707aa75c0c08a092c77fab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515494, "uuid": "553163e3-57f1-4472-9f07-eed4256e50bd", "comment": "Malware payload", "value": "4722eb8ea95a9cefe28df2d4d369f29760b87ce74deef2fbb2aecead75315b6b15b304daef9f7a386908e4f7095deca2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515494, "uuid": "f7437e39-14b3-4152-9dc4-2ac815c612a7", "value": "T16995CF9EF9E04965CE0D44A7ABFCB43A1254160B0C3099936F3DBC1EBBA722CD58B55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515494, "uuid": "1d772ec5-c7ef-49ae-940d-6bcf6453ab94", "value": "49152:zJSjhcB9RlguuuuFp9buMAuPeJHUQ/cEMQ0yZuOwH:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515494, "uuid": "7dd769d9-fc3c-44d5-8ce4-0f04e13b8522", "value": 1993723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515494, "uuid": "3b4eb1a0-2ece-473f-861c-fcd6e93c5881", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515494, "uuid": "2124c0cb-eb26-41ce-83d2-145ddc09cf00", "value": "a4298180c66e373cbd919d2c1d51615e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ac4637-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773515722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515722, "uuid": "7745be4b-3396-4d87-a92a-fd3987dfcb75", "comment": "Malware payload (PhantomStealer)", "value": "af165ce6daf1dcba6b7d52be9c77200c", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515722, "uuid": "953c56d2-356f-4aa6-b160-7688291916bc", "comment": "Malware payload (PhantomStealer)", "value": "f2e801bf11cd524207701871ab483f96074c4a87423abd89dc8569f850fd97c4", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515722, "uuid": "1b228fb1-ea2d-4608-9180-ef58ed76d1b9", "comment": "Malware payload (PhantomStealer)", "value": "b5a536bf0a67e78feac4c464a64a33752461185f", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515722, "uuid": "d49f9ba4-929c-4ddf-ac45-f22e5440d220", "comment": "Malware payload (PhantomStealer)", "value": "576204185146f237c5f137b850de80681dd415a682efd2cf568aa021e88bd882e07f43b4f4beb3fe5b1001625f031504", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515722, "uuid": "fc443a22-37fa-42a3-a3f8-d7ee7a413d67", "value": "T11426A0013ED0DB71F7EA950D94B7232AE375840FA1977049E82A661E1B3EA9843371F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515722, "uuid": "0c851ef6-bfcb-48c5-a763-242a35f46deb", "value": "49152:mHTtbJacviEfjgiEA76/3drWab8Ndy4hXM:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515722, "uuid": "b736bf42-c8e5-43c4-ae53-3bb5a73efef1", "value": 4643255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515722, "uuid": "e6a593e3-12fe-4af0-936e-46f4f75f5386", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515722, "uuid": "88e13951-7fbf-44ee-8181-5fb061146ed4", "value": "af165ce6daf1dcba6b7d52be9c77200c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c0d772-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773515666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515666, "uuid": "5746f54e-5b95-4b5f-b25f-dcff180d2c01", "comment": "Malware payload", "value": "83182524d9afa767119ec93cdce2bc94", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515666, "uuid": "e59da91e-d457-4521-90f6-bd067f905b11", "comment": "Malware payload", "value": "f38471805e8cc6ef3cadd43448797527f6c4a37526202a0033ace61ec717cf29", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515666, "uuid": "7869e06f-ed83-4a24-a5c2-1a12c3544fec", "comment": "Malware payload", "value": "ffc676088fd18bebb48fe389fa20c8e7301ae1ac", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515666, "uuid": "7169100e-3c5b-4b86-a8de-d60210998fca", "comment": "Malware payload", "value": "f0cc19fa8523c5f57a87cdcccca71930748cf007a28afb2121522bc837fdde902604dc3c0e4bc1dd10f90e87e9fc81a3", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515666, "uuid": "86424fac-ab8b-4ddc-9a66-6e082d3c9b8a", "value": "T145959F5940548FFDFC091D6547EA9A6ED3D2BC8ADEF148CC7F64ED8A86264CAC40039B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515666, "uuid": "80131d57-cba7-4630-bb6d-180c96b36609", "value": "49152:iw1QXe9KLh0wkkji1+T61b/nBR4mwIIt+ebYqVRceK0SrkMBssJUH:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515666, "uuid": "3cabf9fc-2b3f-4349-807a-4c9f8df2fc7c", "value": 2008613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515666, "uuid": "724d9b7c-60ba-4791-9015-7eadd181e095", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515666, "uuid": "36366701-ffe0-4ba6-8e29-4aafa98e299d", "value": "83182524d9afa767119ec93cdce2bc94.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24683c0-1fc2-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1773505623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505623, "uuid": "f126bf6b-eaa1-406e-8238-b05370e013a2", "comment": "Malware payload (SyncroRMM)", "value": "aeff35fa36416e379aadf2a33c436947", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505623, "uuid": "fe6dfc30-05d9-4994-aba0-02cbca029dca", "comment": "Malware payload (SyncroRMM)", "value": "f4ed800048737556f59cd3e5cdba4809ef1d2b44e531a0f7307202944071f89a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505623, "uuid": "33ff2b9e-8a9f-43d8-9f39-699e6db252cc", "comment": "Malware payload (SyncroRMM)", "value": "700f6e66762db7c10730bc526544b4af78b1449b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773505623, "uuid": "cb7a541c-d05b-4d6b-8841-eaca19688101", "comment": "Malware payload (SyncroRMM)", "value": "81ef624e563538e42e174fdb24b4e9f973bcc5d61ccdd16cf4eb53bad072b7c3b7e0f8c75acf769d527bf6d6fe9cdce5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505623, "uuid": "c2659584-35a5-490e-90e0-d4f93e58bb6d", "value": "T1CA663385F4C05A3EF19ECD350CBAB628041B62135B205ADBF34B0955EE21FE249FE6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505623, "uuid": "9e0eda8c-0811-4352-8653-7c6a1a3d470c", "value": "196608:pEx4kBtzkqeUc0WF8RBS5F6xYmQHRi0Q7zO1wKfLR9I7rwk:pEqkB44BS5sxiRi521lfLRe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773505623, "uuid": "68f756e3-faac-459c-bce5-c9af7f1e9ac2", "value": 6682112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773505623, "uuid": "6d73b981-00d5-44bb-b3b1-ee47288532c1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773505623, "uuid": "2a201fcd-91b3-4d73-9f2a-abe9388d6e58", "value": "f4ed800048737556f59cd3e5cdba4809ef1d2b44e531a0f7307202944071f89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9791894c-1faa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773495297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495297, "uuid": "00c3715f-e26a-45e9-8bc4-f3f7659374b9", "comment": "Malware payload (Mirai)", "value": "710c4afee803df98ba40082d409acefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495297, "uuid": "4d012532-3edb-45bf-b2c6-837e948cb8fa", "comment": "Malware payload (Mirai)", "value": "f54bb79c8978de382f8521bd8fbc30226ac8796ba35d68cf47984913989ca50e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495297, "uuid": "8e5ab40a-d374-4e42-95da-287fe22dc9f9", "comment": "Malware payload (Mirai)", "value": "5078cf79911c6808a5159249a682b682b2d11007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773495297, "uuid": "14959549-f89e-4685-b65a-909eadeac85c", "comment": "Malware payload (Mirai)", "value": "6afce3e128d0062b848a7334b8c83de1377fd41c822cbb3eca1a6a89454cc6ee8ee93bee1044d0f91392fff384d450bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495297, "uuid": "cbad9284-eb4e-4f76-b3b3-140edf2caaf4", "value": "T1A4F2F8D1B8825A2BC2E423BAAA6F518E336173ACD2CF7717D8111F507B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495297, "uuid": "2f25a434-7bf3-4b47-a8a7-6dd45fa0df2c", "value": "768:CzQJzX74uXq3GpKWKKZSo2Tjupjq3e+aErYe6MjG:RXJXmGH2T+8SErYeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773495297, "uuid": "436dbcf2-210b-4536-ae69-03bd312e3500", "value": 37120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773495297, "uuid": "bd66ba27-5390-4943-aa87-c68b0ddcc77a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773495297, "uuid": "ad79ae27-f74a-49f5-b3cc-9df98e38ff91", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8da23e-1fb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773498958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498958, "uuid": "febf3dc6-9d2c-4149-aab0-394b5b4a3b86", "comment": "Malware payload (Mirai)", "value": "fde20fbd26a3c8e601b904155f8a3b1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498958, "uuid": "2d408828-e381-4c93-a898-8bb0a5144b99", "comment": "Malware payload (Mirai)", "value": "f58eafca48c0ae3e187a3c90d60382a5fd8678c57394ee608e5af76867cdd17a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498958, "uuid": "cd5cabcd-86cc-4cfd-9f1b-15181be8d7da", "comment": "Malware payload (Mirai)", "value": "33ad2f18164bbfe554288774bc65e6f75c0b6d77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498958, "uuid": "93755dda-97c6-48db-9d7c-5839b2236e1a", "comment": "Malware payload (Mirai)", "value": "54c658b1d07b76202c9b93dc6c7f359bf60f5c9026b04a7e1d8c9d8dd5289b3ff9161882d6dfcf06fee34bd3395bd957", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498958, "uuid": "13bb5791-983b-4156-b80e-116bfde3fd83", "value": "T1E6E02BC654A200729EA49FBBA0B1C5D5B2C43483ECC0CA64F489F95E4DECF64B976711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498958, "uuid": "ea341560-52e4-4c93-88cb-ac09e627f3cf", "value": "6:h9OnFfljMo/9As2UtsAMr70X+XOYGxjVhFd/XOYGxjF3U:WDAsZA70AGpTFdpGpF3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498958, "uuid": "06d3bc57-31f3-4abf-bef9-bc6db8a19e17", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498958, "uuid": "ea68e382-50b5-431b-931f-4b7eb01caa3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498958, "uuid": "6d337ae7-4d45-4b09-a5fb-7943bb941934", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f99b98d-1fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773494398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494398, "uuid": "d36de97d-f186-4ae9-9d26-595d7a070119", "comment": "Malware payload (Mirai)", "value": "154d07d239fd917255d8d93122fcd07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494398, "uuid": "d502c966-a1a8-4ff0-a1bc-711a362e0977", "comment": "Malware payload (Mirai)", "value": "f5ac52af9fd254afda8638d95ddbd3e49f5c4dc3bd81cdf82afce54fffe0c05b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494398, "uuid": "deefa9c0-ae79-48fd-af9f-6b1736d343a5", "comment": "Malware payload (Mirai)", "value": "1087a3cf533a2c07904f4a057a957caceac5118b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773494398, "uuid": "716e7471-4694-462d-9cfa-45e1904e2cef", "comment": "Malware payload (Mirai)", "value": "af8df373c8f48ee864296971376264d9b1f387dd3022c43a423f01c236a35371e832e0303a83c998731add1a06d46395", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494398, "uuid": "739d8ca4-f696-475f-949c-24a7e681a6a9", "value": "T19513199AFCC24A3FC1C01379A6AE5A4D3721E3E5D2CB7607CE585B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494398, "uuid": "de3571af-8a2f-41f2-905c-736c6bb1b625", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwBoOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773494398, "uuid": "a540019e-841f-4d4e-877d-a5431ab980e5", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773494398, "uuid": "e1abce7f-fe50-4f38-92d2-47682d186f39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773494398, "uuid": "6ec3c3d1-5f3c-4630-b6de-02a83689a7a9", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3def8aa-1f6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773469655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469655, "uuid": "0e27519c-2f43-4499-ab3e-3d5a8f9a4ba0", "comment": "Malware payload", "value": "3a0d8a9668d1ef5197f9baa57d0b8e3b", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469655, "uuid": "a27daad5-b463-4e1b-8111-42898fa3e528", "comment": "Malware payload", "value": "f5d1d631552acc1470fdf19d02bc89fd134f13edfc30b3f2c3ae27e236b55b09", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469655, "uuid": "17ff44f0-ce60-443a-b276-76eeeda8a2f1", "comment": "Malware payload", "value": "d28418fca990fbcb488ef7781ff3950a46139843", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773469655, "uuid": "5507870e-1eab-4506-9b5b-61fd2e61feb6", "comment": "Malware payload", "value": "33f23f7e2de115d85b824dfe0c9f574b9da58144ce2ca9b324c6676d18695172b4d18987e86c8e55daf11ec0e233d5b0", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabrineme-com", "colour": "#7643AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469655, "uuid": "ca1c7739-2eca-43cc-b218-4a754b945a54", "value": "T1D606BF16B3C86AA9D417CA39C705E333D2B2B9234B66D08B1A9AD7061F77D514F3FA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469655, "uuid": "eb358d82-5fa2-42da-9977-d2e05e741465", "value": "9bad55e74bad1909944ad2c6b5915bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469655, "uuid": "c1f682e8-89a3-4b4d-ba6c-4635daded3bf", "value": "98304:5jJToXj/Gyg8zUk2siRX5823gtijLkuZLkiLKtOq3K7YxFhCFxAzZrKi:xxoX5g8AdX9wUdnLP7YxXCFyzZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773469655, "uuid": "9ed3c4ae-ec6a-4b90-9656-9636af9325c6", "value": 3924480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773469655, "uuid": "f918e18b-028f-488c-9d30-a3122ee940b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773469655, "uuid": "68362779-fe5d-4ad4-b2a9-b2b5f66be212", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a6846d-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773503769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503769, "uuid": "2fb5d3d4-9c9f-480b-9bf0-6b84c87c3144", "comment": "Malware payload", "value": "ac1561a07d69d7111003d966f6c72603", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503769, "uuid": "42185fca-4e98-4564-9fe7-307f6e7e32a9", "comment": "Malware payload", "value": "f64feb190fed8c51208a5819510b45ab888bbe58c8ed03c6e184c944b6442fc1", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503769, "uuid": "f9c298a3-260c-47f0-b360-d77b91b6bd0a", "comment": "Malware payload", "value": "4e98eff6d45d552caf2d5ed5fd6ca378f9135043", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503769, "uuid": "622f75f8-dc07-428a-8614-1d578f271abb", "comment": "Malware payload", "value": "2ed9a69e58077b55cd85b7a8cfe44b0fc71008510188596a86db1cab49cbd790f5c99c98a1dc7bda90216140451e9fdf", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503769, "uuid": "9ee4b2dc-e9d6-4e3d-88e4-d494795b6012", "value": "T14D722D2F42E05ECA127808ECD069A2F325F6B362DCED7C4C9362657A44F0F4566A7DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503769, "uuid": "7c77377f-b371-4d06-b58b-b53c97c72a81", "value": "384:IltOiDggv/8cTkeOtsPJ08SdqavqsKwIw7J7ekTKFEs+JSXN7ZUDXSciK7k0dse:eUiDpv/8cTkeOtsPJSqavqsWeKFiSXTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503769, "uuid": "7ed92a06-3997-45ed-88af-8a7bd348e3ea", "value": 17560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503769, "uuid": "7cf5104a-4938-4d04-8977-64879e6c921d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503769, "uuid": "6cc906be-9d3e-41f4-8ab9-27aae61f02f4", "value": "winecdn_clickfix.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c594aa-1fbb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773502594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502594, "uuid": "f7b8072e-0e75-4582-85da-4b4f2f6de01c", "comment": "Malware payload (Vidar)", "value": "aa9d263071f402e3a5eb239afd087f19", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502594, "uuid": "f08266f8-6790-4b17-a213-edfa7ed9c2ff", "comment": "Malware payload (Vidar)", "value": "f6cb113054b196bd5250b9be6e197d7cec0a69c4f1bb0ed7914fcc2f576bcdc1", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502594, "uuid": "61b84096-b85e-43a4-bb3a-a95a5a3a3066", "comment": "Malware payload (Vidar)", "value": "0d234b7cdbe61e92116f6e39c633900d985d3dbd", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502594, "uuid": "0dc401ec-3454-4dd1-8a04-2c825ba61a1c", "comment": "Malware payload (Vidar)", "value": "577a90f00a0865a6aad21442eefb109b9d7f98ba6b81a242f0450a131c156d3544370539aec4b533d38cd3dcedad764f", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502594, "uuid": "1704831e-8c81-4d3f-888f-61dad458e58f", "value": "T15B955A0BBDA518E6D46A93718CB665913B72FC180B3263D71E607A7C2F72BE0AD71344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502594, "uuid": "521d046f-c785-463f-b0b1-830423b93709", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502594, "uuid": "9a0e2002-888f-4f20-ae53-ccf709115c7b", "value": "24576:HvwKsKvQzAFuL0pHiRGdxMlVq1z26UAutb4aWtPaRRnA/0:HvwXKvQzAFuLxRGd6lVcXra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502594, "uuid": "31f1f294-56c5-4a09-b332-1dc50a0c8c27", "value": 1988608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502594, "uuid": "fba4608a-54c1-4846-9160-1e8da08c0275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502594, "uuid": "008fd1af-417b-4cc0-9a79-612440b64404", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac58c2b5-1fce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773510794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510794, "uuid": "6352762a-9bb6-4d46-9500-e3a789735d4c", "comment": "Malware payload", "value": "c39d15fde2aa5c656e27af7f432fa62e", "object_relation": "md5", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510794, "uuid": "1538fcbf-d6f1-49eb-ad77-560d37df555d", "comment": "Malware payload", "value": "f6d59ebd26898cd89bfae86d02f2fb71aeadf255f75d144b59f19dcefc8f82a5", "object_relation": "sha256", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510794, "uuid": "9947471b-b88f-41bd-b81e-cb2e898772eb", "comment": "Malware payload", "value": "9e25b8c0ec1ab97663a38e9b14ac6e55778749b3", "object_relation": "sha1", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510794, "uuid": "39a507fc-ffaa-42a1-add3-ebe9b3cb1268", "comment": "Malware payload", "value": "df5b62d27c031951866b7947c311f99d37b494651550dca8239ad69429f8cc01f34095370b5939177a6f8091ec328c1e", "object_relation": "sha3-384", "Tag": [ { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510794, "uuid": "76a44953-6b77-4c5e-815a-9c741ea36152", "value": "T12E54E5E02C8805D0DEAB5690EC738DA622777CF68B4A168B0F1CFCF57A546D1E6DD812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510794, "uuid": "97a9072e-c91d-4976-aca5-6502a281a047", "value": "6144:erQ1KvSk5K9ULJMIvnsR47M5FzmvR4+UMyDcC3G8v:e8Yb5KuDsj/yR41v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773510794, "uuid": "bc1258e7-735c-4b95-af38-0f9605c05356", "value": 296594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773510794, "uuid": "1bb2e464-12e5-4390-8597-34ee2d7c3ea7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510794, "uuid": "6b8b0125-9c5c-4f3f-bd0a-aaabff15d24d", "value": "icon.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccb27b9-1fb1-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773498393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498393, "uuid": "256aba94-9629-4f01-82a3-63b9d20b091d", "comment": "Malware payload (ACRStealer)", "value": "4dd44b5f1d651aefecefa39366c2ba19", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498393, "uuid": "1ce5cd9c-f156-4047-b2cd-e4aaf5e743c6", "comment": "Malware payload (ACRStealer)", "value": "f70a9a17ab525ed38ac7b9abe7ce51cfacd8de8e459676507b6e0f7d3bfa6033", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498393, "uuid": "451c766b-ea68-4673-86ff-f32269864961", "comment": "Malware payload (ACRStealer)", "value": "d11b343e953127c4c79ceb7b9f1748de6be4deea", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773498393, "uuid": "461ae846-f162-427b-b1cb-652f1dbfe6c4", "comment": "Malware payload (ACRStealer)", "value": "86533c6b56bead5ba77343136f76312e8d16c43597f0a5833aa78b1133c92726003126f99a98e509056f9091316cb780", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498393, "uuid": "308b53a0-6e20-4d68-9692-0bb3e54adb8a", "value": "T198A5F98221D362BAFAC78E37432A921FEB0186845F21E8FFD6116D57BA739D2D1750C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498393, "uuid": "4b7d138e-d929-4481-9581-b30752743937", "value": "4f6f46f49b8c164878177edff75bc12a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498393, "uuid": "7884c116-b5eb-481f-913a-13ad416199a3", "value": "24576:FZRPTUP9krMcvYjDVfmGaDNZ9NhIZ5gS4joNiPMSSUV:dPjuOD7UgS4O/SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773498393, "uuid": "b1845fb2-f7df-4259-9ade-89b704d3bd31", "value": 2142720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773498393, "uuid": "ce4031ef-1e08-41db-ad8f-884fe1dc3dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773498393, "uuid": "c357d261-692b-4b80-aa91-e851c9c04346", "value": "SecuriteInfo.com.Win32.MalwareX-gen.39279494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d003a4c-1fcf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773510956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510956, "uuid": "7d313ef0-1461-4208-bc56-79952a6add29", "comment": "Malware payload (AgentTesla)", "value": "9a644fc29ba67ea0f5d63a10eba7a3ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510956, "uuid": "1fa96612-d139-4b20-82f8-35214155b058", "comment": "Malware payload (AgentTesla)", "value": "f737f538067803e2ec225595240927a0fb61268a16d3af759c1372487f3ff183", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510956, "uuid": "3103d4a3-87d7-42a0-b84e-6e1ec3b5fc2a", "comment": "Malware payload (AgentTesla)", "value": "c46be3769776aecbd8649972d645b3b5cbaba805", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773510956, "uuid": "77112323-2b5b-4202-bd99-f27947fc035f", "comment": "Malware payload (AgentTesla)", "value": "429fa421f4375584b6ace7cac60d12bd1eee0c02e48651514a6573a2af4b0ec25b62a6c306f5447cad892091030197cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510956, "uuid": "4cfdb8ca-4171-4975-8b33-d9ae80f03d47", "value": "T19235F118276BEC03C1665BF189F1D37517B85D48E412C3438EFABDEB7629B9A2484393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510956, "uuid": "9b0d3fe7-5f3d-46f7-933f-7801912545c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510956, "uuid": "f7ce5b93-4907-4d13-8c6d-718c24cb4446", "value": "24576:g5Xh1iciaBquKOjkIxWmrG+YvzNsZpMlOP:2MczqbOjkoGRv28YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773510956, "uuid": "ed7bf0b4-4a1f-4b43-82e8-bbe34db5cc77", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773510956, "uuid": "9ed53718-1097-46f2-8a4e-19309e036a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773510956, "uuid": "8156d8a7-a817-46ee-b752-fc3e58ce18c3", "value": "PO 4602788258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b866be-1f43-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773451027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451027, "uuid": "c8d86f7e-c19f-4d96-9919-1492a84cab8e", "comment": "Malware payload (Mirai)", "value": "ac43ab77d7c7f81d8f98d85055b1a81b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451027, "uuid": "b8b1329e-1362-423a-89a8-515eb7780255", "comment": "Malware payload (Mirai)", "value": "f76977c251ada28c41e6d37c29d349b729a0b869476bccc94f234ef049f2a1f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451027, "uuid": "babf66bb-c65b-4b78-bc7f-f89e95f36573", "comment": "Malware payload (Mirai)", "value": "4f0d93ffe60e2734f60f8cc170bad751c177075b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773451027, "uuid": "f9efa80f-2dd9-48b9-9e43-8c17ec2baa89", "comment": "Malware payload (Mirai)", "value": "bd357486158b6b80c4de097bf90218904b5290d5ccedd397bdeee8033f301b2615608e25cc320726fc24cb9cbe70a268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451027, "uuid": "b3286398-1fff-483c-8cd2-1eb6b5d0a37c", "value": "T197931856BC829B11C5C412BBFE2E018E33132778E2DE72269D245F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451027, "uuid": "b6376bc9-d1b5-46b4-99d9-3c5067c756ea", "value": "1536:FKnILvbtFNsDAgXUGepgQoobjztBeTWa8osxiHCDdki0V3rr5HY47yp0zZ:Tvbt7s14HeTWa8o7V3rrtB7y2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773451027, "uuid": "dcb06a13-2670-4d6e-b840-9fbff5d7a505", "value": 95832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773451027, "uuid": "d421195a-213b-40ca-9170-d42a0b672b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773451027, "uuid": "22ac9d40-f959-4c10-bf96-d40a916d377c", "value": "SecuriteInfo.com.Linux.Mirai.9774.21157.26492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d396150a-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1773516013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516013, "uuid": "07c9f4e9-8ddc-4a79-8aa1-5c1c78fe830c", "comment": "Malware payload (SnakeKeylogger)", "value": "532b4ccdf3420f26f8a64f02649b6440", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516013, "uuid": "93ddf599-f0e9-46f6-8e51-e78633e9d3f9", "comment": "Malware payload (SnakeKeylogger)", "value": "f88d28cbfa74812d4bb276a9b2d18300a1e725dabca5cba1c4ad77719f1ffaeb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516013, "uuid": "86509e95-7ed7-404a-b508-3c7291dabfb4", "comment": "Malware payload (SnakeKeylogger)", "value": "728afd255f7878d7adccfd4a32cf070950f0c133", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516013, "uuid": "83e4c649-65bb-4dbb-a450-f0ddfd0c91dc", "comment": "Malware payload (SnakeKeylogger)", "value": "f5de3329c195e5f13496e3137f67d10f7d89f6f77eeb72c6e8af05b68c14c0e22775399b81300a536d63b13ebc06fb90", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516013, "uuid": "992c2239-9b8f-407f-bb4e-80c4e90f5c72", "value": "T1EA758E37956ADB95EBC03207A8E4091C23D49467DC367C2EA5F9FC0B1EF8148589A9FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516013, "uuid": "5be44a92-c66d-48c0-9b2d-23df4f30fe0e", "value": "24576:OZBYaUtKi+f9IKLAoRmXVJ1zNL11fdaRWUogEsJKahRsE6O/23CvfpF:yeKfzLPRox5SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516013, "uuid": "37db60ee-7424-4a90-9242-a8de9c11698f", "value": 1599362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516013, "uuid": "ff818e70-92e5-4724-b8e1-4e236c2399ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516013, "uuid": "d7823f2d-a532-4739-b015-1c07ee53171f", "value": "532b4ccdf3420f26f8a64f02649b6440.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de75e6e2-1fda-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773516032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516032, "uuid": "16936b23-d684-4356-94c2-8a6b3fc60b88", "comment": "Malware payload (RemcosRAT)", "value": "c8747452a95f2aef02d8cb76c1305542", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516032, "uuid": "416344ac-858f-4a82-b398-dee0416764b6", "comment": "Malware payload (RemcosRAT)", "value": "f967f1baa92ba0c63589a0277e4675d8ef8d2aa4cefcb35b45f3138dcf1e9d13", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516032, "uuid": "1f6fc9c8-5120-4aa0-9dd2-684c97ff3365", "comment": "Malware payload (RemcosRAT)", "value": "7a46e8c1ba945b9085cc8cff1f88f04db42c0466", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773516032, "uuid": "c1866d3d-65bf-4f81-9e5a-3d02201c4d92", "comment": "Malware payload (RemcosRAT)", "value": "6d3445f59293350d8085c0138354605be08ad901863b90092c191cbcf35b7dabc39c6d039da4d0bfe1e327e1dd65b078", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516032, "uuid": "df052dc3-f357-463e-ae24-d02e84bde16f", "value": "T19853117C5C710484F5C744A256CCFDCC384A6856EFC26E389ECDAFF9B968988A4DD092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516032, "uuid": "402d4e78-137b-4f1d-89c1-a9dccf5088ce", "value": "384:2o04OGJD6m10gka1o8V9RzNhs19XfJEAinIpYajqZehu6e1koTN9K3kxhcbEwaBi:PhJQh2Z3u3qt/3HK1pBlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773516032, "uuid": "5f89fe3b-ad5e-4bbe-8a86-de30482efabe", "value": 63114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773516032, "uuid": "b527e6ec-91fe-4b72-8de1-1dc48b5bb3e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773516032, "uuid": "90707bb2-3016-4e6c-8d73-40b730ea9215", "value": "c8747452a95f2aef02d8cb76c1305542.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f90a803-1fbc-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773502987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502987, "uuid": "bb6a8fa7-f0c8-40ab-95b5-f3f9329ddef9", "comment": "Malware payload (Vidar)", "value": "eaed13c6e882788dae7db7f2ba57fc50", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502987, "uuid": "635e7ee9-341f-4156-9aef-6c2cacbd5315", "comment": "Malware payload (Vidar)", "value": "f96b862d411a38b6b6904a275bc5cfa51a4f6a4ee8e0dc62e6135089ddebf1f0", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502987, "uuid": "11af6670-c824-4c2b-ac14-b30d1a40f2e9", "comment": "Malware payload (Vidar)", "value": "4bbe0fd5a2aeb29e8efb615dc9b45373bc4ef9af", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773502987, "uuid": "5192e493-348e-4f01-a281-3700e11a2f3c", "comment": "Malware payload (Vidar)", "value": "88b4c59324822614d8078166b96e76e082cff2a046e0fbd07aea120c6a6dedd4c9f089b0929e36c0e8660ed1d7435b47", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502987, "uuid": "b631626b-cb9c-4826-8008-005e983628b8", "value": "T18C173340DC452676A7B79505CB99A40E41D1826771F88F7F06FC2A3CE8BD2FA76C2D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502987, "uuid": "ba4da0ad-857a-4f6d-9e07-1f93acc8eac4", "value": "393216:u6VlJroaMnj4dWC/YULtmRug0umIN6mlSk10zz+wNoqdh7cSLdb5cDS6:uCTMA/PLtaug0wAkKHfrdV0S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773502987, "uuid": "25ce74eb-bc32-4b7f-b75e-5363bebac57d", "value": 19811027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773502987, "uuid": "9603b70a-5a22-4ea6-87cf-b7f90aa2d411", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773502987, "uuid": "a0410f3f-9e63-4909-ac8f-850c4c433bf6", "value": "GTA5_Mod_Menu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92c48f0-1fd9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773515540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515540, "uuid": "f073c2f9-11c7-45a0-9ac8-4573d7f500af", "comment": "Malware payload (RemcosRAT)", "value": "65caee877cace9b578bff91a553aaa05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515540, "uuid": "174b1886-5fbb-4125-ae61-93d0232efbaa", "comment": "Malware payload (RemcosRAT)", "value": "fabff45462b1094b3c155c56f061aec91be51072357d4a60bb1300945f9bf0b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515540, "uuid": "6302cab5-3d83-438f-91d9-a958a6522c9c", "comment": "Malware payload (RemcosRAT)", "value": "d23a3c6a01565e537df29ab79e20050439b4709f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773515540, "uuid": "ee0b6d51-388b-4b23-82d3-7abea579c760", "comment": "Malware payload (RemcosRAT)", "value": "da50d7ff2457d2b139e06e95f2d7b8aa3a20a4898bd096f1094eef63328f9aec16959cc3c8b7077231c96f84c2de709a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515540, "uuid": "679ef564-1842-44ad-a8ae-d2f2b20b613a", "value": "T14FE5AE2D27E82A904FE2E94AD0DE41AB8F53C3A655D1BFB9F70037045F87A00976BC59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515540, "uuid": "a550ec4b-9d0b-4eb5-abe6-a7245a518468", "value": "24576:IhuochB+/OQW/cPu3mvoGRTKB6LHK10cHWaLi6nBxrdwQmtsBBEqSj0h+/JovqJe:hoW00dd4dMDso/UqHLYbbbb3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773515540, "uuid": "3767e136-ab73-4a9c-9ffa-dd744ec6afad", "value": 3155690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773515540, "uuid": "974dcced-cfc9-4f58-af41-680dded4f835", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773515540, "uuid": "27fb4bde-6feb-4a3b-8246-a22f0769ff00", "value": "65caee877cace9b578bff91a553aaa05.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8a3cef-1f50-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773456681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456681, "uuid": "e3579a6f-b785-45eb-a90d-cd98f3d42fce", "comment": "Malware payload (CountLoader)", "value": "45a4ffc1fb907873f120e749bb9a61a8", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456681, "uuid": "2cf0e9e3-8e71-40af-9558-f689313a6bb5", "comment": "Malware payload (CountLoader)", "value": "fbfcbd84b2c6461eb62998221db3c299ea8e026bfe00c739a0eeed24cbae9315", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456681, "uuid": "4888ad57-1492-4a58-a66d-50702dcd25b1", "comment": "Malware payload (CountLoader)", "value": "b60d5d456586c2a97bf2388ad0b19da3838245d6", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773456681, "uuid": "735e3f10-dfb4-43f0-a7aa-5b7b7a63bfe1", "comment": "Malware payload (CountLoader)", "value": "2e3baefb8474c14bf45c926b3beec7be6eb48d4bd16c89af69d12f575cb071eaad03571ad82ee980ece82af8652964c2", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456681, "uuid": "9275761a-78ab-46e6-8c47-2de6686e95e4", "value": "T183C3FF79879F83E8B4473854E55F5A06CFA1A5133A0CE590FB5CBAE51F08D38C4FA8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456681, "uuid": "29681c6f-36b6-40a2-8867-b7761b6ef311", "value": "1536:i3LVj4xNepOEpwyEGRr/5gciUl98reK2WC5TbJ1:yj4xQWyPWK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773456681, "uuid": "2e2088f9-7414-44ff-8942-835b96497268", "value": 124996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773456681, "uuid": "3f4706bb-b614-4dbd-bc17-3f3755b04aea", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773456681, "uuid": "442af7cd-a0f4-4cd2-8133-1266001fe0b3", "value": "Template_Sydney__96.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e43badd-1fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1773503710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503710, "uuid": "a4c6a687-672d-4f9c-81e3-8c11b9d454e5", "comment": "Malware payload (GoToResolve)", "value": "452a6a6418d71db8b812ab342ac46f6f", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503710, "uuid": "5007989c-c02e-44ea-8ac7-29dae22cbc6d", "comment": "Malware payload (GoToResolve)", "value": "fc51071791ed9c91dc0b685d807ec877cb0d9177dea77292dde9b895f61fa67a", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503710, "uuid": "5306552b-e0b0-49e7-91bd-ca86f8d9a009", "comment": "Malware payload (GoToResolve)", "value": "5ebdf8da43368a0741d8d06f9893d1781d501003", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773503710, "uuid": "608b4bd0-21fe-41e6-89e3-a82f7ecd46b6", "comment": "Malware payload (GoToResolve)", "value": "59d6fcf5250b4af707ca6174fe10dd5b6eb6b1069e502c69e161702e28712db12977fec500eec48f5086175c92a3dfaa", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503710, "uuid": "d20c647b-f575-4cda-b6ae-81a90defa2c6", "value": "T13DE1A74B640702B4C57385BBA577261EF85521176B441424FBDD8A91CF3CB2EB3E50EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503710, "uuid": "1d2c1c37-8b77-48e2-abca-63b08cbfbd80", "value": "192:K2yXipkZ4o/6/zc/e/3v7E/e/UBl7/yRGYt/r/6ksm/3:ByXim+ZyqKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773503710, "uuid": "f8ceebf2-3bf2-4ad6-bdd7-45e24ee0f07c", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773503710, "uuid": "ad479bef-a688-4942-bb25-ec13ac76bcc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773503710, "uuid": "994cb284-042e-4393-a453-17456a263d10", "value": "SSA_E-FILE (25).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591560a4-1fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773493903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493903, "uuid": "c1a4a961-0ea1-43b3-8043-683799238b5a", "comment": "Malware payload (Mirai)", "value": "26d326a62ad3716e157d6c9f7b769000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493903, "uuid": "43c3e480-e76f-4c16-93a2-b00b23dd44f6", "comment": "Malware payload (Mirai)", "value": "fc8f92147afe0fd26201f34e0843e521ba6812921f5ea5167e60ae32c6aca9d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493903, "uuid": "34d0ea5f-9dd6-4880-8336-52f0b3e8bca1", "comment": "Malware payload (Mirai)", "value": "97eeecd8fbce6fc12c2522270ea13a100895bfd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773493903, "uuid": "7f35a282-1468-40e2-a8c0-a6c6df5bf1c7", "comment": "Malware payload (Mirai)", "value": "0bc224e6c748b5f24824ae7ab999ad3f0cbba2465f3d049fb7a07b2087a171d70f2181544d30228582d6fe67bc21b3a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493903, "uuid": "4f7b453d-3aeb-4662-8edd-f075bfd00457", "value": "T17C837C32BA751D27C4D0687A61F30721F2F6479B25EC8A1A7DB10D8EBF2564032477B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493903, "uuid": "4b911959-827f-4b82-a17e-c1aa377e60c7", "value": "1536:BqjSIdmh69OHkGvTdN5zow5NzQKt0qrNM5owQovwVY4t/7o9VNNus73:sWTlEG3VrnScN8vQKkK+s73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773493903, "uuid": "671e7c47-6094-42e6-8aad-7a3d1739f193", "value": 85512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773493903, "uuid": "3c6a67f0-c2af-4cab-9301-dc3877fb2865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773493903, "uuid": "9b9b0228-d49a-4572-a773-98a0520317b6", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e40a56-1f80-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773477331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477331, "uuid": "000bd889-0410-4b81-9b5c-a9393ec96755", "comment": "Malware payload (Mirai)", "value": "43d9eb9c1e56456242f8c4054fa6fa80", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477331, "uuid": "720b35c9-5d9e-4541-910d-75d88f71a0c8", "comment": "Malware payload (Mirai)", "value": "fcb2749ad962638f3056cb1a8faf69435bdd0d0f1271f70abe4779e5f934fb8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477331, "uuid": "123f94df-a963-4ee5-b3d1-67bb6cb3574a", "comment": "Malware payload (Mirai)", "value": "a0177be6c0f7b9b3a4d5871894755e1ea31867e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773477331, "uuid": "3169c7d4-ac2c-4cb4-a053-7fef65b06009", "comment": "Malware payload (Mirai)", "value": "0a202f17d55b578dbeb70817fef08efcf58f7a0b70cb710a74d87e13da11661bee4541ae2d171e066da24528cebb71f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477331, "uuid": "9a538546-3e3f-4095-8269-d3256ce11a7c", "value": "T1EF3164FB204003B78429FB1C6779858F93BA9BBB95B1A7D09C9C3524E4499B5FC07918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477331, "uuid": "68942f88-8856-4433-b4b0-be94bf9ff1c8", "value": "24:I9nXgocRygO1E65VpLpQEEocVGLEXHVKOKNIlEdkgVU0KHErSq7F/opUV/rEvY:SwocR3O11fFQ+cvHq5H517JoOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773477331, "uuid": "a963c03e-8034-4f06-8106-e51e0b3e7ffd", "value": 1553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773477331, "uuid": "03c60a10-ebd5-4267-aa72-8de72ef7e8d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773477331, "uuid": "917d0ee7-bd12-4abc-ade2-9fc366159d63", "value": "i.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }