{ "Event": { "published": true, "date": "2026-05-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-23", "timestamp": 1779580982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5d01daad-7aae-4f1d-a159-729430edc576", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35e6452-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779520431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520431, "uuid": "1f0dfcd5-c53d-4757-8b23-06417f2972e0", "comment": "Malware payload (Mirai)", "value": "d677ea3c4cf2da951eaa5fe73bb6d8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520431, "uuid": "a960126f-b690-4447-a9a8-f3b3c6f85b4a", "comment": "Malware payload (Mirai)", "value": "00bdb9e8ef81c99109a8dd86c375da85676f31f898dedbb22ef2ec67b0e0356f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520431, "uuid": "ae22bed7-f535-4200-b2f2-90700c57409e", "comment": "Malware payload (Mirai)", "value": "70f9d958c1fa170d45bf3338493c4682be57c09b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520431, "uuid": "3a075c37-ffbc-42f6-9eff-64ce44915870", "comment": "Malware payload (Mirai)", "value": "babad6558333d756090b3faa24130b55f2d2e9103a36ff556f376ccaf5d7d6e45d94550cd7a648693101dfb7343c7dab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520431, "uuid": "03a5d55b-e1b1-4fa6-baa7-6046ae82dc5c", "value": "T1C9D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520431, "uuid": "f7c78b37-d5de-4e41-a433-c8671685980e", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3jnA:APeCK9kzivVYQitymTTnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520431, "uuid": "1dd3791c-8152-486d-b9b1-1244a5ea0139", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520431, "uuid": "e55942cc-5105-4592-ae22-d11ccdfa6382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520431, "uuid": "e4ce8b36-489a-4ea0-a310-4735ff425464", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdaab388-5699-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779535481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535481, "uuid": "de6d9c28-2b02-4448-ab5e-92f259deebee", "comment": "Malware payload (Mirai)", "value": "45f64904dce8e699a210d5bdf632f8cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535481, "uuid": "a5aed362-6d9a-4f5f-ad2c-3f5c0707e507", "comment": "Malware payload (Mirai)", "value": "021fa8166e57403b030aa71b3b2cbb25051af51d3912a2748aa1267f3060ae74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535481, "uuid": "fc912ea1-cfb4-4300-a36a-43010fcbace0", "comment": "Malware payload (Mirai)", "value": "7933b39f8eeb76e4ddf19fde3210d3d97314b0fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535481, "uuid": "204b410c-aa86-4f5c-a324-389957e88cb9", "comment": "Malware payload (Mirai)", "value": "f0f0f05e4bedd0efc67304b6f3573159f1121d3c4712c28ba0465ee07704a5f4dbb227f46b5e7d05abb1c8db8547c42d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535481, "uuid": "d5c5a8dc-c62a-4083-bf91-59ce70a98c51", "value": "T191737CC9E983D4F6EC130A350136BB379AB3E53E2169DB83C3A9A525DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535481, "uuid": "52a19367-1789-448f-add4-a825109739d1", "value": "1536:Dbsv6XewvpXSGos1LNxVZW9Z3J8h3qaccSXl:DbsiJpiGokLNx+9zs3ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779535481, "uuid": "49db0e84-f512-4742-9e4d-a8f1e2f68301", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779535481, "uuid": "2d6637fa-0fbe-428b-a97d-aab73576406e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535481, "uuid": "1e8f3832-1ce5-41d7-bd54-24a5ccb9df94", "value": "luxzz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc311aa4-5689-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779528526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528526, "uuid": "0890e685-48a4-4d72-a873-45db623eefa3", "comment": "Malware payload (AsyncRAT)", "value": "4bbe27ba6f62d05cc08bef87f3b808d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "asynrat", "colour": "#092249", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528526, "uuid": "3a088b3c-b5bb-43df-a236-63e27e7e527b", "comment": "Malware payload (AsyncRAT)", "value": "057ce719d259f34687589c6a31498b1edbdb84af194e6c7c0e5681497699e24a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "asynrat", "colour": "#092249", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528526, "uuid": "21fe30f4-13d2-47e4-b636-d09fdf099cd9", "comment": "Malware payload (AsyncRAT)", "value": "e5c90b3a99f09b7a97689bf9007ddcbb43619058", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "asynrat", "colour": "#092249", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528526, "uuid": "73143216-a85d-43bc-a6e7-cd027b04fed1", "comment": "Malware payload (AsyncRAT)", "value": "d24e09df647780bb9868a99405e3c1b0f4ac43aea815c015456184c4e3fd323bea70359c98f17b8b8142cd463b14fc2f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "asynrat", "colour": "#092249", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528526, "uuid": "971b13d9-6e8b-45b8-8e01-1152a1895a86", "value": "T1FE236D4037D8C136E2FD47B4A9F3A2458675E2676903CA5D6CC814EA2F13BC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528526, "uuid": "e46ebd71-55a6-4731-9775-0c8937fb65a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528526, "uuid": "5f1ff08d-1243-4839-81a6-68162ce2d9cf", "value": "768:ABUQgNIL4+M0+LiZtelDSN+iV08Ybyge0V7HB33VvEgK/J/ZVc6KN:AB1gjsZtKDs4zb1T3FnkJ/ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779528526, "uuid": "2b476504-7ec7-4631-b8b1-7c33e6b0cd5c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779528526, "uuid": "20e0e597-08da-4275-b73d-4de743f0eca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528526, "uuid": "85b8eaea-c0e0-4db0-9a6b-21e2f1b93449", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f7ef47-56d5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779561123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561123, "uuid": "8fe12b47-1369-4eec-8c56-9efed3320e99", "comment": "Malware payload (AsyncRAT)", "value": "95d1f3f551726758afefd7d77374ad68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561123, "uuid": "d2902dff-a82c-4d8b-be39-3517ca6f7147", "comment": "Malware payload (AsyncRAT)", "value": "07506b483a2fe1276fe390fcd462b4ed91ebc28b7be39830b03771e998e2a6f1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561123, "uuid": "2617d610-d552-48ae-8a82-2a981a4c1b07", "comment": "Malware payload (AsyncRAT)", "value": "a292bcefc8f37a360ad7704077f8ecfa8a634300", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561123, "uuid": "9e01cf8a-630c-4109-9360-ea03a186f02d", "comment": "Malware payload (AsyncRAT)", "value": "8663705e5a7efb4b26e3e3947b0323b79fa18173e7147fa83e2cc495d21f7c00b6f8f68bc2589a3ff3c113a392198ee8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561123, "uuid": "14c990d1-4c25-4500-9db7-17211ac12b99", "value": "T1602319007BE8822BF2BE4F74ADF26145857AF2A32603D54A1CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561123, "uuid": "bb96bb32-d32a-4eb5-92b7-496bc2883627", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561123, "uuid": "5ed359ae-739f-4f55-ab4e-300003f6ae5e", "value": "768:Nunn5TgoqzqWU8d9rmo2qrcOjPGagAWOzjbFgX3iYJ17SdnKzZK37lbcDZLf+:Nunn5TgNR2dOTKTO3bCXSu2RlAdLf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779561123, "uuid": "2b80d0cd-f04f-49bc-86fb-2bcb055b24a8", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779561123, "uuid": "b64c1759-15d0-4a5f-aa1f-7ddc7fc7dc4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561123, "uuid": "8cb345e5-8eed-4639-907c-1045889e3bb2", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba905fc4-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520336, "uuid": "6480fd91-2f92-465c-a323-7be1c7ed8eb7", "comment": "Malware payload (Phorpiex)", "value": "d8eae28dc2b65185c0458100aa7d3ba9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520336, "uuid": "3c5b047a-22bd-459a-a941-bbb722e86b5f", "comment": "Malware payload (Phorpiex)", "value": "086e55402d8810a987398734c29f42c1df0bd44ed417212eaa07b04230d4a7c7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520336, "uuid": "c1582ad7-c4c1-4f98-8eaf-4061beec07ec", "comment": "Malware payload (Phorpiex)", "value": "938c46e61d384523638da71076be2a610c10ffd3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520336, "uuid": "41e173f7-b4bd-4f58-8e4b-4ba99ebd5d16", "comment": "Malware payload (Phorpiex)", "value": "769685eb48d11f2989d71e588d3736e8c748b93253a69026f87b03622b69f9e42d8bfbbdb24c303ad96877eb58f8cb07", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520336, "uuid": "a2888cbf-8241-4fae-9166-aeba0da36376", "value": "T1EB824A0FF9914216D1E100B05675863BDAB99C72338854EFFBD48A990BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520336, "uuid": "d1760730-3b76-4bfd-a13c-1a0511990ec8", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520336, "uuid": "2d54cc03-97e4-40d6-8a7f-398c82015fe4", "value": "384:4uIJlVYer7bskwEd0ZHu9JgiL7QWav8U9c3:cg80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520336, "uuid": "07807d0f-20d3-49dd-bb7a-b5a49155974b", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520336, "uuid": "89a4cff5-205a-4f08-98ff-6b036641cc26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520336, "uuid": "bc552a3a-8230-46d2-8280-1492131ba8e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19499df5-5697-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779534238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534238, "uuid": "ae15e6b4-36d1-47d2-bb8c-5a39d7b27e7b", "comment": "Malware payload", "value": "622a642a2c9412846cdbaf767474d0cc", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534238, "uuid": "3b0deae7-9918-44a9-bbdb-5b55eee553b1", "comment": "Malware payload", "value": "08e2c3c69cb72b54b53778ff187b6d26839157c4dfc92829ff8083a56002430b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534238, "uuid": "d0510031-4a70-4883-aa1d-e3510a61c9a7", "comment": "Malware payload", "value": "92c986381f29672d82e43515731881035800cf30", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534238, "uuid": "5dcf8a3b-24d9-4502-8d95-aebd680cc2e1", "comment": "Malware payload", "value": "45d52783062a5af34367d0a2b843ac2146488c4a5b63c77b16d5feb0ec275dee46bbac67eb911c9150a93d43fc9c7cac", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534238, "uuid": "01a3666b-3476-4946-b2c4-8b8ab11fb03e", "value": "T124726425E64004169933C2B8EF639B8AFB624117934287693FEC13925FF6C549973EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534238, "uuid": "ff6072a5-1c4c-4081-94de-17ca2c2f7c35", "value": "384:eLkP3SbdXHRxWr42MQ4MMuR4zV3qUcHZBYF:eA3SbYrlfbTly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779534238, "uuid": "7623e10c-7e6e-483e-b683-f510aabf7b6f", "value": 17054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779534238, "uuid": "e154ec98-9ae9-434b-86bc-bad8f9f9fb72", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534238, "uuid": "95a6d8c0-ba41-470b-8b6f-6f079a02f966", "value": "captcha.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e0b980-56b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779548129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548129, "uuid": "dcb275b5-aa81-482c-abc7-44e63d79cd40", "comment": "Malware payload (Mirai)", "value": "063a6b50d3d018ff4ab3c3a9f0eb72ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548129, "uuid": "95741a6b-cca5-4db0-831c-0883efd6a489", "comment": "Malware payload (Mirai)", "value": "09c3915d9851e6ba233010056aed5ebdbc888663bd66fc2a06872139fd62bb31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548129, "uuid": "1e418d3d-df62-4178-bf9a-3b669ff5f8d5", "comment": "Malware payload (Mirai)", "value": "326859ceaf5af3a3242793bdb0454a36f716a967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548129, "uuid": "f63082f6-024e-4fbb-ae70-f0e98bacfb8f", "comment": "Malware payload (Mirai)", "value": "5448460f5bb65288165b0a94d63fecf3792de66b16d03f0a30ff0a89eab20eb0f28ca6c6a4428a7d6f16d744893d1e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548129, "uuid": "1df5b139-f703-413d-851b-b1e426a27077", "value": "T1FA833A52BC819A12CAC413B7FB1E418D372663B8D2EE32479D255F61738AC2B0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548129, "uuid": "a61963a9-83c6-4bd7-b17a-c620c2b15e52", "value": "1536:VoUZXH7DfYb070ambs51VeNB8rpKBWHEOWr0I4ZY6CytcpY2r/:WUZXHHYbziV0m9EOa0IgYItkYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548129, "uuid": "f9a08fb7-a705-4f68-b8c7-c2ea88586902", "value": 87360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548129, "uuid": "aa1cc50b-e9be-49d7-828d-c00180131042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548129, "uuid": "43573a3e-de03-4421-b41a-1eb8aca7d809", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa72e2b-5677-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520478, "uuid": "602bbd3c-267b-4a4c-b75c-11dfb7ddffb3", "comment": "Malware payload (Phorpiex)", "value": "9b311601ef28d3a1faa4f91e331ff1a2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520478, "uuid": "235b4aa8-3336-441e-92c5-653923d127ba", "comment": "Malware payload (Phorpiex)", "value": "0c90e66538809a106c820738fe52e5c71100b860d71c77604e8b8915d18a0133", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520478, "uuid": "fa5e210a-8d2d-4adb-9569-b2d1fc15593b", "comment": "Malware payload (Phorpiex)", "value": "3cb08b1863221d4e716b23a99260ee476e311d8a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520478, "uuid": "8c00a6a5-52fc-415d-b682-7abab2adeb57", "comment": "Malware payload (Phorpiex)", "value": "eaadaf5a9c97d9ffbc720d34246971e634840338d70a6efe342a6e687494bd1ed3e9a188c6dc2d1f479726c4f66dae62", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520478, "uuid": "aecd664b-502f-4f07-8bd2-8a67097ce46f", "value": "T12F824B0FB991421AD1E100705276867BDAB99C72338414EFFBD48A991BB86E6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520478, "uuid": "f5735aa7-6ab1-4a39-a34b-18a39a6cd9cb", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520478, "uuid": "5c5a84a9-5ddc-4d8e-a703-f3bf28e4b2eb", "value": "384:WnIJ1V4+brLsEwoNSZ5Hu9JgiL7gWav8U9c5:RQIUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520478, "uuid": "06189bf8-edbc-4d3a-bd9d-460a5f72052e", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520478, "uuid": "0324db65-6a60-47f1-8ab8-640b8cbc60a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520478, "uuid": "df21aa9f-9a02-4452-bdba-bd61db638e84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb2384c-5674-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779519349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519349, "uuid": "c7887412-3ba6-410e-81e5-489d444b6b63", "comment": "Malware payload (Mirai)", "value": "38827548cea486213206444c11ddb2cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519349, "uuid": "78f98a39-e3fc-4341-a265-60e0f50f4011", "comment": "Malware payload (Mirai)", "value": "0cb92c85a1806bdb9137a7e225e47aed596578f8c30712e85a32f8dcf751e149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519349, "uuid": "9d2c44ba-973e-4541-9a06-bdbafe94b225", "comment": "Malware payload (Mirai)", "value": "5418e1ca251fe5c08370ace7f5f4e26eac621e07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519349, "uuid": "35392676-7719-41c9-9e71-e2fb6f0848de", "comment": "Malware payload (Mirai)", "value": "b124b3a4d917507ec326dd02f5c7d49bdd0d3ca3d21534277405b6909eaa531aba3e478513d12896172fa10cc087cf0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779519349, "uuid": "33c6583b-64df-4093-8e69-91d2f28110eb", "value": "T1C4041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779519349, "uuid": "58b74c79-0f98-4be4-af8b-6df63eb8fcd4", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2worKFLYV0fCtZ1SD39rsJzjM9fx49SY2q:t3nEr5dfHPq7UTo+FsvR9X0l6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779519349, "uuid": "bd017142-fbcb-428c-b023-242df28f807b", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779519349, "uuid": "e79b4244-56ea-4d5b-98c9-9bbe4faaf418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779519349, "uuid": "b2133e4a-f6ac-4aa2-a935-83c74109f68d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80602f08-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497045, "uuid": "7e92dcba-9bab-4a38-be87-c54ed115a7f4", "comment": "Malware payload", "value": "1f0d3202866eb07bd9a4051dbadeb740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497045, "uuid": "866e19d5-8f7f-4a7e-be36-b795db42cc8b", "comment": "Malware payload", "value": "0d77820072bda4a45876ca676ebeea0f831fce252edc418065f6aed2c467dae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497045, "uuid": "90af67e1-3c19-4e61-9cb3-9eb604ea10ac", "comment": "Malware payload", "value": "dbe9a48078508f5dd8d9d822c50bb8513537f2fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497045, "uuid": "a497b257-3327-413c-ae58-56712775d6bc", "comment": "Malware payload", "value": "6c469d3e3bab6bfb915007e9fd87499b0f400d7bb8120efc06cb56aacd1f8f13b583f03043c8c745a68780e513814c6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497045, "uuid": "e90e4210-e830-4442-a050-4840b1e86594", "value": "T18545F117FA7108A8DDAACC75825EB133D6297889C312B1273FD55F012B2AB24EF1DB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497045, "uuid": "26b03425-61e5-4953-a84a-29deee50da15", "value": "24576:b20o/+j7dt622HYSPaBw4jH5lDCubrBfdryY1WyBO8:bJDjPLWSBw4ltrBfdryYhBO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497045, "uuid": "74fcd2ad-1c8c-4af0-943b-68efcc8e918f", "value": 1245020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497045, "uuid": "3cb1b1b3-c5ef-4e46-aa26-87d9919461c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497045, "uuid": "3c699785-21a2-4f95-8453-f22ccc5b271b", "value": "nknrjhk.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06797a9f-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541079, "uuid": "20fe7cb6-8faa-460a-bfe0-cf90938c640a", "comment": "Malware payload", "value": "be02789e19fa7714569b48c775d1021d", "object_relation": "md5", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "krypt", "colour": "#98EB44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541079, "uuid": "f5647418-2c14-44e1-ac62-b68fd5e010d4", "comment": "Malware payload", "value": "0f06611bba9fa719a02d6a62f40e97abe2d7015ce000197e7f0bb24d55d4acf3", "object_relation": "sha256", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "krypt", "colour": "#98EB44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541079, "uuid": "59a9b861-8fc5-4076-b774-d81fa590804f", "comment": "Malware payload", "value": "2a6a862ce4539d177d551dcec46040558a62fe92", "object_relation": "sha1", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "krypt", "colour": "#98EB44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541079, "uuid": "d62e5259-cbb8-4ca4-be4c-7affca6049a0", "comment": "Malware payload", "value": "829d54c6a4a38b640c680a4d94a21f94478b8df3ff749e7735a305a7ae88fbd0c0d7bc640b8ef4c734b4fb4d5878076b", "object_relation": "sha3-384", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "krypt", "colour": "#98EB44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541079, "uuid": "451689d0-cec4-4921-b42a-cec62f2fce84", "value": "T15AC66AC7166D3DCB80A177BC944190A8F1CFD42DAB9AD3F19ED7FC5A51924820C42BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541079, "uuid": "fe5e77b7-fdd6-479e-9cee-0514d27a4197", "value": "7a2491da65ac5f1d2282bd8e2e29c33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541079, "uuid": "de1b58ae-97c9-42aa-9146-bf85dfb84160", "value": "196608:n+mTXOymJmZjRUPGxOVdVvESB/JhYsikxc9CyGzqP:+3gR9cVdhdYsJxcCyNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541079, "uuid": "fb25fec0-b170-45a8-a346-fd6daf94fb1e", "value": 11557376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541079, "uuid": "6f72dd74-ff36-4a5a-ac2e-9d6edb8d75fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541079, "uuid": "ec9a37ed-7665-4eea-926c-49ede2187cc1", "value": "cs2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0673f7-5680-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779524635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524635, "uuid": "2540b1f6-870c-4460-ad1c-a4a2ad121963", "comment": "Malware payload (Mirai)", "value": "95b8960c9bedd900c4c4ec46639892ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524635, "uuid": "95cc8379-c8de-46b5-8363-78e3af88e462", "comment": "Malware payload (Mirai)", "value": "102e358065900de9c401f194d637eea40a1025d24a031340093847404fd61a76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524635, "uuid": "21c3c210-5973-483c-ab26-fa6104ab426b", "comment": "Malware payload (Mirai)", "value": "36961964b1bafb6dead8698add3a9d2cab40630a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524635, "uuid": "b6f74e98-bb6c-4397-b350-ffd69379b75a", "comment": "Malware payload (Mirai)", "value": "7abbf58b948bbdf1e51856ef9e0cdb897aa8032962ad2edc2fbaf3ad2996b1c6bafe4d1d31ee3f4a56adea58766b9a77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779524635, "uuid": "458eff4e-80ba-43ce-a8b8-dca3da2d2648", "value": "T186C39D32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779524635, "uuid": "1455858f-76cd-4fe3-9dd0-ef36af56b33e", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKLYMYaXgDe6u8KSgnMwSMwm9rFHwR:6f5Z5Z98XdmVMJaWaXvbjSqSMrHQwE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779524635, "uuid": "446b52ac-71af-49dd-9962-ea83319c37a3", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779524635, "uuid": "83831d9c-461d-459a-88c7-83647c4578f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779524635, "uuid": "536f96e1-e797-4f6b-a6a3-efb99f45c6a6", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b77a0e-5644-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779498952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498952, "uuid": "d277b7bd-2c8d-4943-bc3c-08bed33e62c1", "comment": "Malware payload", "value": "fd01922860b54585ebe1d990df4d29e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498952, "uuid": "1e909a15-42a9-431d-8cf1-21814674acf1", "comment": "Malware payload", "value": "10bbd20b2f26a8e93ac0c4df3cb4f9c6b984c40f64e93f80846439e7374d4ce4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498952, "uuid": "efcbe402-480a-4c83-acc2-b4985bfcdea5", "comment": "Malware payload", "value": "b9e103963c8953f279e7f49fd52fed0e032a885e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498952, "uuid": "cb9e855e-5e34-4f54-9535-cd219f36ad6d", "comment": "Malware payload", "value": "fdfb43c48afd5b8f353bab19606341234c78eba6897f85e2512a3eec99a0dd92f1b278409862d3bb908855df414f399d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498952, "uuid": "e937a095-4832-4ae7-b014-daed20c2eee7", "value": "T1AE136D6526953C25AE99883B5D7F2F0CBDA983E2304491DDBF8A3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498952, "uuid": "2d5a3858-d025-4218-8c39-1018fe0c2fdb", "value": "768:Br9NyXsZztCJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:5HusZDco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779498952, "uuid": "50047e69-ac2d-46cb-939f-de554122f441", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779498952, "uuid": "f8980883-6c89-471e-81ac-1f03cedff62b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498952, "uuid": "ca560298-b363-40e9-97f6-5826bed30257", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57abadc9-56dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779563978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779563978, "uuid": "c0086fd3-acdb-45e9-922a-46fd838c61d0", "comment": "Malware payload (Mirai)", "value": "41696a94d867ad324fc5bb6010d85004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779563978, "uuid": "c21c85a6-848a-4d76-b7d5-52b1fe05dd40", "comment": "Malware payload (Mirai)", "value": "116a87b8a4c7500a4878bff4b8a2fea16264247a70311a75704d00a2c8d110a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779563978, "uuid": "a70e271f-89e9-4ae3-8579-3462226bd3e9", "comment": "Malware payload (Mirai)", "value": "99e0c76798a4b40d30c0410355244a43bcfd7657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779563978, "uuid": "04ffc96b-7160-4695-b26d-8ecf2fce6991", "comment": "Malware payload (Mirai)", "value": "c3e4258c2628a27be8c53a96f62b2576226d3f453635ffaf02261f050ebd74b94dc51f14d93520e56c9b205738e0b747", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779563978, "uuid": "4ddffcff-4bbd-49fd-8f8b-72b8219cd9a3", "value": "T1AE144B46EB818A13C4D71775B6AF42453323EB64D3EB73068928BFB43F8279E0E62515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779563978, "uuid": "6c987f53-c7c3-49ee-805a-5f7466425980", "value": "3072:3UfQcoDCmIc5K1lRunsaAeUrllYNlx2q/eozHksCiiMLmk3j0M3:3UfkCmI91lMsaAeUrllYXx2izHksC3AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779563978, "uuid": "ed83b89d-1af3-424f-944a-ec2ab3431c2e", "value": 194343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779563978, "uuid": "8f67e2b7-72d8-43ec-9374-fbd5e41ec15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779563978, "uuid": "8393527a-eb84-44ee-ad4e-ac33c0b93810", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e9eaa7-56ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543329, "uuid": "3537d4c8-f9d8-4497-94a1-d77afda8b033", "comment": "Malware payload (Mirai)", "value": "261f527c7aa822a38d4d4de3458052a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543329, "uuid": "0ceb7991-543a-445f-be92-b9777c1d4b55", "comment": "Malware payload (Mirai)", "value": "126829c07ee9da211745e8fd6565a2b3b9d871dcd28890c28cb99c52bdf0b709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543329, "uuid": "b491f8af-6385-4d17-8a85-5fd29682e692", "comment": "Malware payload (Mirai)", "value": "c765cafbafaa6c2046ccf3af1545d5495f3914ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543329, "uuid": "5ea6240c-3363-4768-a245-a596fbc57d18", "comment": "Malware payload (Mirai)", "value": "206f6d62d0e7c496ca6b561411505688cfa8a9551e6ef187adfabc51dad6451552aad2ad69d4fda71f642bdb67cd7651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543329, "uuid": "0c5f54cd-568f-4e17-ac46-f4178a3b6986", "value": "T12C143B46EB818A13C0D71775B6AF42453323EB6493EB73068928BFB43F8779E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543329, "uuid": "ec15d276-9f39-4793-a3d4-a83e0d761a07", "value": "6144:dWenZCjtjlt2Ca2OqeUs74+2MLHML/KZmk3e0t3:dWYCjztda2OqeUs74+Na/2mkO0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543329, "uuid": "4d1dd1f5-ad56-47b0-b378-b5218c990b63", "value": 196881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543329, "uuid": "ef82fc7c-59fd-4ea3-8c8d-e803acb5b50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543329, "uuid": "a880183c-5a58-41b7-a0f5-e57b16eafa13", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef727c08-56ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544047, "uuid": "683ce39d-4bad-41df-8881-decadd9bfcfb", "comment": "Malware payload (Mirai)", "value": "038804e50546c51cd4a8843a8e11c3ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544047, "uuid": "9e218976-1b9b-4d1d-9703-30a47ccf280b", "comment": "Malware payload (Mirai)", "value": "133e43c48c330e06083981a13a6991ed97c009e75083e037e01e333d592392b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544047, "uuid": "cae7eff7-7bbf-4da6-880e-df06277ed452", "comment": "Malware payload (Mirai)", "value": "bd641b080296e892748b10a474423c891619a43c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544047, "uuid": "9d11397c-adfb-4c17-95e9-0a7f69391613", "comment": "Malware payload (Mirai)", "value": "51947b9c1571d924f9abb818bc7b440128b39af294298dc16f21c329a71b343207e573d499f93945c6192ffccf6a1477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544047, "uuid": "2ea0b0f9-3c61-4cc8-92b4-8617b522a210", "value": "T19F832880FA4781F5E95708304077F23FDF32E56A8070D66DEF9A9E25DA33A41A316399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544047, "uuid": "86030d24-0904-4971-85ba-8c66fdd07d64", "value": "1536:Z3ouPlV4jmtUAHHp1rjVMGR6k8JHa+cTjhM+JbzW3MGnJ/cPPjub0GN:J/9V9tUAHHptRR6dJDcTlb+cGnJi7YpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544047, "uuid": "97cdc451-81e4-41e2-90dd-b9583b874a11", "value": 83020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544047, "uuid": "8e391ee7-1880-4b30-918e-19d950f18d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544047, "uuid": "a91b1b09-0288-4088-8557-ab657705a0ef", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fb9362-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544412, "uuid": "c12a5f03-12cc-455f-8508-db4d0dc658ae", "comment": "Malware payload (Mirai)", "value": "b83f770ef0e3cd8ae03670815a76b4dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544412, "uuid": "4dce9c79-7fea-49b8-a0ec-a3bebdc487ae", "comment": "Malware payload (Mirai)", "value": "139228accc9803603d54a34cf75e9251dee52dc7bd5a91d871e76d092f9c68b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544412, "uuid": "5258ceb4-934f-4ca1-8ccb-f108974f55d9", "comment": "Malware payload (Mirai)", "value": "9edadc9071e055493a49b6756cb54f1dfebf7b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544412, "uuid": "40afd667-0eb4-4ef7-8f09-6ebbf8570f97", "comment": "Malware payload (Mirai)", "value": "6d3f7afc79d78a9b6eab5255c20e68f0c6b4bbd999ff0da7fa07ff88c0183c185a57081448c8ed41a2aba4d98bc7db57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544412, "uuid": "7b970d15-c1d0-4049-bd3c-bdc41a131015", "value": "T1991301A8585A8AE9DE20127253EC3D5FC6F03D414B4A3A4973CD3AF05EF710A8E35163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544412, "uuid": "f643458f-51db-4355-aebd-4568d2e90b4e", "value": "768:FHsa5QDovTv4hh6NvMZf8u+Rjgyvh+hXNCWQdYU+XjKhXI3Wiz:aa5ooLvUh61QARjjv7ZcOlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544412, "uuid": "4e33aa16-aa76-497b-a20f-4dd8a6187a15", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544412, "uuid": "d218cb7c-f4ad-40a3-9549-a6f83229db13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544412, "uuid": "66402eb8-3c76-4cf8-a439-80856761cf3c", "value": "luxzz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d6cbee-56e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779565851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565851, "uuid": "6db389e5-b4d5-44ce-baaf-376835e59900", "comment": "Malware payload", "value": "47529c1928858959aff9b1cced5b0d16", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565851, "uuid": "1ed8e1d4-af1c-4362-b709-731ef3684a56", "comment": "Malware payload", "value": "16007cfdf1d0fdd3c004ea52957ff97b88c31f7d880be88822325c48b4504c56", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565851, "uuid": "e35c457c-9bf1-4aa6-8fd8-fb7944daa758", "comment": "Malware payload", "value": "86fa58490dd065c4e346278640d91d24090420d3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565851, "uuid": "20485d67-5af7-48fe-b7a9-8a73879c4738", "comment": "Malware payload", "value": "a86cd8401b5f5e362f85574a4872ea886e1fca58d7c0bc0908ac9c767be29760b3620f72a47c9bb62b7d7f286bf71e2b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565851, "uuid": "5fbac5a4-b209-44c9-900f-9103933d078b", "value": "T1E4C6128674A1C5FCC845C530E2491AFDE0EE78594DBC5A3A7FCB881265B0D98C8F9BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565851, "uuid": "07f62cba-14d3-47c8-a79b-73646c5690e3", "value": "64a82792ae217a318cbb528c890e0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565851, "uuid": "2959ddd8-8a11-4e93-869c-ab3ebe079aca", "value": "196608:KT+s0zA2aBQGFItGSvhu29I5SF+95vMxfI9MS7j6Fv+nxCjuvg4bvyBA:u6bwI6yIU+j/MSMGnx4Yrbai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779565851, "uuid": "6ea0d771-c167-464e-9b02-86de730ba7e7", "value": 12000768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779565851, "uuid": "f472d5d8-1dc4-448a-a936-ca5711a1b634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565851, "uuid": "67542667-b39d-4843-ad81-bf17f3aa03b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cb9e6b-5678-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779521153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521153, "uuid": "6bdc4172-0a90-4f52-89e2-c314bbb28b26", "comment": "Malware payload (Mirai)", "value": "d3d757fa15eb8297ee2376ade2d9a6dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521153, "uuid": "f9191608-deab-4feb-bf31-392b7e6a3b0c", "comment": "Malware payload (Mirai)", "value": "168913763cbd04ed8164675b4b180eb7bdc7b10e7df5c1f57b2067451b4fdf08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521153, "uuid": "2af6a98e-cd58-44a6-9810-d172dca871a8", "comment": "Malware payload (Mirai)", "value": "b442d8b1199f7ff0fdbf315d4de5a3ecf5a45454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521153, "uuid": "1f570326-e928-48a4-90c3-140c83a0f0bf", "comment": "Malware payload (Mirai)", "value": "9d797c024eb936632b82e41f7161b46f9ae72ff8338e483fe31ad93d9d7f05c9f5c1218f4682be92d6afca15f71399b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779521153, "uuid": "b7233414-3857-4ced-9cbe-3fabab8ac54d", "value": "T1C793D551BC82562BC5E423BAB6BE668D336577E5C2CF722BC8214B117B8551F0C63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779521153, "uuid": "2363f5ad-8a31-41e2-9ada-9d7c2f80bce0", "value": "1536:Ud+d+6yn9H/NTzULgW4W2luLaN5q00brz9ikZcxew+7YY1:++dAn9eL6w0ecxetd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779521153, "uuid": "e11c7695-8512-4190-89eb-5d416b1a18e2", "value": 93800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779521153, "uuid": "110a00f0-f561-4615-91c5-9ff4c33b3e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779521153, "uuid": "5c0bd049-5262-44ce-94c9-f36ff2101b6b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce67edda-56f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779576633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576633, "uuid": "9ab55b8a-dfc9-42d3-a889-56d2ed8aeb22", "comment": "Malware payload (Mirai)", "value": "caf10d63df6a4fdb114f844db7af1dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576633, "uuid": "a43fa170-0b34-436a-9593-188a9c384747", "comment": "Malware payload (Mirai)", "value": "18d2b705487de081c5ad70cde6ecdf9808854f8c991c093546b65e7433d97a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576633, "uuid": "eba80a94-89d3-42db-b5d1-b2883bbddc25", "comment": "Malware payload (Mirai)", "value": "cbc95ed5a074424c6548bbf5932fa023544f71ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576633, "uuid": "b1b967f8-e138-4000-afb8-4350ee6df855", "comment": "Malware payload (Mirai)", "value": "408afb153e5cdfab57b12ab99dc06045172f06afdf32605f9e619262b2f35a10fab87c10e7e451d5dd73f95bcd1075b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576633, "uuid": "ff2684ed-14a0-4904-9b3e-2aeecbfd110a", "value": "T1FEF33B02BF600EF7DC6BCD3716F61B05258C591A21E9AF3A7934DC58B58F24A66E3834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576633, "uuid": "4ee4119f-a647-42ca-bcbf-1c6e9b570ee5", "value": "3072:WOWe15b3hfjU1h9C0+XQ+3+rzjDLT7jm/BXRkpTPX1wmT:WOW65b3xg1h6HBSR1wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779576633, "uuid": "79c13b03-1c87-47b3-8d7f-72449dc3b540", "value": 157832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779576633, "uuid": "c0c81254-0f2f-474f-9fa8-4b7f6d896c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576633, "uuid": "3de02e46-96e2-4028-8a1f-c396fb9873fd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b97762a-56c7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1779554992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554992, "uuid": "490e6f44-5698-416d-a886-5454a67085c0", "comment": "Malware payload (SalatStealer)", "value": "aee4431579b6a0bbabe55e3e5113af39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554992, "uuid": "1997d169-d01c-4364-8e1f-510778d1c66c", "comment": "Malware payload (SalatStealer)", "value": "1963aa0f51baebbc5f9a04bf57e0358dda6c80e16055a9654bf9a4cae08b4415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554992, "uuid": "d42dc8e6-fcb5-42fc-a6b7-aa4b81b67860", "comment": "Malware payload (SalatStealer)", "value": "c3c8ddee1d679cc2d7a6ea93997a199a59c48f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554992, "uuid": "8c408608-e183-4f70-955e-496ab75ca77b", "comment": "Malware payload (SalatStealer)", "value": "40996a6d0d59d63d51fe998b029c5092336b36c5e08855c27b102532700fb40d29df6522369effb0b2ffd336ac13d967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554992, "uuid": "61ff4fff-1f63-4b22-8798-b69dac60564c", "value": "T194F53369C7F136E0D3063F3C2E729F15015FC7552B897816916F8A603389AF5BA2C78A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554992, "uuid": "8ed375df-b0f3-4cc6-8515-bd30708ba312", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554992, "uuid": "f92416a6-c4e4-4335-8312-ec954a4f3393", "value": "98304:PR+T8CsDTT3OOStwvhOmn2jNwJL5NE0XSyzzCx0q4zxD:PR+aDfZStc+jNcL5NEnu8Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779554992, "uuid": "c2114604-a772-4f49-877e-55fb682b0fb7", "value": 3597312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779554992, "uuid": "89944087-ce5e-4955-8a57-634963e55c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554992, "uuid": "9f2d53c5-1484-4e4f-9bb8-0b8202d3d792", "value": "Dior fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c6f4da-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551860, "uuid": "1265216e-3172-427e-bf58-43a10f819ee3", "comment": "Malware payload (Mirai)", "value": "c840d0367e6e4a5ef152b32ac5917c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551860, "uuid": "dcf75f9a-c767-4c85-9624-97e3b091e026", "comment": "Malware payload (Mirai)", "value": "1978d1201613ca6db2abdd7a6d7633d84e5e1f9e5e01da9f1a187d2aeec9d739", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551860, "uuid": "7e2686dd-2ab6-46b5-b920-7fc789008011", "comment": "Malware payload (Mirai)", "value": "20540d28e28c47c1f4359e89f335281a57800720", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551860, "uuid": "ba66ba3e-7a40-43f2-a0f4-ac41375162bf", "comment": "Malware payload (Mirai)", "value": "5529eaf080449c0061238f78133bc0e8b026f72e24406b7eb052510125c9adf7f4ff44baefcd424b1c9f924a6bb091cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551860, "uuid": "a2622d63-e12e-484e-a059-1a7ebdfb0c19", "value": "T1AA266CA8BC1CB552DEC87AB43B6541D5B235FC48AF41C7277614BBADA9F23548F22320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551860, "uuid": "a17916c3-6267-489a-a97f-043e23222f91", "value": "24576:nDNK6Fxw1aDV2IDWZrH2+6wM16tIoRbTCcAHbnSw2sOk5cvE7SCfTqXk59yjybza:nDdwl27DoRbTCcS92sOds75EyEVPvVfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551860, "uuid": "2a372b0b-5363-45e2-8f8e-6e6ac4b0e91c", "value": 4849816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551860, "uuid": "1df6863c-beec-4269-9271-0f20b946bbb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551860, "uuid": "76ced9c6-0843-4460-94cf-cfb12b948a4d", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e856d1-56aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779542427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542427, "uuid": "462b2a75-11be-4c55-bf62-50e6b9983b8a", "comment": "Malware payload (Mirai)", "value": "0877f0d23f05b9dc0933204516bdcd73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542427, "uuid": "fab63c39-9ecf-4408-984b-49baca5a366b", "comment": "Malware payload (Mirai)", "value": "1a5c6ef07fc3a96b9373a156142558bf001321e36d076cc36edae15760766c99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542427, "uuid": "d43ff1c2-1d61-4b79-aa04-c52856c3853a", "comment": "Malware payload (Mirai)", "value": "6bf3a3b368709e82760c630eb06752f94a72a0e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542427, "uuid": "9d17b6e5-5309-4dcf-8a7f-4a920790cc3b", "comment": "Malware payload (Mirai)", "value": "bfaf57558c0b91411df45706fd4540c3f17225ce5902c78734104fb2c7ae6b563b2a45be68171e7c0730e8244e2135b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542427, "uuid": "9bcb99f8-49de-46d6-b080-edb63e2ad074", "value": "T1CFB3B309BB610EFBECABCD3746E9170525CC552B22A92F35B538D828B14B18B1AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542427, "uuid": "07794aa0-7408-4338-9f59-7a9a237d59ee", "value": "1536:a85NDe5qWz6SJGHB0MKEsJ0ZCVQMuftMJZRuikM4fWZzMQrnpCylsT:agNDe5qWNqmECHuikluSa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779542427, "uuid": "57367eb3-213e-4a15-90bc-af238a22b1d7", "value": 115724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779542427, "uuid": "afe9a28f-a4cc-4ade-9c63-d76ae7c9fce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542427, "uuid": "f30282d7-11a5-4828-bf59-9264df50f03f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec79d90-567d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779523188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523188, "uuid": "ae4ab759-2512-44ba-aed1-6856b8dd3ebb", "comment": "Malware payload", "value": "fc0fa8cf054f8dc4d8025a1d25c5d75e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523188, "uuid": "ce7df662-feae-47b6-b47b-503d6cf0128f", "comment": "Malware payload", "value": "1a62f6ae3a54ae13e206c8b0b9a333bbefdaa1462de784fb233077c4f0bde12f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523188, "uuid": "44b19e38-b60f-44fc-8a37-88f120873330", "comment": "Malware payload", "value": "479ee424ea2d050839e4028f9de6b5bd5f22c5a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523188, "uuid": "d92e6b55-1fb6-4756-b7b1-58e5b893fa70", "comment": "Malware payload", "value": "41fc59f1336cfb889fa2681310793ceae33c58cb02b4b9254fed153e9edb5b06505f1429a51e0bb05572f4b09718e937", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523188, "uuid": "74b78349-9cfe-4798-a04f-bf0216aef32f", "value": "T1FFA0126802F51902150CC81121D000291214E0C034D0C133D0187A5120825093841549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523188, "uuid": "3945c563-c396-4f2b-980f-0b377e7605fb", "value": "3:AjOh5gXVRL/L8ApHKJGNIaoLKJ4Kv:VSP/np0ax4KJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779523188, "uuid": "d2db798f-b817-4a53-ad6b-5c74e42c5ff6", "value": 83, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779523188, "uuid": "76725a60-b037-4b1b-a4e2-ff162152b349", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523188, "uuid": "d20445c6-9fd3-4f64-80fe-fabe0a791613", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4ac969-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541199, "uuid": "d91496e0-9311-448d-8644-bfe1eba136bb", "comment": "Malware payload", "value": "470a90a81a400ef50f41cc3b3738de89", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541199, "uuid": "ec4377da-50cd-4a8b-8823-bf019300dd75", "comment": "Malware payload", "value": "1af2f129e63043f6531afb771ee7b731ebc38cd95fee5b85fdbec2cd9803dd56", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541199, "uuid": "854bbf5a-e95b-4a49-9d60-2cbce8a23e22", "comment": "Malware payload", "value": "303013913df3ace3ea1f2b2a5cdaa322c200c9ea", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541199, "uuid": "bd0d1bd2-8e4a-4a08-ad09-ea646fa5f4c5", "comment": "Malware payload", "value": "dfa6548cddc5a4f40b19c4c530aee79337a4797b866c2c6228cc49d0245c26fc15fc5c161ff5a5a5de2ac733f5dfab6b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541199, "uuid": "e66afef7-b55e-4cec-9d65-8a7832ab2f5a", "value": "T12032BF6BCF391DE76813978218D6E521AB950DE9F6CBFE23300241420872EB1AA6D164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541199, "uuid": "74c4584a-638c-43e5-a251-6c2944418b3c", "value": "192:hlQJAhfF/GBiF97SiE0u8JgU4ZMkQSzX7rDtWtl6zNKrH0iVV7zNK:LXGe8i1z4ZMQXTtWv6xKTBjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541199, "uuid": "b6bc5f6e-6669-49ae-89ba-2fe7b96848af", "value": 11469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541199, "uuid": "d5820d9c-765f-4898-a3ed-3da2ec047467", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541199, "uuid": "745d07bb-6ce5-48c9-8eeb-9c70a3ab53f8", "value": "DHL Shipping Documents pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cd9ea0-568d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779530151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530151, "uuid": "3b15149b-7295-49b2-9774-0ad5e27d3550", "comment": "Malware payload", "value": "f81a07c07aac2e23fed4615f88e2e8df", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530151, "uuid": "6fcff4a0-4134-42ce-a9dc-58e3427eca22", "comment": "Malware payload", "value": "1b8fb08f6b44d184457660dbee4f572c60bcd80d6443ac8355d08dea6db19bd0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530151, "uuid": "3afd48bd-3869-4959-8cd9-804c58778148", "comment": "Malware payload", "value": "22209d2b5ef462791c424f780a89377f717bbddd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530151, "uuid": "e5767638-755d-4930-b34b-6df08f465354", "comment": "Malware payload", "value": "7c59ad6a2fdec5cac02f3641fd6550dd2462bce598e1a6096f0cca97858457ff003c3dbe0c072af917599968411a2d62", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779530151, "uuid": "43470a0f-5461-4a5f-a951-1f0cf51bced5", "value": "T18E4173654FDCA680D10E6DF3ED4B236EEA12EFA1F27D07210C609C30258A05997D245E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779530151, "uuid": "d2e2923c-9f13-46a4-931b-8db934579655", "value": "24:9XFaqpxJGkPC4iEY5jgSp42DrOwNrX79eKeRYSZa8FadxJGkPC4iEY5jgSp42Drw:91FM544qL2Nb7U5R544qL2Nb7UXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779530151, "uuid": "fd312044-0ef4-4b66-a9df-a07dda09d511", "value": 1966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779530151, "uuid": "74b20e65-eb87-4e6b-9c2f-0143ccb1b2e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779530151, "uuid": "7ad069fa-bca0-4a5f-9477-9c5bac06f792", "value": "RE Freelancer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb69b5d-56d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779560095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560095, "uuid": "411708f8-41e8-459b-b928-89db0a963546", "comment": "Malware payload (Gafgyt)", "value": "962e64843b77a73589ae30f865fb0f60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560095, "uuid": "09ddaa5d-aa49-4ace-9402-29ace3040324", "comment": "Malware payload (Gafgyt)", "value": "1c08cfd3e7af0d11f17753613fc47ce8bcfd90c938b75af5adb079fdfbf0ee8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560095, "uuid": "8e80d5df-9e93-4617-9a2b-b4bba810d1ae", "comment": "Malware payload (Gafgyt)", "value": "6bc57d9173368c33ad1079571613ccb1668bb183", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560095, "uuid": "b536ba7c-36af-4689-8928-003d0e566ba2", "comment": "Malware payload (Gafgyt)", "value": "45dd940492eaa81136ae4f8ae5769d26ecde183f5171f166c4f39b1abab1cdb7f79a928a4f6fbcc3f094cbfdeda6c23f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560095, "uuid": "9b53c38d-c57f-49b9-b527-1bc26263a4c6", "value": "T135C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560095, "uuid": "5df2be98-1bd6-4138-a6be-3dd09f2594af", "value": "3072:6jVlyaL5JCrIpv04swbttiEiTmP46aQyfPlfKsNb:yoCJCN4swbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779560095, "uuid": "465b53bd-060a-4905-91f0-ff8998c2bd3b", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779560095, "uuid": "bb5f1d19-02a1-4634-91f8-acb6c57e9e51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560095, "uuid": "a0ea2395-5192-4122-80d0-bbfab4d440ab", "value": "1c08cfd3e7af0d11f17753613fc47ce8bcfd90c938b75af5adb079fdfbf0ee8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3296c0bb-5702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779580237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580237, "uuid": "c7146d5f-52bf-4acc-bb75-a47af8a6289f", "comment": "Malware payload", "value": "45113959b6985616be7ace9f4196a5c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580237, "uuid": "7f1d86ce-a76a-48fd-a0cd-fddfe7cbb9db", "comment": "Malware payload", "value": "1ccdd5b0fdcaa8d45b4cfd203fbde1c00d554153344aa2d01ad689017347acdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580237, "uuid": "26fb8b80-04d2-4e38-b425-532f49696971", "comment": "Malware payload", "value": "600285190f6254c17d49719a14f05c56fb42452e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580237, "uuid": "e5b84803-be03-47b5-8b8b-ceff6b7d80bb", "comment": "Malware payload", "value": "f73bf8c575a01691f710698d261e55f59d519d47e93463b72bcc3f64972fd09a5074cd0d04c53fcf828dfad64a8133ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580237, "uuid": "ca7d2f38-a046-4b5f-94f5-2b671743bd03", "value": "T14AE733B53ECE1A9FD01832BE26A2D113438AD954FAA4C6E1BFD15C4F9D8FEC18C46245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580237, "uuid": "d83c225a-0a51-4812-8e95-7be3f96f070e", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580237, "uuid": "d4cd45af-4eba-4011-aea4-bb7515daa5fa", "value": "1572864:y6aYPZ854xLpNgDDoMGU/esIuLOz4tc4pNtSAxpfIaG:y6aO854ZMDDoMGoe7ea4pPVpf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779580237, "uuid": "b2b63aef-cea8-4963-901f-6a74c8a27a6b", "value": 64854090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779580237, "uuid": "bf2bef01-7e13-41a1-94eb-b18d3ea8387e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580237, "uuid": "ce8368a8-4f5f-4078-a3fe-cc60f1dbd01f", "value": "dingtalk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81206a64-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497046, "uuid": "c53c0e7f-46ed-46bc-8767-d35f526d1693", "comment": "Malware payload", "value": "073139f63e06ee402e51b129b904fe3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497046, "uuid": "fb5595d6-ba8b-4211-9fb0-2e93b9d1a629", "comment": "Malware payload", "value": "1d9ed69fbceeeef59aef703cc1f714566a2e23b95c4e9259379e88378a657de3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497046, "uuid": "c2aca07a-2b19-4698-934e-050d2a34d90e", "comment": "Malware payload", "value": "3ac6ed7abec9af81bbea84df3c8076fe211fef20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497046, "uuid": "b2ede7b3-b6ce-45bf-908d-a6f13301115e", "comment": "Malware payload", "value": "bb8892aa9647e41fdef47a48a6ab11f08b3cd1ee3177be57221e69b99d6f1107ecd173bd4baf808a75aa32ad3404ecfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497046, "uuid": "85ea3a13-40a8-425a-b1ee-c04d93a0d880", "value": "T14415D066BC419A52C4D0267BFA6D8198330313BCC3DA750AED15CB3976EF98E0D3AB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497046, "uuid": "3254d832-4ee6-4462-9e96-ec1aab64dc1e", "value": "24576:DlDdzDnSc3NpP7d4eC3JqYu4+db8zi295R6:hd7Y5PJibgi296", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497046, "uuid": "3463a999-ed0e-4395-8e0f-8ae873e69ac2", "value": 884147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497046, "uuid": "732c3d40-46f7-490d-9301-59f3324c983a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497046, "uuid": "f8b1c00c-4341-4acc-9248-dfebf01416a3", "value": "uasvdmt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a7ada0-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520220, "uuid": "ad4a8390-d385-49f2-a888-38029c91986b", "comment": "Malware payload (Phorpiex)", "value": "42f27698d7c3f88317081d153a2b92ee", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520220, "uuid": "df75602a-346d-4f9e-99a8-9be0ab57ed00", "comment": "Malware payload (Phorpiex)", "value": "1ea9d58808e4695d37823d3c53c9ec96ea78adb64a130b41d6fb2ed8e7164264", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520220, "uuid": "268382ce-3653-4507-93db-03c6a24a0fc8", "comment": "Malware payload (Phorpiex)", "value": "1bfc5d909447a8f083e596cd8c694d0799a918c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520220, "uuid": "33930d4b-b0eb-41cc-af25-162a5e79d38a", "comment": "Malware payload (Phorpiex)", "value": "1ec409b5ff7b98ae9c502f2e7904558b2e2ab6759e41c9968adfc117592ac21280e1ef0726ef3cc29c53d704e0148759", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520220, "uuid": "831c84ac-87a1-45f4-b2ba-27018e8bdade", "value": "T1C9824B0FF9814216D1E100B05675863BDAB99C72338854EFF7D48A9D0BA86E6FC3221F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520220, "uuid": "1e84082e-e343-4a47-a1f4-b1df72a8110c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520220, "uuid": "6064328c-74cd-4c2a-b561-54fbd6274277", "value": "384:yYIJlVYer7bskwEd0ZHu9JgiL7QWav8U9ckW:Ig80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520220, "uuid": "ba9ce453-5955-4e02-a8e9-b1feb23cafd4", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520220, "uuid": "a05570c5-c6b3-4a1d-837c-3c7c33908d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520220, "uuid": "02a3b336-1495-44e9-9ca6-9314d5ff6c37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b759da36-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520330, "uuid": "934c10aa-3780-4c6d-9047-18abaf2cd163", "comment": "Malware payload (Phorpiex)", "value": "dfba4ce11fa19548f91749cdc35e6539", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520330, "uuid": "b7dc0dcf-175b-4d23-a9cf-56c4f3a077ff", "comment": "Malware payload (Phorpiex)", "value": "2226312333e0450d82c5785f26fe6da3032e23075988d551cdf7f3b15390c10e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520330, "uuid": "fd7ef7a7-375f-457b-acfd-1fc8cab86b38", "comment": "Malware payload (Phorpiex)", "value": "0ba3fb180a1a8bb80ce528beba342bb19ec6d166", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520330, "uuid": "67d20cad-bc74-429e-9892-ba39ae865f27", "comment": "Malware payload (Phorpiex)", "value": "3bd000d8ded5bfa897d0d2f358073a9230ac57cadb9a4593f4e6f94953c6eba3ecc63d014c7e85c821be14f6665c285a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520330, "uuid": "123716e7-2c9a-4e71-81a7-54abffa9690e", "value": "T17D824C0FB945421AD1E100705276867BDAB99C72338454EFFBD48A990BBC6E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520330, "uuid": "8a397925-0923-4666-907e-a6ee27ed399c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520330, "uuid": "5b6264d9-f86c-42d8-9ae2-e8e2bcf61d9b", "value": "384:QYIJ1V4+brLsEwoNSZ5Hu9JgiL7gWav8U9cA:eQIUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520330, "uuid": "5305ceb3-8e17-4778-aed1-d26f48696365", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520330, "uuid": "ebb81e81-2f81-4322-8262-03eec986a75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520330, "uuid": "7ea8c96e-4b9a-456c-83cf-136ed4f4c350", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3177821c-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779537715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537715, "uuid": "fb5b7ffa-d331-4e24-ac73-8076a409b89d", "comment": "Malware payload (Vidar)", "value": "418d7cd437026cac0723d9af519793a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537715, "uuid": "54c7dfcb-6609-47bb-b59b-891f9ba540d1", "comment": "Malware payload (Vidar)", "value": "22d002bda592d0e72584e2920aec3281b19912fa13fdf11e1360f76f14d1d842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537715, "uuid": "0aefa410-cfdc-47f5-99a4-fe339c717239", "comment": "Malware payload (Vidar)", "value": "0e533c42bece0e332aa73ce32bbaf0d8fedec8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537715, "uuid": "aa3b6d85-14b0-4f8b-8ab1-bc421e6b911a", "comment": "Malware payload (Vidar)", "value": "f3d82e209e2ee6e5d154ded0f294ca15a1f6ef07a447f8586918a3c628ddc7a503c8deb2674c5d950a0d914b4cd6479f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537715, "uuid": "7d8f5d62-0c36-4bf8-86fa-04e856410530", "value": "T17AF47E15DB2393D9F83BC037D176A7A7FC70BC568228DD3A5AA00E4566A2621723F317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537715, "uuid": "b3e2a767-c860-4d7a-8ce2-449f0ded6d4a", "value": "2d036fca5fab0c142790dd9967ceb56d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537715, "uuid": "f95aaf05-838e-446b-86ad-5ba290b55807", "value": "12288:nioGWXlDx7mgsrNEZd8W8mgM7DVm1oixAw3B9Vhyt4cv+DNcz+1lAwb6N:nioGob7mgsrm78WH7DVlyAwlhyt4cv+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537715, "uuid": "cd9d8ef2-13e9-43f9-a24c-965f5774c1f1", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537715, "uuid": "6339c1f4-a0d7-46be-9cef-d8c9c738698b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537715, "uuid": "41e0aa6b-fd39-460f-ba8a-a954509217a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16acd8de-56bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779549696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549696, "uuid": "26c9d46f-b5eb-4d42-a79f-95485633c1b9", "comment": "Malware payload (Mirai)", "value": "8811464a7762983ec4f2ab6e6691b50e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549696, "uuid": "faca0250-a087-4359-98c5-dc4d49751e61", "comment": "Malware payload (Mirai)", "value": "237effca2382491b4deca2a965ce2a834a4a8168f46bbea1bb16c96bb10182bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549696, "uuid": "bedbad00-5774-4239-8efd-1bf516a62b62", "comment": "Malware payload (Mirai)", "value": "fe66d62c3909a7eec759c07c8eb608762c5864f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549696, "uuid": "4cd350f0-10c8-40bd-94df-aec45994abe6", "comment": "Malware payload (Mirai)", "value": "bdf28ee7c1258f069ba8e08ec66c60584b112bfb18b40e17201ccbe19fc6e0a8a5f3f2ccae6ebb2a183eb916253135d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549696, "uuid": "cf1d3134-1ee2-4356-9356-d921130cc66e", "value": "T121143A46EB418A13C4D71776B6AF42053323EB64D3EB73069928BFB43F8279E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549696, "uuid": "22f9bd24-1ec0-4aed-8392-f49d5eaf8795", "value": "6144:MlOn1D2llto+ia3+6e0s3eyVilHMsCdmk3e0t3:MlMDktga3+6e0s3eyc/emkO0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779549696, "uuid": "9a606ecf-594c-4a8e-892a-8cf949ba4274", "value": 196881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779549696, "uuid": "a6c164a0-ad69-42c5-881f-bef82b008ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549696, "uuid": "50674081-6dea-4002-85bb-b961f89fd3b7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e8090b-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779544405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544405, "uuid": "54e404dd-8fa4-48b5-b2f6-06004a58bbec", "comment": "Malware payload", "value": "32331148bcad36ffb07813ab67cf34e2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544405, "uuid": "5a8f9b84-7baa-4657-8265-95232244436c", "comment": "Malware payload", "value": "23a0d96a978b07f063dfc4e1c957906eb5623a1a035192404c7fb3bf7d8289b5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544405, "uuid": "1a983101-243e-4485-bd6a-89a229bcd637", "comment": "Malware payload", "value": "bc047962780d8ae01f7c6c7f3529676dd8a815df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544405, "uuid": "8e922e37-391a-4f28-bdaf-2afc091ef671", "comment": "Malware payload", "value": "fb9c5a9d20142bf9b3bba7169c07eccdf9bbceb83cc9cbe1940ee0be4d42d1eba1379926544e55922d03d8ab0beef281", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544405, "uuid": "245079f5-148a-46dd-b775-5da92c9141b8", "value": "T123137D6966857C24AE9D883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544405, "uuid": "5c1f079f-8faf-4ecc-83ce-afc4624905b0", "value": "768:F+k9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:F+Jco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544405, "uuid": "64019716-23ae-4cab-95ed-980322133419", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544405, "uuid": "48fb3a4f-d1ef-49c0-984c-0e9f150ff20f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544405, "uuid": "d003a80d-861f-45b9-ba70-e4d0885b261c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a602e08-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520201, "uuid": "a4ab9a80-7cfc-4445-b16b-3ce451144624", "comment": "Malware payload (Phorpiex)", "value": "68bf9b000c247e1b67eb539834ce8a6a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520201, "uuid": "7cedd191-5574-4690-bfd2-a9d0f9e57ae5", "comment": "Malware payload (Phorpiex)", "value": "23a4b7fd2cca9d6942a1962288b9c21ad5ecf11d4aaa5b9ea74d71e1ad52bf1c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520201, "uuid": "c3a1ed0f-ffe0-4669-aeef-8a5ca68bf159", "comment": "Malware payload (Phorpiex)", "value": "2ec5090357a24bdbb7acfa4aa168e2d9e65bfabd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520201, "uuid": "956d1fb9-12f8-4f93-b633-77f98cbac702", "comment": "Malware payload (Phorpiex)", "value": "ce620d437c321163243bf3644512ca5f5027fc78f4a41048f27dd3170c1bdcd8c891cd8668edfd8d6363ea8641c45300", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520201, "uuid": "d6b4c026-1f52-4baf-bfa6-0af916522bd0", "value": "T1EE824B0FB985421AD1E100705276867BDAB99C72338414EFFBD48A991BB86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520201, "uuid": "3d2d5e70-c3f1-4105-a5f5-d7afe0cfd44d", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520201, "uuid": "0dde470d-9f47-4881-9511-951b457f60f3", "value": "384:EMIJ1V4+brLsEwsNSZ5Hu9JgiL7gWav8U9cf:CQUUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520201, "uuid": "98d119b5-6ff7-4aed-8eae-d27c081631a3", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520201, "uuid": "214aa65a-6051-47ab-bd91-db36306d8f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520201, "uuid": "52ef914b-dff3-408c-8083-3ba99ac9922f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce58d9f-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520340, "uuid": "d75eda1c-f997-444f-bd14-6219ff1ed31d", "comment": "Malware payload (Phorpiex)", "value": "969489de78bb09dd51f5a77441fa6c05", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520340, "uuid": "b09da42b-05a8-4b28-bcf2-17e8a4126f36", "comment": "Malware payload (Phorpiex)", "value": "2419152d838e8bd72b6971582e475954c0d4416e786279082148cb9a5eddb017", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520340, "uuid": "081d7e1e-bdc5-472e-8443-1922a9efecc1", "comment": "Malware payload (Phorpiex)", "value": "0d8b38218cc432a70f13c635a87ca15b74c9acc2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520340, "uuid": "57b6e33c-761e-4025-aef4-b1c2db7676d9", "comment": "Malware payload (Phorpiex)", "value": "1b427b730970027c3e239a02c287aedf8767636a46d3272cfb60526ef899355bb2921f5fc2508e6375165803b719588e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520340, "uuid": "1f9c7d6a-9b29-40e3-ba47-6fa3b9f825bb", "value": "T134824B0FB995421AD1E100705276877BDAB99C72338414EFFBD48A990BB86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520340, "uuid": "24fa0caa-2d47-4350-b3bd-16f83a0a7ee2", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520340, "uuid": "63a927b8-8f6c-4769-8055-1c6f72c4bf95", "value": "384:dMIJ1V4+brLsEwENSZ5Hu9JgiL7gWav8U9cc:JQMUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520340, "uuid": "c3857363-786e-48f8-aea4-77aefecc27d2", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520340, "uuid": "e0ca6fa5-3dab-4cfa-91b3-e9edf864f9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520340, "uuid": "e0eff2f3-4112-4afb-836f-64f668417067", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6b5602-56cf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779558319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779558319, "uuid": "66193acd-bb79-4375-8af5-3d73be44abe3", "comment": "Malware payload (AsyncRAT)", "value": "32fa5ef4fb5ae4187037d525ae71f7fb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779558319, "uuid": "f7b5556c-5d22-4c9f-a764-59b5e4f74284", "comment": "Malware payload (AsyncRAT)", "value": "246a980b622b251ac79105dcedb1371747ab14e4f57f28923956d713d87da671", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779558319, "uuid": "745add82-01db-407c-a74f-f3e5f1d19374", "comment": "Malware payload (AsyncRAT)", "value": "67ad4853b9789b09ee14bded0e2e3efdc133baec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779558319, "uuid": "d576c5c1-16fb-45bc-a09a-2d839b47c1b7", "comment": "Malware payload (AsyncRAT)", "value": "6614a5e4bbbc9e18654ce55df2ad6f74795231675e742dc815ae30528b8bb838800f03330b4fa820d2d0af0607ee4e50", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779558319, "uuid": "fd52dc3f-d12d-4448-997c-90863b39d2ef", "value": "T121231B003BE98126E2BE5FB89CF1514187BAE6633603D65E3CC841DB5B13BC6CA516F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779558319, "uuid": "868f1e21-21f4-49cb-8126-b3a5c9a75e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779558319, "uuid": "57ec6500-7d7a-49e9-9ad4-f62b0ef37b96", "value": "768:YCq/z5bX/wPLsekOicvHk3eHlWMPbPgF0qcUnJQGKLPxI0s6YI6OC22tYcFmVc6K:YC7seXvZH0ub4FrPJQXZTZ6O7KmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779558319, "uuid": "9154077c-001e-4124-aa9e-adabb5c463fb", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779558319, "uuid": "9f619cc1-33e7-4e99-8fcf-dadd006c98db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779558319, "uuid": "408c7e40-dee5-4843-b35f-2edfcf766468", "value": "GTOOL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c9bd3-5678-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779520917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520917, "uuid": "6435658b-d6ec-48e4-8b2b-c6f9023b166f", "comment": "Malware payload (Mirai)", "value": "aac754725b0f00afa356ea03f23845e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520917, "uuid": "3e8ee09e-1883-4a7c-89b0-c0486964fa36", "comment": "Malware payload (Mirai)", "value": "2674ac0ebde893235cfa3668d8603aff6dad955db2d35145cf1a8cbb7ed521d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520917, "uuid": "691790a6-b553-469f-bbb3-8e13ded36de1", "comment": "Malware payload (Mirai)", "value": "6161a5079467b5ad3d85e96a309883c583bef36a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520917, "uuid": "c2b5aff4-be78-40c9-909e-a52f5721eec9", "comment": "Malware payload (Mirai)", "value": "62df7113bcc04b30c11d817183b883d5d43ea700f77adc7bc00a2f058200a46566ec40892edfb9345c080081b1cd096b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520917, "uuid": "535767c6-3415-4ddc-b607-926d012795a8", "value": "T140F3C50E6E198F7CF79987344BB79E32925833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520917, "uuid": "c0f19609-82a4-40bb-b11b-05dca127eee5", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwu:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520917, "uuid": "12e56f06-7a9a-453d-b534-2fa5673aea44", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520917, "uuid": "02ba6178-7f1d-4a56-801a-00068d0fb6a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520917, "uuid": "3774da06-575a-4fd1-b3f8-0afa3e35e85b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b22646-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551864, "uuid": "dfbf274a-236e-458d-a6b3-a447dc0961f2", "comment": "Malware payload (Mirai)", "value": "c4bc7a5ba091a59c91209b5a389318e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551864, "uuid": "ab8deafb-565c-428c-bb01-1ee8a29c2f4d", "comment": "Malware payload (Mirai)", "value": "274b9cbf6306c7d0b6b7c92f565aa87d8c17bdf13fd7954c407ffb479034f675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551864, "uuid": "29e14a6e-a8bb-4370-9703-8a5ec82b2ee7", "comment": "Malware payload (Mirai)", "value": "ae6837097db3e172abe31059cf4b0e43bf09a1b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551864, "uuid": "d4c127c4-c940-4335-afde-b961a3c58c92", "comment": "Malware payload (Mirai)", "value": "82bebb208701bb2fc1071277bec835b082dc4c7f1c7eb406aa22b959dcd5a7a4f3544ee8a090384b9cc28954e575f3b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551864, "uuid": "ca283561-b729-4822-9b19-809c627b91ad", "value": "T12E4619277A28DB0ED228213458B1CE99673A2C4646D7A527B391F30DA8F20BC5D5FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551864, "uuid": "f182aba2-aca0-4995-a149-19f7650b4d39", "value": "49152:1b02CbccirWGBnPRts2wzNdncsBeG0xjvbYNAMj260bAW5rqXbdQhJ69LZcB1V0e:6GUWEK1V0ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551864, "uuid": "60bfa765-0cf8-4afd-8e67-13a8b236fa1f", "value": 5570743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551864, "uuid": "9517b68f-5fad-4054-bde0-04c422d168f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551864, "uuid": "912d2fe4-6325-41ad-a24d-3051c098de1d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1823326-5693-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779532776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532776, "uuid": "b44c006d-29d2-4568-a8d8-47d5f4938660", "comment": "Malware payload", "value": "d8afd6179b860ebb188fea01255fb3c9", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532776, "uuid": "69f8b2d9-8b76-40df-916e-a43a7b03d59a", "comment": "Malware payload", "value": "27588c6b0db532d5ce6186d4b1b8d729f19ada7fd1618d8cc66ae1e048580352", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532776, "uuid": "7ba4f3ca-c09e-4260-a8ea-99eac3bbf915", "comment": "Malware payload", "value": "44c34a0eaace7fc568891b640d8a74b4ce41f661", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532776, "uuid": "e4aea9ad-4d50-41b9-acfa-fe408794eaf4", "comment": "Malware payload", "value": "41906690627b6202719e0aa4237e48bd35dc883e980cb92787bc026c67e2c704d7322aef6582209b407e6614fdcff5a1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532776, "uuid": "d1113629-a486-4e4d-b649-3c31a950353a", "value": "T13BE19E296129034A8523D1BA653FCA78E89B4404FEA77336BB82D8A6287C754D535F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532776, "uuid": "b898a721-9cdb-42c6-a557-e019c6f37217", "value": "192:5vggYpJ6O4uGrlUUocZtihv3UJcDWT6p5fhh+1dt0:j2J6bBs0txu26p5uzt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779532776, "uuid": "c7507dfa-ab2f-496c-8a02-873c596ee379", "value": 7404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779532776, "uuid": "4cf4bd2c-162c-4277-8ae1-baf990aafdf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532776, "uuid": "e3163b32-de27-4b4e-be34-ebe8ccb23a6f", "value": "photo-763489021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7cbdec-56d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779560098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560098, "uuid": "6b03a1a2-3203-488c-ae82-ffc25f1716a9", "comment": "Malware payload (Mirai)", "value": "346a310b01d8a21bf2f8d43c9315befc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560098, "uuid": "ec81984f-0568-483d-8eb0-517341d41371", "comment": "Malware payload (Mirai)", "value": "2773c1a142df303740724e10a44302970ffcdab1595c199a9da2339a5b619138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560098, "uuid": "8aa578ef-287f-4314-998d-f86fa49c285f", "comment": "Malware payload (Mirai)", "value": "c46a886c02df96b5dcf6af917b7cce725d7eaa56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560098, "uuid": "714af0fa-a01c-4965-8b88-8bba5fc691e2", "comment": "Malware payload (Mirai)", "value": "30bde13897365429e3015c8b9a20405aa6c40d0e74017afdb007d4a6d7eeb867f31df30452546da8da3c2f03f6f699b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560098, "uuid": "47fd3c19-2bdc-47ec-b567-df31f8af6597", "value": "T12E042934D6504B17C1D223BAA69B424E3F234F97A3D733095638BBB43FE279A0D62915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560098, "uuid": "6a5d55d6-7f2a-4737-b071-397242aaa421", "value": "3072:6PC+RjGkWa6s/qSPeAjQM6PBtjLbPOgpM/9sAfymUwwFB7DXNu:61fWa6s/qSGAYPBVLbPOqM/9sAfymUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779560098, "uuid": "5863e1b5-5621-4c55-922f-ab607b313d1a", "value": 181882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779560098, "uuid": "e965138e-2fd3-4a4a-b2fd-82123d72c697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560098, "uuid": "eee16464-08fc-4723-b4c7-ec9022fc49d5", "value": "2773c1a142df303740724e10a44302970ffcdab1595c199a9da2339a5b619138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0e0591-56ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543051, "uuid": "826ee9ea-448b-46bd-90df-56dea86b7078", "comment": "Malware payload (Mirai)", "value": "5bc7e2cba8438d5ad4929ab6dd0ae88d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543051, "uuid": "10d7bad4-54ea-462e-9c0c-e8b9f6408a32", "comment": "Malware payload (Mirai)", "value": "27f80d9fb6544f5c6785b402c8333448442af00616f4b5821d53dc392504b62c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543051, "uuid": "444a00cf-da72-427b-a61b-c206dbe41cc5", "comment": "Malware payload (Mirai)", "value": "73d4e1c5978c87dace857a78bf0ac2656a1637f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543051, "uuid": "94f81154-0590-4390-96bf-d48fdeaa1bf0", "comment": "Malware payload (Mirai)", "value": "642552128fbf26003a46a47fb7bec5cef78943ef3b4ee5c7254dbabb6f75a50129de8857be2161616c46b9f0e66c0219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543051, "uuid": "fa70756e-513d-4a53-92ff-050091d58329", "value": "T16373AE73D42A6D18E64456B4B464CF384B33F050819B2FFA965AC37A9047EACF60A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543051, "uuid": "3d7ee4a3-dd2e-48db-8700-5dbb3ef0ef15", "value": "1536:7a9/0b/Lh2uNhjAyKstD7FgWTbKP5Nour1NQr7jFYMHKyASnowgC8DO0pC+ygdrI:7EMr39AyhFgWTbKP5Nour1NQr7pYMqyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543051, "uuid": "982b1e3e-4cf0-4ad0-b48f-e5de3239d14b", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543051, "uuid": "bc5a7851-b2d4-4033-ac50-d7ec0dc03f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543051, "uuid": "5900890a-efcc-42b5-9b74-661d77aa1cbb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02e134d-56b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779545336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545336, "uuid": "8977d383-86ca-4c93-8522-c7ebc2a688a5", "comment": "Malware payload", "value": "acf5499bc65f05513c3530d32c991d3e", "object_relation": "md5", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545336, "uuid": "1fdf1bbd-871f-42dd-98a1-fbce8105b44a", "comment": "Malware payload", "value": "2841aab00ee6f00213e594dc562d03b982e6d8570a6de2a0797f3a147665f4ca", "object_relation": "sha256", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545336, "uuid": "afb4193a-b428-42f9-9d93-8f3151f882fa", "comment": "Malware payload", "value": "aa42cc22bab169f4295930471f5b8097b69bb4ae", "object_relation": "sha1", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545336, "uuid": "b823b9a2-bc12-4d7c-9be6-f98f2652b8e6", "comment": "Malware payload", "value": "f9474bf8a10f178c314621d67b1e6823707820d1933346be0005bbe5975b31798f10cccc2b29903d93bbb8ced2c27ba5", "object_relation": "sha3-384", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545336, "uuid": "5685bfa7-8172-4e01-9ed5-785433163b40", "value": "T185034B2A71D23197C852C379ED76973FDA70B042AA10226F2330EA3B1F27671E744E19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545336, "uuid": "8e1b09e8-8ffc-404c-ab9b-9f8f26df21e5", "value": "72d46649e1c061bb2f6f6d91d9b6f96a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545336, "uuid": "d56614f4-10b5-4631-86c4-82dc19313202", "value": "768:Q0BdYxU4TJVqtuj5cms72J/af99BKUcjJ9qx/VW8MKgWcDFZQELC/wg06OCZaBN:TUK4Tnqt172JSlFcd9ExMJWcDFZQELCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779545336, "uuid": "a0f3d0f2-2699-42fd-af6e-9122812f2a5a", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779545336, "uuid": "9dfde91a-2856-4f7d-a480-6408a3c85c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545336, "uuid": "07421b38-e0c1-4237-b05c-eacc2a403f7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9fceb3-56c7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1779555098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555098, "uuid": "b8675256-6e0c-4634-aaaf-60ff7bffa23e", "comment": "Malware payload (SalatStealer)", "value": "a8f1351c02aff119054b7cea3764d8c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555098, "uuid": "7bc69c74-1396-4064-b816-6c7d177081da", "comment": "Malware payload (SalatStealer)", "value": "2a89325f2ee48ccf888cbe5a859a7d61dfbeb89dae062c39682adb628e45787f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555098, "uuid": "f242415d-d5b1-4c7b-8085-b2df7e9484d3", "comment": "Malware payload (SalatStealer)", "value": "d26df3f4feaf68cc38d13dd62ba328970c1eac55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555098, "uuid": "3541525a-5027-4b16-91e5-8fcd7f1581c3", "comment": "Malware payload (SalatStealer)", "value": "61017e97042a1a12fe674c28dd4a404364bd36332fd40ad1d223e2af88d4566a4efc49b9530c423ccfda615e8b4a709d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555098, "uuid": "b303f213-a66d-4c11-a4f9-e2866cc5e624", "value": "T14CF5335800BE5544F59BD138788EFED98A771D639E9D32D7BB8028B87479BFE0040AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555098, "uuid": "05045a26-b151-4ec7-a350-d57b5dcc3261", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555098, "uuid": "3c21f091-6d5c-45f8-906b-a8d96c0675e0", "value": "49152:wF3Vq5ZVr6NdWWfOJ/kVwy66Y1hudNVY/xVfbjPt2gJlVgm1hmyzWg+:wFYRr6vfOJ/CwyM1odnYpVfPPkszWg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779555098, "uuid": "081daf08-8dca-46e7-926c-b722bc19f9c3", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779555098, "uuid": "a2eb7444-9794-4c6c-b1ec-445858039bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555098, "uuid": "d39fb07f-f9ed-4acd-bb1b-a652ffc74fa6", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115b73af-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779537661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537661, "uuid": "5bc92d9b-6577-4785-8cc8-519e403b6865", "comment": "Malware payload (Vidar)", "value": "5ec1dcc43c05b00f1a19c99ed5e49187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537661, "uuid": "b3429e7c-b0ef-4d13-915a-7735c6095f35", "comment": "Malware payload (Vidar)", "value": "2bca79d7991785f58ecd8780f50f472b00ace15ca3049e19889bcea2c7ed33f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537661, "uuid": "61643d6e-63e5-4377-beb5-cba9fe3b127e", "comment": "Malware payload (Vidar)", "value": "fbfee1893c33478b052b1d44715a9fed1556a466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537661, "uuid": "d41d90c9-59d2-4a45-b4d9-344ab3d7d380", "comment": "Malware payload (Vidar)", "value": "0ff1cf1c282d5a2303626194d354027a8c87e98ad98ddc1ca909ae25c56ef055d4a7e3637d365c4ae6b5a493b2a434ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537661, "uuid": "8f1ac2f3-667b-4f08-b3b2-4434c3987f5a", "value": "T175059F119F9352EAEC334939D4EA131B78F47CD882A08E33C6670E993D43565B33B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537661, "uuid": "e26515a1-835a-4f4d-ad4c-583ed916c9c4", "value": "835e7131fceb7b369597efbebd85dc9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537661, "uuid": "317b9be5-c38a-42fe-a7e5-6ed306590176", "value": "24576:CP134HzWJZncEGahYFQw6UOMc7YNIGAR:CEzgnceeOM8YKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537661, "uuid": "a685b47d-5056-4247-926c-e884dbdbf961", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537661, "uuid": "a8601d0f-3995-4484-ac1e-556720a89357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537661, "uuid": "f8d45b60-6fd1-40c9-91d1-c9e4925f9bb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ec5c1d-56b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779548220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548220, "uuid": "2410487c-fb91-4360-8e84-679f4059cd51", "comment": "Malware payload (Mirai)", "value": "42cf36385a564f089f95bd9b1e7842d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548220, "uuid": "70a3e923-1692-4887-89f3-413596ee13bc", "comment": "Malware payload (Mirai)", "value": "2e3baf8b0eca3ed113bad116c9ada38e8bb26669166edb075c710fb4b15bf900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548220, "uuid": "446794a8-e8dc-4c12-a57e-e40123a7b044", "comment": "Malware payload (Mirai)", "value": "2768ddf050cb057d1dbe703a3680d9a671de7bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548220, "uuid": "553af080-18a5-4a00-8b77-41d76a5fc7fa", "comment": "Malware payload (Mirai)", "value": "4b7e2137eaf6503b6113ad953f0294eb5eb419d602fc5ee3bbe9fb85a4328d375cb812477ce8335a68644f0946d785d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548220, "uuid": "e3f182f8-c6b2-4057-989f-8cb842ee5f01", "value": "T149B3C509BB600EFBE8EFCD3746E9170625CC652B22A92F357574D828F14B18B1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548220, "uuid": "5581bc1d-70e8-4349-9f75-a4ade4439944", "value": "1536:uKcvx4z0uPqSDSAgVukh6pW9kZCVQMuftw9Fb1Q6Mp45ZzgkUn7Oad:u/vx4z0uDghSoJ1Q6M02hP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548220, "uuid": "f4a7b1a0-bf3d-47d0-943d-3d4c07b758df", "value": 116288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548220, "uuid": "71171998-37b5-4058-9a36-81f61d3b4ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548220, "uuid": "d41a14b1-f76f-4325-89b8-fac14855da02", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff4f7ae-56d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779562301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562301, "uuid": "bb64c0c9-da66-4261-96ef-c0dcfd60788f", "comment": "Malware payload (Mirai)", "value": "0c0c6e8ea35232aad7dbb258e757ef1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562301, "uuid": "f29bdd0a-0052-4f41-a3e4-da37471be150", "comment": "Malware payload (Mirai)", "value": "2ebbb2ae9cdaa83e2ad312df4643c5e2cec07acec56b81838bb53c20bf4adc89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562301, "uuid": "76beadf5-3d8a-4e23-9ad1-6b95953f1cc1", "comment": "Malware payload (Mirai)", "value": "a6343dfcff974abc34e29fd5f876e7962f9e0017", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562301, "uuid": "c56cf7f1-5a7a-4a25-aad9-aca6939d5d20", "comment": "Malware payload (Mirai)", "value": "0e2cfbb40b34a2c4f1b521b768277576ad18cd31a8274b4bcdb5e12394720bc8dc8d022fd376539aa50d9aceee3f48e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562301, "uuid": "b0c7e6d2-6b34-4ec7-a635-2a65126abb00", "value": "T1F27329C0FA8B81F6E81709304166F23F8F31E9794075C66DDF6A9E35DE23A41A316299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562301, "uuid": "08d158ae-c88f-4180-9000-b5b9a7ca35c1", "value": "1536:FeS3BtVgakSQzgjOMG/aoi9rL0jjT0Jyf+WOIb/9vTB319Rp:ISjVgakSQ0a/aoiuHYS/b/9LxPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779562301, "uuid": "f0a49ddc-df4b-46c9-82a2-982dc5722a4e", "value": 79468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779562301, "uuid": "5b9f5505-ed12-41c9-8d94-8db66e928455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562301, "uuid": "12ed641d-e477-4300-89b4-e902433b7f28", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35adf59-56d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779562065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562065, "uuid": "840b96de-a2a3-46f2-b119-3772df5f6550", "comment": "Malware payload (Mirai)", "value": "c030fc86d56cea4119d07dfc7dfbf6b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562065, "uuid": "64bc7153-fe2c-4f40-b970-ce90fab017c9", "comment": "Malware payload (Mirai)", "value": "2f02f1e69a1d0e19aa2403d85dbeb3a8e754de3a84db638bdd8c6595e08b5cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562065, "uuid": "668e1d7b-6cfc-4ce8-9b4b-08bd3a6bfcc0", "comment": "Malware payload (Mirai)", "value": "5575182b1649f4f51d9ec773fc54cb0e0b425c66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562065, "uuid": "52021f20-88f1-4f29-a88e-5963f07604b4", "comment": "Malware payload (Mirai)", "value": "025da2bd92e03d6f25a8aa310af2c5e5786dc3c41bbeae9eb40a47cc1fb93c67362ec09d5c6b769870795009dfa17826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562065, "uuid": "72c575cd-c262-4bca-8e3f-a1755da59131", "value": "T13F73BFB3D8266DA8D0584170B0B48E795B73E49082572FFAA996C376D04BEECF10D3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562065, "uuid": "1101bf88-fd80-4546-98d7-21cde8102729", "value": "1536:Fax/0yAuc/YWlWNhGUO5UhW0Z/6W56SmKNb5I28U44ACtrug:Focit85Uh5CWwSZNl8d4As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779562065, "uuid": "24e47bbf-0466-4d4a-b093-20c540a6648a", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779562065, "uuid": "499060c8-6776-41a0-9a7d-afa07f48cfce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562065, "uuid": "f85ae81a-c87b-4d3d-bc1d-39ca592e8977", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ed1926-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544408, "uuid": "4adf909f-2e98-4283-898f-bb71b41444ff", "comment": "Malware payload (Mirai)", "value": "e596dcc19376f9dde30bbde12cd5a0c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544408, "uuid": "b56bbf3d-8940-422a-a72d-96d0418cc449", "comment": "Malware payload (Mirai)", "value": "2f0dd5c9ab2b550631a9785f61af01d0d9a38e0f029ee946642df2d099408b0c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544408, "uuid": "e01bbdc8-3d31-4386-9efd-40ef16daa067", "comment": "Malware payload (Mirai)", "value": "c34cfe770749ef66dfab9a7b846ebeaaa974dfa4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544408, "uuid": "4967ebf4-7d33-42e8-8a8f-d9b7aeca4c8d", "comment": "Malware payload (Mirai)", "value": "d80f22d315a980e0682fa0260237919abfc6cba16bb56c0fcc93e4ce4328ae0e1e340ca8b53f6122f76d794f0f646da8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544408, "uuid": "38a3c283-8d91-459c-8e7c-5802b4db0396", "value": "T1E0116D97F99686A38E8D007D5F6EB1164063C87717A2C839B28CEF190F53144BAE1238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544408, "uuid": "8d2c47ef-7860-48a0-8b2f-631feb140861", "value": "24:t+AhIMhfyc0stjGV98xK8R8stNsLkrx6ipas0s0XsJinbNiLuhZajbUw:txIEfmOyV9I/RjtKAtSsRMsCbOCIjbUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544408, "uuid": "aef1652b-4ffc-41a3-bff2-0529945ef7d0", "value": 868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544408, "uuid": "15b3290f-7321-496e-bcf3-19c6abf71fdd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544408, "uuid": "e977aeaa-7654-4560-8f42-859c06582b38", "value": "memekc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40afbc2-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779552107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552107, "uuid": "afd85a66-02d0-4ac6-a434-181885ab536f", "comment": "Malware payload (Mirai)", "value": "fbb3040538e259d51501647cfe2b790a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552107, "uuid": "a358237f-d0eb-4490-881a-be5289ea4ac8", "comment": "Malware payload (Mirai)", "value": "2f99b81bc710002d56dcd99a8a7be981cfdb0e273fe5a2e77597dc887b22bf52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552107, "uuid": "aedf0ac2-3a63-4714-aeef-dcf676ac0056", "comment": "Malware payload (Mirai)", "value": "4ff7753142eb6fd361733ea4edec083639118eb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552107, "uuid": "23dbf7f2-45c7-4d68-a238-2bd06448f8b5", "comment": "Malware payload (Mirai)", "value": "d6110149326139f2fbcd7f6e6889ab414bdd057746dd5af93e5c81d49bc049680fa9c0103f0933ef6e74fbeeb4217796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779552107, "uuid": "b8bc4f1d-1f01-4754-98d2-58cf057aaf65", "value": "T120361A87B8D24A43C4E4367AB87D81C872A34EB99B97135A5D04FE3C3BBE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779552107, "uuid": "4d87dc87-f1c1-4ec7-9501-f2e53af0d73a", "value": "49152:3ux/+ioBE1Xuz7pEFPHrh91lXKY4Rm/ww6B7VUyizDXenlM1h:+x/+S1X/9HL1laY4RGm5izDXenlM1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779552107, "uuid": "2d99b2e8-26ce-472b-b44d-4799256441c3", "value": 4980888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779552107, "uuid": "3cf6e027-742f-4074-b656-0e82e299cf0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779552107, "uuid": "b9e8ac0e-be22-4c3d-a5c4-83b8a7fac8ed", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a39e93-56d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779562302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562302, "uuid": "64a61e9e-2ea7-497c-83ed-533c0dc1b32c", "comment": "Malware payload (Mirai)", "value": "23edc0de7ae8068e9a035391c1273a1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562302, "uuid": "88310485-0227-46e8-9aca-0c144567f054", "comment": "Malware payload (Mirai)", "value": "2faed3b77297d75e31e12e2c0edcb75c56d5aaae6050f1bebfe2aa4ba13664e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562302, "uuid": "fc9b847e-471d-46b3-b570-ce05896618e1", "comment": "Malware payload (Mirai)", "value": "a16a6dd77ab1a6aaefa89d6f4d55df717e1f3d8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562302, "uuid": "3f9b72ea-b1ea-4b5f-befc-89cb1bd69ea6", "comment": "Malware payload (Mirai)", "value": "3ce0892cf2830d0c267633af9511d653ce97c3623b38217b679860cdcce30e340f8cc6d0ca89fc1d7d5df4c6b791af00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562302, "uuid": "08ceb6da-804b-4b79-a745-9d3bc11daf20", "value": "T1FF932A55BC819613CAC513B7FA1E028D372623F8D2EE32079E255F6173CA92F0E67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562302, "uuid": "21b750dd-db23-4117-b0ec-b0d83a6ff30a", "value": "1536:AG37pIytT+9Gp+rhm+OzcXx7lYhP3vYfD4dGGfTyUfYVyW4ad7TNsF:AG37pIyh+9ZGc6nY0tTyvVyxyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779562302, "uuid": "16678004-37e0-40bc-8c37-15b6ddf92234", "value": 91456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779562302, "uuid": "0c975f87-5207-4a37-98ce-c1b062fbf319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562302, "uuid": "1d111d6c-ea0a-40ac-bc60-2e2aa773d863", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecfc5d1-56ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543052, "uuid": "232f8c62-7bc0-426e-ba6f-8a53013bd86f", "comment": "Malware payload (Mirai)", "value": "1eef02283646f3c3ff334ff7c80f44f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543052, "uuid": "4de3af6b-14da-4603-9dcc-480833b24c41", "comment": "Malware payload (Mirai)", "value": "3113cc77f64587ed9bfbeca3c6acf7be1d6ef98c3507417f04e547bf71902db8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543052, "uuid": "240d9c91-b64b-49b9-bbab-e12e83a1a174", "comment": "Malware payload (Mirai)", "value": "19e016465f8f5c2c295be8992eae1428752eec45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543052, "uuid": "a2fd701b-c0a2-4e9f-87d5-2272c43e6942", "comment": "Malware payload (Mirai)", "value": "452531a1409b5675e006e8d6a9db04ef725881daa91ab77e936fcf11457b89f80435277a81dda98bc370bc8910a19635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543052, "uuid": "5e20b999-77b7-4d48-a5f7-28cb025432c3", "value": "T1CD932A86BC919A13CAC51377FB1E028D372623F8D2EE32079D215F6173CA96B0E67552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543052, "uuid": "cc9027fb-a3f9-457a-ab8b-5c0d12125920", "value": "1536:sP+df9gL19DgOaepAvnHmA/Le/PFvYfD4dGGftR1aNvC/ML3H88YW:U+dVI19DobaY0ttRINK0RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543052, "uuid": "9f22bebc-3d75-4f9f-9542-38f0cf5c94b7", "value": 91988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543052, "uuid": "c2834ac3-e446-480a-a50a-87af2129f1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543052, "uuid": "3727df61-80ad-4dad-b1b3-1f31f604fb17", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dd8f3a-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497048, "uuid": "c67d3aab-9ef6-4c0d-84ad-336dff502945", "comment": "Malware payload", "value": "35e264fd003ee3625df5b506144d129b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497048, "uuid": "d7e8bf3c-435e-4470-87ea-7fc5419d7dd4", "comment": "Malware payload", "value": "3131522c7c03857cacedef875e328144d0f90b48832f7c114ce837f6d14f9792", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497048, "uuid": "238132a5-0256-4b08-8427-040aa185d030", "comment": "Malware payload", "value": "f632e906fc7ceab4e740987bd34ca8775ccda924", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497048, "uuid": "8f7a8262-ad51-45ce-baf3-7172c9406d73", "comment": "Malware payload", "value": "7df0d28622ffd5fae26408c387694556a87d3942e6382797740ae99882cb269666c67794b70a085591cea700aca1f928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497048, "uuid": "61fabce7-1530-46c1-bfb0-813a5653bb93", "value": "T10325F096BC52A942C0C136BBFA6E8188334753BCC7DA710AEA04CB3576DF99D0D39B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497048, "uuid": "d5d02e8a-1bfd-4128-970a-501cc607173c", "value": "12288:VsoOlwuNmpqUnTMyZpsmbLW+kQg4vF83jwqe2P0sBmp0CYvWbcmc6OWcC/otQGAZ:rOlw3pbQyAkg2qcsBmGCYwy5WcQovAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497048, "uuid": "fca8c47e-8115-4729-b0cb-3424bee9cb41", "value": 964969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497048, "uuid": "b799ffcd-ba9a-4271-a683-887aebe7a97e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497048, "uuid": "82d35f6a-948c-496f-80ed-ed3490699fd9", "value": "rrolpik.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b0bed6-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551865, "uuid": "bf682735-bb84-4fff-8bdc-7c2669b4af25", "comment": "Malware payload (Mirai)", "value": "e3dec08c092a6e32e15810ffc9e9210a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551865, "uuid": "8826c80b-6c18-4f7e-a5aa-92199f4f3281", "comment": "Malware payload (Mirai)", "value": "313f4a546d4f1019d10a02294dd28c1937fd5d026afce1aabfb0d9be3e320e2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551865, "uuid": "8a5cd43c-1b26-4bce-a590-22e58a1d4346", "comment": "Malware payload (Mirai)", "value": "d1de4c1711c75dabb86c381acdbdee839a9d6531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551865, "uuid": "55b580f9-9775-48eb-81ee-cdc6d26baca0", "comment": "Malware payload (Mirai)", "value": "8f56f9242703ae23024492562a435c0bbf9d3b6779845cef87a7639953796ef176e0da211f4cb819772a5ce41e0b38f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551865, "uuid": "d869bb42-27b8-494e-bb8e-04617fa46b29", "value": "T18A463A9CF81DE5A2DDD8BA747BA141867639BC45AF81C7232600B76D75F33D88F22260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551865, "uuid": "063e2c15-0d60-4303-945b-bc84b53f6589", "value": "49152:knuqtyQfieR6bqHSKQDKhFzfC5E6Uey4unqi49:2uqt3fi+6bQSKQDKhFzf4EBqi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551865, "uuid": "3a577ffd-d67f-488a-a5b3-e2cdb69865cd", "value": 5374273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551865, "uuid": "ea3bf713-21e1-4cbf-bdd2-ec7681977c88", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551865, "uuid": "f2c5721e-aad8-41c1-994d-97619bc62225", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d877158d-56e3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779567201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567201, "uuid": "615a5312-6958-4eae-9be6-1e3b2541c6a5", "comment": "Malware payload (AsyncRAT)", "value": "fc4c5f83e64c5e02f34ac86645dc5e24", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567201, "uuid": "babec6da-cbc2-499f-a26a-34cf5cc5f999", "comment": "Malware payload (AsyncRAT)", "value": "31a2d8711fec6b73142756e0ffefd5a9485a86e06417e756d95e5bfaeb72b3cb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567201, "uuid": "7d7c72af-0ab9-4170-b328-f287b159e6c0", "comment": "Malware payload (AsyncRAT)", "value": "32c5ceabac605c7d0a82a2d4eb41081fbc7df72d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567201, "uuid": "0d2fb730-ffed-4a8e-8511-5bdf307b895c", "comment": "Malware payload (AsyncRAT)", "value": "2a3a5922ab4faa0266afe457aa0b4067a2a3b7cdb14c18e770d15e431b479b380382a5c5774ff9c9395ecb21632a2ed4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567201, "uuid": "ce2a3359-bc60-4803-b745-0fb720c5a55a", "value": "T1C3232B003BE98136E1BE5FB89DF1114287BAE5233603D65E7CC841D64B137CACA52AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567201, "uuid": "a5537d2b-e374-4db2-9979-cc96eded5a92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567201, "uuid": "0691debf-6a6a-4cd2-b559-6cfaa32dc94d", "value": "768:1qHHWcbXIgc3WkOicvHk3eHlWMPbPgF0q/LB1wPlniPZc/YI6OCzKtYcFmVc6K:1h3WXvZH0ub4Fr/LB2PsPw6O6mmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779567201, "uuid": "13985b70-0944-48c6-b4b2-b2f5969b5b2b", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779567201, "uuid": "00a4e6b4-dfec-4013-b344-7b904d2b9e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567201, "uuid": "bf0c71f7-2f4f-4481-b1e2-ffff4bd7b3e7", "value": "BOT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac860ef-56d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779560091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560091, "uuid": "d60aebb8-b388-4407-8023-db6d2fbe9cb1", "comment": "Malware payload (Gafgyt)", "value": "ebb93e6357419f8b9a74d57319a6aabc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560091, "uuid": "3cf3c7e8-40ca-4954-b31d-e87f06b5d4f8", "comment": "Malware payload (Gafgyt)", "value": "31d1e534e97689dc88d86bad0586ee29570463f61c659d149e33745247fe66b0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560091, "uuid": "019b5f14-6690-42bc-8536-8f7e9f418bc0", "comment": "Malware payload (Gafgyt)", "value": "a8d5e812a3d3fea4050f6bb0c4c81db50cc332b3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560091, "uuid": "72d7be43-435e-46e6-8fbb-27de995083b8", "comment": "Malware payload (Gafgyt)", "value": "2523ff3e92cb2a8cfb328ae40dcced32cb5480f20e5768acad57001c557d777909cb9953514e8db4a56852a2fa883185", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560091, "uuid": "a9b6cd34-9ba6-47fb-ab09-d564e209b37b", "value": "T1894185CF22A20AB4ADA1A927326ED85874D8E1D715C9AF6E7CDC7CF9408DE0474006F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560091, "uuid": "88a71555-9a18-4891-aade-9a330f608dc3", "value": "24:vD+mdc4kBAasOhs7+oEsG4JuKiIisjbCo+BP9t:vSmu4kebOq7+WG4JuKiSjbCo+J9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779560091, "uuid": "0b769a55-a6ed-48c5-9bf5-68e150928115", "value": 2040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779560091, "uuid": "d3a28170-df92-48b8-9df8-76e4f1f1f329", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560091, "uuid": "c849c4f5-076a-4caf-bd21-1c44f115dd95", "value": "31d1e534e97689dc88d86bad0586ee29570463f61c659d149e33745247fe66b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10a3bce-5699-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779535406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535406, "uuid": "72384c4c-6942-4ce2-80a1-01a1eb71a53d", "comment": "Malware payload (Mirai)", "value": "dc3bb6741b141d2fffb52e7d9dac86fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535406, "uuid": "c498a202-0f40-4a3d-8a25-1ea594b5bc6f", "comment": "Malware payload (Mirai)", "value": "33e59d6043d7c0f8d98d41d4a175a27407d6d375285f48c24aedfaca8214938e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535406, "uuid": "f7892fe1-748f-40ba-9ad3-0d51243974c8", "comment": "Malware payload (Mirai)", "value": "6685ddc82807ba5237c51c5fe8cdc4898667e0a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535406, "uuid": "e9828373-3e30-45b4-8492-a378892b2be5", "comment": "Malware payload (Mirai)", "value": "25edd4bc804751fb3c861e8ea8d69cf32ebb7472e8daf47194b7a8a3866f4a947474677031360719f040fef1b7f75a7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535406, "uuid": "c02fd7b2-cbc0-4e72-afcb-799d7ff48833", "value": "T158634BCADA43D4FAFD6706705077B7379E76E53A2058CA43CB99E836CC12902D61B68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535406, "uuid": "eaae8883-5483-46f6-9a23-903deccf5805", "value": "1536:RGVlTURBUL55bzOfmnvPIegF6PEUPYiJDCfU:w3MBUD/OmvPIv6PFPrZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779535406, "uuid": "eed713c6-32e3-4dc4-b6b6-939bed9b5c86", "value": 70732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779535406, "uuid": "894c42fc-f5eb-456f-958b-cfda1fd63d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535406, "uuid": "fcd12412-5818-4e19-a668-5a46b4143759", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae81424-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497036, "uuid": "e4e52854-32db-4cfc-bc5d-9b6dab8edb30", "comment": "Malware payload", "value": "198c07f77cac3f6a25e3cba59cb0651a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497036, "uuid": "35ce6ca3-8a82-47d0-abfa-693b40fb63a8", "comment": "Malware payload", "value": "34380991baf418cb1ecd1ceae3508c62472b7f89795a052ba95c9a9d1d0eefbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497036, "uuid": "c2d89178-d283-4b08-9477-e083005f55ea", "comment": "Malware payload", "value": "31b6c7f6b67dd61e5a5e964a3425cecec0a254a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497036, "uuid": "f55414f9-5d33-4191-a699-380212e10baa", "comment": "Malware payload", "value": "a21923cf8c9004304b560f3ade6bfecda387e5892d6d515351526bb8525964db23b9abba60d0a081d416149427f9193e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497036, "uuid": "3c9c432a-a4b9-435f-9057-48bc13dc20ff", "value": "T16125E02AF91154B9D473A0B1530FE376CD286A34465788CBFF5A1D28A6392D0AF3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497036, "uuid": "648f33df-e684-48bd-b80f-f773337775be", "value": "24576:h/cZLpHt+FUSztsQ6TQjSNZ++BsKzRXiy:h/cZLpN+FUu6eSNg+B5Rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497036, "uuid": "a470cff9-f564-40ac-9716-02c7c81acc70", "value": 990273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497036, "uuid": "3498297d-5cae-4665-a433-345d2872d62f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497036, "uuid": "f3f8f000-e98c-4d58-b9ef-b03778cc2688", "value": "amvdvgp.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc6b423-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579588, "uuid": "a93bbd53-9ee5-4a30-b2cf-20de079a1da9", "comment": "Malware payload (Mirai)", "value": "6a743264aa5a3ac83c4d25c5688ba6c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579588, "uuid": "746d45cf-a99e-4149-a6b0-887daafc3df2", "comment": "Malware payload (Mirai)", "value": "34cf01c73d13f2aabc3f518f66dbf1bcbd35402ee64f47a950f55d984c514881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579588, "uuid": "5c076dd4-71bf-4b22-a8c3-bc7664ecb612", "comment": "Malware payload (Mirai)", "value": "6f763b3eefbfd2698b13851bf5a4d1da1f46bdd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579588, "uuid": "31dfaae5-d265-4f03-b4a2-66897b8fdf96", "comment": "Malware payload (Mirai)", "value": "6dcc777933085e2cfef8c06257857efc53ee5a81d77da9d0c2c9938ca0cf40e193f6d4273d4fe1256aebfc3831a54979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579588, "uuid": "82b939d6-d795-4ff6-bf48-7a675ad771ad", "value": "T117E3A53E7E11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579588, "uuid": "7fdb2a13-96f8-4043-ae5b-943603ef1367", "value": "3072:JW6dm9tS1aRGQdK76t/zCDI5mrThPaLEnvPrNb:c6IG+LCEmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579588, "uuid": "d76269d6-a704-4335-b4e2-e9aa484aa73e", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579588, "uuid": "18f2417a-7cfa-4021-8143-efc3d4cdc3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579588, "uuid": "25cf4ff0-cbc2-4f98-951b-d746d4f70a46", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11080f82-56b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779548398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548398, "uuid": "11f9335f-498b-4fd2-ad38-8a438609b846", "comment": "Malware payload (Mirai)", "value": "7abcc63641f3a2e1ca387ea4332278fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548398, "uuid": "4a982a99-f656-422e-a3de-50a384458c1f", "comment": "Malware payload (Mirai)", "value": "369c432f8a46231b911f7f23823efc02a966ec2ada6b2236485144ce891a6f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548398, "uuid": "e1abca6b-bfcb-4693-bbd4-44962268a89f", "comment": "Malware payload (Mirai)", "value": "ea7ea84e312927a26a3616f47c6f1b86d9f95c7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548398, "uuid": "587514ab-c84b-4674-89cf-7b02e8edc8b5", "comment": "Malware payload (Mirai)", "value": "53c138583290880a414f63a2d087c82f442b6d9680af3095d3c2b0dc9fd5873a4cabf030d35782deab82935dbd36aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548398, "uuid": "eb13fcc5-f5b0-46e0-90cb-7fc3610b9916", "value": "T14273AE73D4396D94D1484674B4A88E785F33E49085873EFA2A96C3B9D087EECF2097B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548398, "uuid": "c844933b-8a20-4834-a7d6-ce42b245a888", "value": "1536:Aan/IZyY9iVlrVNh7Y95OuN9tFKgjBFpsx0lfC9/dw:AygZB9+tZxuN9tMgts+lfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548398, "uuid": "e5ededc3-c4c8-453a-bd14-f33fe676f931", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548398, "uuid": "3c8d9858-424b-4ad5-b889-3393d1321f97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548398, "uuid": "5e7abec9-7ecb-4e47-a37e-86c9f023e786", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4d9e2e-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497040, "uuid": "7437401e-9ed6-4459-8ebf-4c75d0a1568f", "comment": "Malware payload", "value": "26673a709013bc3148cff77ff2bc8838", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497040, "uuid": "935a7949-c3a2-414b-ad26-e032ee9887b0", "comment": "Malware payload", "value": "36ea03edf39aa7c59693fe12159851e16982363c3486d2db85c0736e325d20b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497040, "uuid": "bdfe85fd-bfdc-4b81-b8a4-6daf224a7ff7", "comment": "Malware payload", "value": "a17d7650b332e57dfac8d36a4cd0638ea124e744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497040, "uuid": "aeac6a08-5cff-421a-be39-e9994e58672d", "comment": "Malware payload", "value": "ad945330eb9f661a09d69cd320c8149ce9782d0dc7e192d77064b3896e719c74893779d0643f70064141d76b8aa1c4df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497040, "uuid": "c8086969-7e48-41a7-b6a0-9dfb63b8c10c", "value": "T18F25E00133094E63C0E33D70257F1229EBDE4A8B4759A01E292FD72E6572A74764DBEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497040, "uuid": "12807eb2-67a0-42c8-8eae-d042fc67a204", "value": "24576:8GRCRQY3/y9zjLMv1YRvBWbeHr/zMSe6yXD96oN3Kk:84C+rnLMv1avZ/VeYeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497040, "uuid": "8c5f8391-b916-45b1-a2d1-ef1880fda46c", "value": 1016016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497040, "uuid": "88797144-0be3-4282-bee6-f7264e8b395d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497040, "uuid": "9eb2f5dd-1a79-4fb2-bc2d-4901b9ae8cf4", "value": "jvwyawa.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2945106-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579593, "uuid": "c7372ef7-1b78-4924-ad56-19ad350b0e85", "comment": "Malware payload (Mirai)", "value": "6d634620adbf323fe308e7d603265ec0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579593, "uuid": "8db853f0-8d61-435f-bef6-c2c14c3aa56e", "comment": "Malware payload (Mirai)", "value": "3716515024757bb7f217cc2c1078da1b56626857710527427f06c2b3ea3479d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579593, "uuid": "532bba8b-4c02-4fbc-9b3b-0f899abd91b5", "comment": "Malware payload (Mirai)", "value": "fc3f12c956ee473b021505a190ebfe181ade98aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579593, "uuid": "0360a9cd-4840-4428-a272-6cf3d870420b", "comment": "Malware payload (Mirai)", "value": "8fa9f451a2eb2c539c2e0ad73ec54fd6d9429c371baf5b71136f4dae27c94b8a2252f35f18d1a99d3312f1ebe89f7a49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579593, "uuid": "3eb20af0-3a53-4bc0-b3f6-1f0a5e4b349e", "value": "T1A6B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579593, "uuid": "29bf1399-3ac6-4e4c-ae2c-8a38c28e5f6a", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZ3oamm/QcuLB1niDNb:YuFX0GIk1MHyph4amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579593, "uuid": "c1fdc47a-66d2-4291-9750-b870cdaf9116", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579593, "uuid": "f11fb5fe-819f-4886-be29-7317b8bc8591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579593, "uuid": "be8037ec-cd0b-4834-aec1-c3306184969c", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105994d6-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779537659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537659, "uuid": "9a83dd72-82b9-4207-9fbb-aebd939060cb", "comment": "Malware payload (Vidar)", "value": "d34965454f86b78f224bb6e02e0b62ab", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537659, "uuid": "471d1f14-9081-41b1-acb0-1b785e6aca86", "comment": "Malware payload (Vidar)", "value": "391fb426ae1a22217cf9a15427766c13d27fff8c412ce15448b42fbe4b95b0c1", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537659, "uuid": "bd27ed1b-6aea-4bb3-9f45-231d9b3bb971", "comment": "Malware payload (Vidar)", "value": "a35cbfba1299b7e4ea103b99cf539ba1fe044779", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537659, "uuid": "3581fd9c-8b4e-4695-8cd5-3bb35246faef", "comment": "Malware payload (Vidar)", "value": "193f2751611be4dd23efcdff7b8132583874f29dec86bc282cdd4a652163a6a4781307b76e503e5c070f670bae31f938", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537659, "uuid": "d4ca84d4-0f43-4b7f-95ed-84385b8fa0f4", "value": "T18A84235AC585AC4CC58E09F39373D7B99BDA6CF87F6A46028D846C2005F619AE4BCC35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537659, "uuid": "9b42df0a-7894-4af9-a3b7-834a592df981", "value": "c8544af3c2e49fcd9f40e8a21b0e74da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537659, "uuid": "50630769-ae78-4a8c-aba9-43f8ceec00c9", "value": "12288:5oO6eNds//tHY8Hv/29WrsF1Q3N1XDYu0x:5oOjSy+v/2aW1kPDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537659, "uuid": "9f13d20f-0636-451c-a9ae-550c0730a4d3", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537659, "uuid": "36666d6d-1588-4afb-889d-5529dab6b5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537659, "uuid": "9c2eeffb-eec5-4302-812b-0280cfd9166a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a70cf98-566f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779517061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517061, "uuid": "d13aaa47-3abe-4388-8b7a-9c53753d20b3", "comment": "Malware payload", "value": "310c37133f164b9aa05e9669d1c654db", "object_relation": "md5", "Tag": [ { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517061, "uuid": "608a0f76-d774-4949-b499-9db8b5b61561", "comment": "Malware payload", "value": "3acf42943efdab94f3548d3bf218a6c8d892ef80a46ad0bf0d1ea41ff167b220", "object_relation": "sha256", "Tag": [ { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517061, "uuid": "ac2b8517-7936-4d55-9821-a15e050eb9c5", "comment": "Malware payload", "value": "4baa7e920b96d2f1752f85bb651d2bb7f463f614", "object_relation": "sha1", "Tag": [ { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517061, "uuid": "0a824667-7add-49bf-a764-d844ce99510e", "comment": "Malware payload", "value": "c47bd5fc6883b1291a7187b4900a4077e4d21896c40e9d7234b1423a37ca8236ba5d33aeb3c464900760454fdd1320b4", "object_relation": "sha3-384", "Tag": [ { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517061, "uuid": "3177b632-1bab-41bc-a572-64cbd053d5fd", "value": "T187D36D5573B501FAE0B78278C8631E46E772F85617608BEF03A4426E2F237D1993EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517061, "uuid": "e3da4a09-1f41-4934-bfce-fa7ff26edd86", "value": "56ab395da667e46ede71668f4dded947", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517061, "uuid": "0250b498-9f46-40f0-b805-607aff70f180", "value": "1536:cAd1qEOisW8idu9dlqsfsMWjGY4fuM8HnBb96nnBGc85DTHeSrmxd74fj7fW8Gk7:cAvqUGnst4Gnv8t8F+Umx14fjrVl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779517061, "uuid": "cb2f6bd5-ed76-4a2a-8f5c-489907c11e24", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779517061, "uuid": "e8ff6d50-b93c-492d-bd6b-0e8ce707157f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517061, "uuid": "857cfe47-8f4a-4e64-a690-53e83b3cbca1", "value": "3acf42943efdab94f3548d3bf218a6c8d892ef80a46ad0bf0d1ea41ff167b220-openhashtab-github-io-6.52.3_dump_64.exe.000920d0_00021600.dll--", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d79b85e-5696-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533789, "uuid": "d1dcd1a7-106d-45f0-8e60-2f2b4aa0c8db", "comment": "Malware payload", "value": "089e908ca57adf2a4782fad42770104b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533789, "uuid": "527b5cf4-9e69-4965-b403-d3c1513e5aa3", "comment": "Malware payload", "value": "3b946c2724958515d10d698ebbac37a61b033e128c6cb371fa170420d8a26513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533789, "uuid": "8d402b02-f371-425f-bd5a-9cb8bc435ea6", "comment": "Malware payload", "value": "0dda2bb2105fa0d47025671b60693218a3618167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533789, "uuid": "b8f74a0a-260f-45d1-8376-155a3d9f0a71", "comment": "Malware payload", "value": "ef9ad92ccbaddd2d74bac9506f1b9c742a1a45f73897d8daf6463326a1752f511616c0b6f0ca9648c0ebdcf028ff1f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533789, "uuid": "dfad36e4-21f6-4df9-8865-8ce1e01a10d2", "value": "T122E62321F3E947E9D076907CC8429607EAB2B8090761DBCB13E85B652FA76E04F7E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533789, "uuid": "d29cc81f-4d8e-42c0-afea-3808383bf164", "value": "242e0aac4e550e690ce475bbb6adb5bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533789, "uuid": "bf74facd-63ca-4d2c-9488-afacd73edd7f", "value": "393216:1xA85vzDzUe1+TtIiFF5N+XXNzHw4cIbnwoedLL0:/5vzfH1QtI3vRbI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533789, "uuid": "9e248300-427e-4f5f-baa2-59a5e240acac", "value": 14738944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533789, "uuid": "0c9d194c-f179-411f-8ec9-e8473b355c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533789, "uuid": "69747e55-ed2f-439a-9efe-04219e6268de", "value": "prox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7deed9-5696-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533791, "uuid": "3b49de18-6716-4c7a-8772-a3c7fc94f9b9", "comment": "Malware payload", "value": "dd8bdcb7df845f0fe315df4f06c5d7d5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533791, "uuid": "e438a244-d99e-4ee4-8436-81e9492b1f1d", "comment": "Malware payload", "value": "3f8a418129b2ea210fa6f14bd7e7d9b5e0e564607ce3a6de022327f393a2dfea", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533791, "uuid": "2d71da07-982b-4386-9427-69040e4803bf", "comment": "Malware payload", "value": "fce0b1257ab1df842d2ff16cdb87322fb06a40ce", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533791, "uuid": "9d82e47c-e6a1-4f2c-aad6-5e831cfaf162", "comment": "Malware payload", "value": "8a2ffd2b49675ac9d9ed436a60b8394012f3d0d5041f56a8a266f36bec845b8833994e3c42f5687088da0acd35367ebd", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533791, "uuid": "3007d4d1-aafd-447b-8565-c92c507dbc6e", "value": "T1429423C1AF5AC5E61D4A2314001F6E142B16B763E0AD4A89FF0D11874B3DFEB618BEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533791, "uuid": "c7798e95-b186-4cb3-99a6-79605c256a10", "value": "6144:xm64lSBMVet9s4Xy7xXo5wciUHqAS6gwgGqBGbX1GfvXJBO68kgTzA8Vh8:x34Ul822or9HLK8uvv8koUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533791, "uuid": "7c019f88-9331-484c-872e-0bc802bea8e9", "value": 429291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533791, "uuid": "bb1e7841-25aa-4794-ab02-02caef84624e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533791, "uuid": "8a562c1b-455e-460c-9d1e-d5a90b567d29", "value": "3f8a418129b2ea210fa6f14bd7e7d9b5e0e564607ce3a6de022327f393a2dfea.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9ff714-569f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779537766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537766, "uuid": "a9c7fd60-395f-40a9-b049-6e91346b0062", "comment": "Malware payload", "value": "632217ab190aac960106f7acaafbd25f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537766, "uuid": "df98b5eb-0455-4aad-9670-89fda916515c", "comment": "Malware payload", "value": "40121825fd5c28eb2809af3ee9b5afc3db298c03ba642694a9f9f7dff9b6e2d1", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537766, "uuid": "75954519-f275-4c4b-acc5-bb7dbb620ef3", "comment": "Malware payload", "value": "d3674189343e06e027d7b3fa3306bbd2c20ce2e8", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537766, "uuid": "09115b5a-b341-46f4-aa36-83f87a0e999a", "comment": "Malware payload", "value": "6bc746a04afa5e3f58d0f1563820084320083998e49d7f61c25c03a9c50017a56f45df8fcef20889d473114bf3ccfd78", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537766, "uuid": "383ff92d-675f-40fa-915d-0eefe7250fe1", "value": "T186064B05F25A10AED587C5B486464923DA3474DB0B36EAEF42C0D2363FBA7F85B39B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537766, "uuid": "5b3ca631-a8aa-4c01-a6c5-df35d8c8456c", "value": "5dc656cca9effbda0d429dcfe08805a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537766, "uuid": "616f231c-ba2c-415f-be5d-61b806c03a2c", "value": "49152:XHjvcX0NIxdYPgqAxJjcBi4TfdazGJfvxKPxvvkrqICut5xL8vST9tOasi6:V/6Wrpg5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537766, "uuid": "7b8e9a38-a022-4c3e-a5eb-f9fd9b2ce00c", "value": 3819008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537766, "uuid": "9bcb8dd2-0a90-46d7-b6b0-d8b5e838b2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537766, "uuid": "95e6b338-84f4-4247-a76d-1bb826ab128a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcab2afe-5642-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779498113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498113, "uuid": "a968cca7-bd0e-47c1-9cb0-38a13128b99a", "comment": "Malware payload (Vidar)", "value": "3ad8b5dc33fc8b22f0105c51baa90d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498113, "uuid": "2a38a8c0-0459-4878-aebc-38e8f3e187d5", "comment": "Malware payload (Vidar)", "value": "410e8554adaed3fd30a57fa84248414826bc81b954200142f1159706c8170ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498113, "uuid": "0a2c57d8-e471-455f-8c4a-2555bb017280", "comment": "Malware payload (Vidar)", "value": "d512f67a3e01f329bc2332f5a6f8ba3e946a6933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498113, "uuid": "56a0fc71-09e3-4959-a351-ddde2abc4dac", "comment": "Malware payload (Vidar)", "value": "e29495e561593d736fccb47302ec6fb9fe358fb4cf207670b29cb8d9c56d5f9d62b15ae9fcecb4619cfd3ea79e1928ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498113, "uuid": "4b7c342c-06d0-46a0-b0c0-c9b2079adc62", "value": "T176F47E15DB2393D9F83BC037D176A7A7FC70BC568228DD3A5AA00E4566A2621723F317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498113, "uuid": "3bf7a8ac-6196-4c05-a633-ef8a48ab19b2", "value": "2d036fca5fab0c142790dd9967ceb56d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498113, "uuid": "1b95a9b8-5ef0-408c-a383-c5fea426e11e", "value": "12288:nioGWXlDx7mgsrNEZd8W8mgM7DVm1oixAw3B9Vhyt4cv+DNcz+1lAwb6N:nioGob7mgsrm78WH7DVlyAwlhyt4cv+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779498113, "uuid": "76c58c61-ba3c-404f-b315-77fcb7845d38", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779498113, "uuid": "9a3605e0-83f6-4aed-b446-9d977b5ffb85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498113, "uuid": "a9f0928e-46fd-4f72-8978-285535c98263", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a1d96e-568a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779528974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528974, "uuid": "7e0a96cd-3ceb-4f93-a9dd-ed6084027742", "comment": "Malware payload (RemcosRAT)", "value": "b8ec51fadfb2679088be299069fb91c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528974, "uuid": "3d281249-1115-4a95-8329-971736771522", "comment": "Malware payload (RemcosRAT)", "value": "4204657530d7f2e692cc0ced28a87adb8740573aa4c9b363d339b9cacda1ab8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528974, "uuid": "9bc30969-8064-4d33-922f-bea199eb8d38", "comment": "Malware payload (RemcosRAT)", "value": "8e0216bb1bbfe8fe1683bdb7d979f594cd1939a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528974, "uuid": "e33f91c4-5317-4bd7-ac78-c03b57150ec5", "comment": "Malware payload (RemcosRAT)", "value": "44c781dbfeef592c52aca3b9e9d4fa32d715f3670847c6dc57e9413770a41c6d3b63bd3badc57f71205fb1843432881b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528974, "uuid": "b3b7a126-d3b8-485f-966f-3c47c0bf8260", "value": "T1BB93D813FA4AD0B2E46591F145426F31CEBCBC3636492173D38FCA41AD79892D416EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528974, "uuid": "1a112c0e-68a8-4c29-acd4-9e232cc55213", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528974, "uuid": "5e1e92b7-7e90-4635-a6ee-9aee60319656", "value": "1536:YhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6krV:+hzYTGWVvJ8f2v1TbPzuMsIFSHNThy+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779528974, "uuid": "7eafb4e4-2010-4128-8b80-e6696a90c52f", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779528974, "uuid": "374a79cf-ebf6-48b2-8a3d-a96b71695929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528974, "uuid": "13137cba-1517-4956-85db-b2d827d7cc1d", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e39763-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579592, "uuid": "2542b52f-dd5e-47fb-8c6b-bd73a7acbd61", "comment": "Malware payload (Mirai)", "value": "e71e011f3af2c77bff40f26e28b9b7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579592, "uuid": "bae02b98-9ebf-41d4-94ea-9855bb46e5a3", "comment": "Malware payload (Mirai)", "value": "42c61cd005472e5df6000d7337a52cff27af5705b764b8b728ce46c32c78afec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579592, "uuid": "00a78859-a0a7-4dd3-9318-1aa3e357c0cc", "comment": "Malware payload (Mirai)", "value": "33bc8c50b6f2428b2d97f2b1df8a30c026e96593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579592, "uuid": "33aa49ea-df7e-430a-a97a-1bae7d141ea3", "comment": "Malware payload (Mirai)", "value": "c85ec02a5ecfeadb3100967f44ece38fedff2de53c2ef354206124bd6da666d282d70e317be0bbbcb44a0ef4aad4a3ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579592, "uuid": "0c1349c1-f45d-47b1-8299-d42eded4568d", "value": "T1A9E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579592, "uuid": "681d1f61-6951-472b-a864-1c7faa5a8e89", "value": "3072:dgZc9h1jlnLA2PiXYeyCcaVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZaVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579592, "uuid": "34815c2e-a3a3-44a9-9622-b4b5d767b52a", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579592, "uuid": "b1f975c2-7f75-4525-8db8-c65cb1477430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579592, "uuid": "243f388f-4acc-4446-ab73-3b9d150f54f0", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333ebd3a-5670-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779517532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517532, "uuid": "ebeba95a-afcc-43ca-9e2a-7aa78abafe4c", "comment": "Malware payload", "value": "b3e778846594ce32157a7aa5dea7a41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellLoader", "colour": "#BEE485", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517532, "uuid": "fcbc76d7-148e-4254-a6dc-4c3e415c4217", "comment": "Malware payload", "value": "435bf9bbd0678035d20b644eaccb3cce2062d90a8a870a07c3cc8b5d6733ffa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellLoader", "colour": "#BEE485", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517532, "uuid": "ce051986-a7a0-4c93-abc7-07074ab55816", "comment": "Malware payload", "value": "4fbda7a37ebd0f42e66a60fef8b6956065fdcf1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellLoader", "colour": "#BEE485", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517532, "uuid": "34eb9a6c-064e-4e83-9b71-e4f0736d35d8", "comment": "Malware payload", "value": "dc793f640db821d0084d97c1ef0d07374d6c8d3048495bec853417e2c656b1a70b07c07006af656c0edac48c91c18125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "ShellLoader", "colour": "#BEE485", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517532, "uuid": "be140010-68e2-4078-adfe-70c731aed14f", "value": "T1C2B21845629C8537E67B5AFE61601A038B71863F6852FB993C8C60AA3FF3351811376F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517532, "uuid": "9ba25d45-c450-4aa2-87ba-4e82bfad699a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517532, "uuid": "33860157-e4f5-4e7f-936a-de68378f5184", "value": "768:nyOTWvTdttK7uX+R3dWIUH66r8DYcV6cizh:nyOTyxtI7uX+RNWba6r8N6ciz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779517532, "uuid": "92c2c345-0968-402f-82f5-d6bc4b3ce107", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779517532, "uuid": "94e57b67-43a1-4316-92b7-5a7bfb1125b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517532, "uuid": "7d8179be-60d2-4a73-86fb-c4e61d19eea5", "value": "CANCER LOADER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5f5a24-56e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779566377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566377, "uuid": "08908c97-47b7-46d2-8b80-e8c5773fca8f", "comment": "Malware payload (Mirai)", "value": "a074916dcbad9bf7ffdd056c2fcafcbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566377, "uuid": "8b14792c-9e49-4e2e-8326-d0d3b45301bf", "comment": "Malware payload (Mirai)", "value": "460683578b9df651bfbd362cefc73e1d3afb815a8a0af06b646a2d0a585df9d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566377, "uuid": "ae537a28-55af-4699-b388-9e3ce464bec7", "comment": "Malware payload (Mirai)", "value": "9de9c6f5fe935c79a5c130c7ee9622c15ec6f380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566377, "uuid": "7c8f13dd-b58b-4479-afb8-17aefae8134d", "comment": "Malware payload (Mirai)", "value": "7b236593ac5bee745e242f632c2ded088bdf81b2ceda1f79cc092c9ef6d042426cb9127b574e4d9a5f3916facd3f3492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566377, "uuid": "a4a950d5-3393-4525-a9dc-543e5da5fbc7", "value": "T10A736BCAE683D8F5FC1205322136FF335BB7E23B1168DA42DB689A36DD52601E25631D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566377, "uuid": "f55b8016-6e45-4774-a97f-fec7257534aa", "value": "1536:nBTifkymdbEAtEMwcv5Q1jbtXg/aKJGJeB/xaDeHEx5VAT:Bmfkymdbz6MDYjtyZGJu/QDZjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779566377, "uuid": "dd731d6c-0493-4ecc-bdf7-7375474a147d", "value": 74828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779566377, "uuid": "0b32f216-a52d-42ec-b075-ee1ee820e941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566377, "uuid": "1ca7fbbb-4ab5-4c4f-83ae-51261a9b91c9", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b4f3fe-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551862, "uuid": "cf714e87-6a89-4538-b001-a45238f3c2c8", "comment": "Malware payload (Mirai)", "value": "53187a8fdcb02ff61cc9165c395ae0e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551862, "uuid": "edb8ce8e-f59d-4030-a7cc-3c738e28c1af", "comment": "Malware payload (Mirai)", "value": "4747ed18f804c6f83b2ebfd846b8c41a353bcede2671ce076e4ae8a5db47871e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551862, "uuid": "a2c3bf2a-8a5f-4ed2-b207-f94f95904b81", "comment": "Malware payload (Mirai)", "value": "45a4b5f8784165e039d526fc05bc222eb6819a05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551862, "uuid": "dd47aa54-ada4-44b8-8169-a2ae0bddcf6f", "comment": "Malware payload (Mirai)", "value": "98e36a7f3d945c8ea1fbefcc689758453646bb67b9c7952ffab7750ebc6223ac32aa310a2e240de3f252c00cea29d332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551862, "uuid": "afceb6f1-866d-4ef5-8d4c-1b1da9b0f34e", "value": "T144360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551862, "uuid": "a63fc862-e970-4a18-92f5-103c10bbcc84", "value": "24576:pjVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlND:v559Id2QET/bY+Ay8vWPMJyB28wAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551862, "uuid": "d1257dd6-27a6-4c1e-bc65-fd9568741e22", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551862, "uuid": "60a23f36-769d-4d7a-8db0-26350f84b890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551862, "uuid": "7060939a-d385-4113-84d4-c7919fd42325", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775ec3cd-5696-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533967, "uuid": "94b3f98a-7d14-46a1-a575-91dda952eab9", "comment": "Malware payload", "value": "562bb01152876363601107aa47ae5d8f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533967, "uuid": "030e77b8-535a-454b-9011-85be4da65ba1", "comment": "Malware payload", "value": "480a915590b1f7ff14365dc2c9a2b3cd1b3cbaa7dd5d88d5a1c6e6b5d0035504", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533967, "uuid": "ff114197-24b9-4c30-84ee-34d88ebcc097", "comment": "Malware payload", "value": "923544c0d398b52d5e8932ead6c59507acb4e63d", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533967, "uuid": "f51f69e9-1ed0-4415-8d00-5c973a7b10ae", "comment": "Malware payload", "value": "902bc5aac7c3b300de78b20fe2ce4d82ba309f3eec7be85986dd4da5533c1d9cd2685dbd7d8fd63bc0eb48bdddc6f980", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533967, "uuid": "4744ba43-dc4d-4527-98d3-1ca3cf49fffc", "value": "T1DC51CA16A3EC462BE4770734AFE3435767B4F8149FB257A959800229AC60B546E31FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533967, "uuid": "a116a5c1-4391-4236-aa57-20fd85ad8b86", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533967, "uuid": "472f696c-0eb1-457c-aec3-eddaada926f7", "value": "24:etGSom/BepOEl/d8d7itoqWltkZfEZXHUWI+ycuZhN3lGakSElXPNnq:6YMUuMto1QJEJH31uloa3kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533967, "uuid": "1d0991da-831a-451f-8f2c-ca6f5fda77b3", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533967, "uuid": "c8796cca-bd92-472a-93bf-bf8614a3d877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533967, "uuid": "795386f7-4996-4790-99f7-9aa6be3719d0", "value": "480a915590b1f7ff14365dc2c9a2b3cd1b3cbaa7dd5d88d5a1c6e6b5d0035504.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b65529-56c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779553620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553620, "uuid": "894b9528-a1ae-4d3a-90cd-c1a77cc8d720", "comment": "Malware payload", "value": "154ffa9ebf8816621fba5d1a49fe6300", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Downloader.Win32.Agent", "colour": "#D43630", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553620, "uuid": "738fb61e-75a7-4090-8d8d-edd10c11a030", "comment": "Malware payload", "value": "495377a021f4027a3c64297f52fdb75771c2b0ad69787306620db1fb3fbe35cd", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Downloader.Win32.Agent", "colour": "#D43630", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553620, "uuid": "9713150a-3230-41bb-9147-1250f6d9ccfd", "comment": "Malware payload", "value": "76e82c3b09f48abb84b242658c45b4e22b0bce39", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Downloader.Win32.Agent", "colour": "#D43630", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553620, "uuid": "1ef9c65d-de41-4bc5-a25f-dd143506610d", "comment": "Malware payload", "value": "c8ecdc42816fdb520d3dcd68877da579b90f2ffe6cd3b370e65d4da06f8e4542fff4b0e7a731be1f629f5abf28a9fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan-Downloader.Win32.Agent", "colour": "#D43630", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553620, "uuid": "44a45c64-7632-437e-aec7-e4c2a7792e4d", "value": "T120469D0BA3E446E1D127D634CAA68333DB717C611738CA4F1596E60A2F33A909F6F365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553620, "uuid": "acda74f6-2d24-4c1d-a114-3119f5a6556a", "value": "c941741b2df2e417e6644d049501200c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553620, "uuid": "3d8c2797-9895-465d-8134-cf0af5cf459f", "value": "49152:MkJ6a/87XkhnJFX0dHPyv72Tvmn+1rN4YiTXoNYbFyx5G1L+ZUKOUCin6hySE7ol:M2dYdN4YqYNYngCwPjG4puvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779553620, "uuid": "93483bbc-5b1b-4c48-8aba-f9634d102149", "value": 5516800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779553620, "uuid": "6aeb2d17-5042-4373-b317-2af83e215a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553620, "uuid": "0e4949f2-5d57-47e7-974d-14621a677ac8", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c075cc6-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779541169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541169, "uuid": "0ffc7181-bf79-4414-b4d9-f57a937d02f8", "comment": "Malware payload (Formbook)", "value": "4458cb082205ead1d04d73ccab88a075", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541169, "uuid": "95a59a53-34bd-451b-a20f-9bf3bef0c364", "comment": "Malware payload (Formbook)", "value": "4a1cf2f06ea8576c62c669fd2f6f9f3557d4aca37abca66419e5cc67c451f81c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541169, "uuid": "3c4e52b5-aca0-4fbd-ab55-2e7c16eaa737", "comment": "Malware payload (Formbook)", "value": "1ba8b90da27f126c9a7be5e60a6a777fad398c02", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541169, "uuid": "0c6d369b-5fd9-4fee-9bc8-8627279913f6", "comment": "Malware payload (Formbook)", "value": "8896693ba7ce8625b6f5494712b0ab5ed68130b8830232d4309deb047877ce90986d2fd3f3089489e85ce18e71bdc0db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541169, "uuid": "094c7f8e-4b6c-42de-b0c7-ea6f5751bc4d", "value": "T19415339DF77E44C823379E035640874C54AEE89FEAFE39A217B9F4B18441C06499EE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541169, "uuid": "b668824c-ce4a-4e9a-bb10-25ad4ea64613", "value": "24576:1YZjwurABNypagJFJHDJ2lHuKOjy1waC4Y:+jTABNHg3JHIlHuPjyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541169, "uuid": "d89902f7-9ace-46b7-a87a-9e68b8dca4a7", "value": 956613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541169, "uuid": "00cd4d56-fb92-4c90-a933-ce29ffbdc0d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541169, "uuid": "66073646-e259-4761-bd2b-b4719ccb074e", "value": "SC_TR11670000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b055f53-567b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779522350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779522350, "uuid": "21870901-1aa8-42f5-a84e-499fba3b886f", "comment": "Malware payload (Mirai)", "value": "b518e426cedf66dd225edee134349952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779522350, "uuid": "e8441e34-6754-41d1-9d80-0b17b9a32b46", "comment": "Malware payload (Mirai)", "value": "4c13460a6b80b35194ef2bc730095b314ad91ad0e39af427808d0d9ac000b178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779522350, "uuid": "2b4dd50d-b24a-4114-bf1a-afdf89cbfb20", "comment": "Malware payload (Mirai)", "value": "0298cb6402fa12b731ab2ed8cfe299280e72296d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779522350, "uuid": "79ce6dce-b4b5-4909-9c7d-e99fa5493a07", "comment": "Malware payload (Mirai)", "value": "24cc18f39bbe229cf0b3a4eddd566296917b2952372cb38bf0b53fdc05b29be22ad0f814357b1f793a1df93157ca2527", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779522350, "uuid": "88136430-0d6d-4361-89be-594c0117185a", "value": "T1E4D33841B9829A27C5E523BBFA6E018D332563E4D2DF72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779522350, "uuid": "280f3995-9240-4082-9268-f81344ac28d6", "value": "3072:snFif7apx6XS+kUgpjWXlsCMobmaY0qhzCQSz:sn8ZS+dQWXlsC17YbOQSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779522350, "uuid": "c56d5f1d-95e6-4900-bd42-505b5f50b7e5", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779522350, "uuid": "2f7c8bef-f0ac-40eb-8ec2-ba47b43bb638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779522350, "uuid": "9348209c-bb63-43ad-b48d-406f4bb5d118", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b48d7d-5670-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779517568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517568, "uuid": "a74f7808-16d8-4fec-85db-b60762b6ce61", "comment": "Malware payload (Phorpiex)", "value": "c8487016eedd07a59af2f28f427964ab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517568, "uuid": "4d949796-222f-4cc7-a277-f8aff5109540", "comment": "Malware payload (Phorpiex)", "value": "4c1c48ce76a82b790ccebc8319a21de1ad7b0892c75651e66a31514015fbe66c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517568, "uuid": "522bc1a6-12bf-4174-b9fd-49dbd5af4970", "comment": "Malware payload (Phorpiex)", "value": "8f9912b609db8074f40ada11af76c5078667b601", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517568, "uuid": "0a7c422f-fd18-47c7-aaf2-25df394078e3", "comment": "Malware payload (Phorpiex)", "value": "d08cea9e82cd155e724a95ef3fb1fefed69941c98ae0aa99f74392a49b04a09bde2e9f8dbf9058d3858b9105e1ce6138", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517568, "uuid": "ba952071-2b37-437b-b040-0c638c67bb6b", "value": "T1C6824B0FF9814216D1E110B05675863BDAB99C72338454EFFBD48A9D0BA86E6FC3225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517568, "uuid": "4ff10c64-10d2-4ca2-bd54-508ae49448b3", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517568, "uuid": "b478c82e-b3d4-4d9f-a1ff-d30ab14a850d", "value": "384:90IJlVYer7bskwAd0ZHu9JgiG7QWav8U9c5:tgw0w9wa0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779517568, "uuid": "acc387be-f4ce-49a4-978f-5908727c3ba5", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779517568, "uuid": "911f2ac7-de03-4788-9255-cc8289cdab4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517568, "uuid": "43a8150b-4c06-4b7f-a219-2b6d8238800b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edc1400-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497043, "uuid": "1941c337-dac6-450d-b04b-b26aeab2e1a1", "comment": "Malware payload", "value": "ad9e61f9d3183add9d080fb99e4e125a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497043, "uuid": "dceccec5-7ccc-4b09-9aee-ed1a887a4c60", "comment": "Malware payload", "value": "4f50668ac4796f909c5903a52a33d7cd4368558354e35a385e66f8dcff06a5ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497043, "uuid": "580b4e7d-7d49-41f6-a64e-234b1e4fe5ea", "comment": "Malware payload", "value": "238038c5d7faea17f6cc870bbaaa0994b56d43e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497043, "uuid": "cb946645-3831-4461-a179-19a10ee65386", "comment": "Malware payload", "value": "4ab29cd4e898dbfb508b3cb3131d432b68cda0efcd89c5f0243ca24ed9b084d6b2bd3faf3531a4348e9be07e5a0f6c94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497043, "uuid": "8e8bb3e5-49f2-4f9a-a70f-b0a92f5d323a", "value": "T19B25E106B6C8C96FE5A760B45BF68274E7F59540C6EBC12AC6548B110FFE21ECC1ABC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497043, "uuid": "7062b07e-27e0-44c4-aadf-9c396ebae541", "value": "24576:yo7MxkHd97YQ9iI8IrKGZreouKSpzkzuM2l6HYzxy:yo7QkH/EQwI8IvRhSpAzuM2UYzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497043, "uuid": "fba4fafc-368f-4424-89e4-df9ae022a7bf", "value": 994850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497043, "uuid": "0fa078c8-27e4-4670-a61c-628a755b2c16", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497043, "uuid": "71dd0917-3b86-4a8e-a9ee-6987f9c1322b", "value": "nqxefxw.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c25d7a-56e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779566257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566257, "uuid": "b3f16931-34e0-4b04-8eab-2616842b2485", "comment": "Malware payload (Mirai)", "value": "5701eedab1c82a5cd78a228c269a0ad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566257, "uuid": "71db5268-c3b5-44cc-b94e-4efd25723b57", "comment": "Malware payload (Mirai)", "value": "50f9f1d908d0515151fb87663b2a0d5a333034764f18f1d4502508bf92a3aaa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566257, "uuid": "c9906a25-b36c-468d-aa92-f135043ce55f", "comment": "Malware payload (Mirai)", "value": "16e06153cc5efbde2ee5607065d8fc5d3d267e1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566257, "uuid": "9a140a8d-fb30-4fbb-971d-ffad44a85456", "comment": "Malware payload (Mirai)", "value": "2518e2fe2ed4c8ea6f65edbad015820a647305abdc4acace023078432ad7e7af1c3859b5e720604f2d67a4d6d2f56ea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566257, "uuid": "a80cd75e-fec8-4b78-a0b8-2eaf6b8c2cae", "value": "T1C3735C17798180FCC459D2B447AF7239C533B03E123DB2AA67D4EF226E49E601F2D9A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566257, "uuid": "c77fde27-0fc8-4057-994d-db7cf33a5345", "value": "1536:sOzHCRESwOVQe0j1qDO4UhBfnjDQlCInTiWM10+GiCRZJ3:7zHSEpQQZAi4YBfnjMCI/M10+Gi0ZJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779566257, "uuid": "bcd6b3af-c10b-4ffb-be5e-512d2854c904", "value": 80048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779566257, "uuid": "8f47461a-f960-41ab-8a51-02a91dfcf187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566257, "uuid": "a6b29285-a60e-4990-a6c1-f57dcd555963", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0bc993-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544415, "uuid": "4b67a55c-103d-45b7-8509-cb69e186b084", "comment": "Malware payload (Mirai)", "value": "7273958968181ce4c08dd135add015db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544415, "uuid": "46a2c35d-7931-48d0-b456-464b3e5a5ac5", "comment": "Malware payload (Mirai)", "value": "5331001f9e39019ebf6d7004a8dfc3aeef4c7ff753cf3ee4e47fc273bb5d842c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544415, "uuid": "94a78e38-7c51-457e-badc-5c3d21394c8d", "comment": "Malware payload (Mirai)", "value": "d930cede18a02ba3ad97ecc327bbb78515f0a3fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544415, "uuid": "a30ab770-ba34-4fd6-88bc-ed3fea9a5cc2", "comment": "Malware payload (Mirai)", "value": "21a4c984a96aaccc56b1a396e0a68c2db97080cd7c12fd23cb1cc79dbb756f39f2dd2712606df50343cffb2e7608cb55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544415, "uuid": "b0c64d86-772a-4acd-aec6-bf157334c4cf", "value": "T10D13027DDE2512A3EB16983990630A9A4BFF58C9CF83BF0DEB60B852705C4057537639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544415, "uuid": "4040e55c-3905-4673-b005-3b26d4ab0bc5", "value": "768:ilkWoNuBjL6H260T1PpEIB+Dk33ok2DtLVPPgeVuCUXLbWINCT84aSfsB:mk5MB/U2zTgm+A33orbXgjPLbW2CTQSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544415, "uuid": "3fbbd3ac-df81-4093-bb35-c924a16ef0e5", "value": 43148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544415, "uuid": "a530e26d-2682-4d3e-bdda-195595c871eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544415, "uuid": "0cba1bd6-be08-461b-b1b8-953cf9e073f6", "value": "luxzz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56667c7a-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541213, "uuid": "cf7b4861-11ae-4f63-a946-07ef99d33099", "comment": "Malware payload", "value": "8b19bdba30b70fd2771ac4b187711a2a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541213, "uuid": "4263ee9a-46ee-4241-a8ad-9f3544e2f036", "comment": "Malware payload", "value": "534b03fbbb60543253e0a9a014180888e811d57c538f13c73c2b03a3ee918e48", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541213, "uuid": "bfded65a-943c-43c6-b38b-058392388349", "comment": "Malware payload", "value": "a723e5b53a7116b68fcacf666bf2627a2694913d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541213, "uuid": "7bf6cff8-6dad-49b6-93ea-4f6f59b789ba", "comment": "Malware payload", "value": "8a8962afef4df1de6a0279fe7281c3c01c2dabfc7cc433382996ee3bb939637c59a16636af3a31de8753d17bc5b1ea65", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541213, "uuid": "c52a66e4-bf0f-4555-8d6e-1a3ffbdafd24", "value": "T113B2A5904B9B0B9177435AFDCDC431A4A674CAF3072004EBF2663B1EA40CB75BE35A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541213, "uuid": "499e92b1-20c9-4279-bae2-9d17169a3e5f", "value": "384:9o9G20u0/08lSDg2PvXQW/HHmUq8dajntRv1GRFXnQ5RstN:9o9WpslDg2PP1/HGUrdqnba1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541213, "uuid": "53653da5-34ef-4f76-9cf6-978c7573f6ed", "value": 24449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541213, "uuid": "a957c877-cfcb-494e-9f75-c4633a2ebb9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541213, "uuid": "7600ccc8-3156-43c0-aaae-529087b69a5e", "value": "DHL Shipping Documents pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f058ca69-566a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779515272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515272, "uuid": "003b23a4-1ebd-439c-b30e-9871d62b8179", "comment": "Malware payload (Mirai)", "value": "9bee964514b66beb3ba5c7570e2c1345", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515272, "uuid": "bc8afbdf-b8a1-4bad-8343-d7f005de42b9", "comment": "Malware payload (Mirai)", "value": "53ef43c728134dcefd92a3121284e618db04e4230da256aa23a901ccfb5b54d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515272, "uuid": "7106948b-0106-4056-9478-949732739137", "comment": "Malware payload (Mirai)", "value": "97964e287ea51abc41ee36fd6ac9feb0292be5f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515272, "uuid": "c084e3c8-5611-4380-af57-df056504758a", "comment": "Malware payload (Mirai)", "value": "d43064c18d7c9c86c21b803f38aa09af2e136f80702f8fbf7cb16f2caa54e558fc6318d9faf6563b653e55f5e7882fb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515272, "uuid": "4361af7d-3964-4408-9a96-e234f4c45843", "value": "T196C32802F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515272, "uuid": "d77ce3c0-f2d2-44b3-89ca-f7f06fa02b87", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BA7WobozQPAdojgaR/K:eH3TghM/1weZbcnITeyosFAIxnJdhgJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779515272, "uuid": "43241327-447c-43e2-8fe2-e50726d0000c", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779515272, "uuid": "324f941a-16ba-4469-b770-d1f4d72f0787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515272, "uuid": "9c71e45c-0fa3-41c6-8003-7a4d17a1e725", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5601b1a7-56d6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779561399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561399, "uuid": "a470cd22-4ca4-4fd2-a528-d70182441468", "comment": "Malware payload (AsyncRAT)", "value": "d6c1328728e411166d7613d52c4ae618", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561399, "uuid": "ac475f3f-e062-4f66-a778-63e167e97f4c", "comment": "Malware payload (AsyncRAT)", "value": "53efaffb26ff1a404c68e769b402cfd492fe6bfbc13c82ee0bc82ae78969295c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561399, "uuid": "fb7c13e6-f1d5-4508-8051-bf841da2b3d2", "comment": "Malware payload (AsyncRAT)", "value": "4d7503e11abc7fd2995a30dfa9bbf52d58ebb7a7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561399, "uuid": "5207eeb1-567a-4146-8cad-8c62da44d5db", "comment": "Malware payload (AsyncRAT)", "value": "ada866de4aa71186d171b19ecfe611737afab411186c1decd004e6aea7f4fc793d558d78c0eb458d8e6d3ab811819c06", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561399, "uuid": "b9ee394b-81df-4091-9341-2255a3b41496", "value": "T1BF231B003BE98227F2BE5FB89CF26145457AF1A32603D54E1CC452DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561399, "uuid": "83c81364-a186-4c07-b9dc-7c2b3786105b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561399, "uuid": "ed98be27-71a5-484e-9629-a2124b9e875a", "value": "768:Nunn5TgoqzqWU8d9rmo2qrcOjPGagAWOzjbFgX3iwHoUT9kdKXgH+72cDZLf+:Nunn5TgNR2dOTKTO3bCXS3UTEKq+7Zd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779561399, "uuid": "4140dbcf-15f2-4ea6-805d-1092f13dc67d", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779561399, "uuid": "3ad967ce-e8f6-4894-a7ad-7301adf2e027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561399, "uuid": "4da7534c-be0e-466e-a1b6-6418ddedadc5", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642c556c-5693-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779532646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532646, "uuid": "a2e44598-27e3-4698-a56f-1ddea2200d8a", "comment": "Malware payload", "value": "79c3aac8ece7bb9cf5091441af449368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532646, "uuid": "d3dbcc0e-207b-4b11-9cf5-0a1f4a7bd46a", "comment": "Malware payload", "value": "5584a8f05eaf96c914a3a4755390550d3a962266d9100ff97ce40730adefac3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532646, "uuid": "ef63b4be-0b7b-4608-9576-a7879923b06c", "comment": "Malware payload", "value": "e9bcf5f40b1ca5dcfe7dff43cca4dfecb776f332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532646, "uuid": "3dcf6644-ae6e-4638-8117-e2fe48ca9589", "comment": "Malware payload", "value": "fe31d78d841add3982e71cc9a92958d1f5473d7e7d69d18d3b6701cc99e6bca2a1c61f0f22b4953c3339a00161880e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532646, "uuid": "fab3c934-53b5-4181-afb7-8d2d6bca81dd", "value": "T1FCF733144060C7BADA7FF6BF04A30B33A77583BF05B56B0BEA06B36537726069850967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532646, "uuid": "7da54a06-cfbe-4f1f-9daa-74c883724787", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532646, "uuid": "bc802aeb-32f9-47af-8c1d-00dc718c701e", "value": "1572864:jt9IKP72OO/RQRWYce3FW4D8YOOmM8VoI21X3JbsT9sdIThkKe8y2SG7:jUKD25mRW1e3FfmfM8VO1XZbEsCyKyG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779532646, "uuid": "104b1ba3-7428-434c-825e-4f7503d86f63", "value": 75838416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779532646, "uuid": "8fd3ee62-6efb-4ba6-b26e-774b066fef81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532646, "uuid": "dbb086ff-b812-45d9-9765-5640c70d51ac", "value": "Start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c292b20-5675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779519828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519828, "uuid": "000facba-fa6f-4d41-912a-1caba8e248d5", "comment": "Malware payload (Mirai)", "value": "b44dffc91dc9881e7c04f0343a41b138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519828, "uuid": "31cfd96a-420f-476f-b0e0-d61c22398289", "comment": "Malware payload (Mirai)", "value": "55b6b18347507b20256169b6d3024602427dd0b133a4d0b9b45cdca8de87ee42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519828, "uuid": "bf37c0ad-4391-4672-9d04-7756c3d51ce3", "comment": "Malware payload (Mirai)", "value": "ae260687a44c4f6bbb28a3a52618904f0a689e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779519828, "uuid": "4e9824f3-5ce4-4394-8585-a3cf8a388c12", "comment": "Malware payload (Mirai)", "value": "645c5760d3f4c544efff9f45a13d16873b03bf489a62a1842c6ecdf6096163f5204dc4025dd311073060a1cfaac91a83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779519828, "uuid": "986d2e17-86a2-4eaa-9c06-90b382625f3f", "value": "T1F8343B45EA418A13C4D117BAF5AF418A3332A795D3DF730699286FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779519828, "uuid": "15597761-c89e-4380-9a96-3505be878cc9", "value": "6144:sQYf71sTafH/a7KKck/l9Inplzv6f9ihM/9eAU:sjxEiH/a7KKcktOpZPG/wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779519828, "uuid": "4a22faa3-bcf7-4a13-a6ee-7e5e7bea314c", "value": 230968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779519828, "uuid": "409bc738-9dcc-4dc3-a1d6-382516bad715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779519828, "uuid": "62080773-5046-4651-bac2-977376a39206", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836a0fa7-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497050, "uuid": "2597909c-8eb0-4644-80c7-c0a409c4185d", "comment": "Malware payload", "value": "0f627498fb204a9e2903faf1696d909e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497050, "uuid": "f47f6f5a-430f-49da-b64e-cf5e8b21e511", "comment": "Malware payload", "value": "55e69bc1b8367a9f6d57c2c57d1b799d099f49402ff8e2a1b7e5a37bc08c3d1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497050, "uuid": "4e557467-74c4-472b-8da9-2f9b47a55b0f", "comment": "Malware payload", "value": "47bff4bab03277b20a1a63c94d6c51980eb175ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497050, "uuid": "ff01fc2f-e6a5-4ee1-bb82-d3beddad2234", "comment": "Malware payload", "value": "1f0c4ce978d3210c63154cd7bc886f6f0e4deb903b108f3344ae7af617cee772a00158d48896d684733544526b8db0cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497050, "uuid": "88cd1311-8abd-4240-9edd-a6d7093e1296", "value": "T1A425E11AE91190B9E4B360B1534FD37BC864AA3452534CCBFF5A2D68A6362D09F3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497050, "uuid": "51b704f4-e652-4088-9463-fed5354c27b2", "value": "24576:h/cZLpHt+FUSzn3MjxptKfF28ns6os+JMbMRFwOjIQu:h/cZLpN+FUU30fofAis6J4hYOjIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497050, "uuid": "8a50fa00-d8e4-48bc-a32d-1abf0ce0e73d", "value": 990262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497050, "uuid": "664dcf11-2d1a-4515-9049-638f89b6a4ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497050, "uuid": "776db002-3eec-447a-968e-8a40a03bf167", "value": "nvbiyjp.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ba10d7-566e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779516831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516831, "uuid": "059516e6-dac1-4d29-9211-1305994594be", "comment": "Malware payload (Gafgyt)", "value": "775cc78a7352dda3e6c89da5a283a735", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516831, "uuid": "c7b894de-71f9-474e-b20e-f75a621f421d", "comment": "Malware payload (Gafgyt)", "value": "5839ee721dcc485bcb03386fabb7f4ed4bf118430319bc6da8cc3c03fbb0f794", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516831, "uuid": "a3160415-3614-42b0-9162-c7428f6327b7", "comment": "Malware payload (Gafgyt)", "value": "8f2e01e63a95455b4edd94180750f5d7f438a5fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516831, "uuid": "7180659b-4bb4-4a19-8312-77d58f7d5bdf", "comment": "Malware payload (Gafgyt)", "value": "ee182a0b4354bb5fa53123d19fcb974ab78d2f43c5c187a7f02bae08199dacdd1f35c9cc9183763ac3ac4470162a846c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516831, "uuid": "8374d3e3-b80d-4bbb-a05a-84aec2057ff7", "value": "T1394182DB12520BF7ACA5E83332B444A0F9D4A19594C5DF0B2DDC3ED458BFDAC68456C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516831, "uuid": "3cad3772-934f-4325-8298-5fd75833a929", "value": "48:1ed8RZttQdMiFgfbNp+TuU2IwLL3Z5vIwr7qT:1ed8RZttQdMYgfbNp+TuU2IwLrZ5vIw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516831, "uuid": "8dbfc668-ff5b-40cb-abc9-016bc84dcd55", "value": 2140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516831, "uuid": "8ae5a157-3d74-43ca-b6b2-ab479d9fbec7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516831, "uuid": "7a8f2578-75d3-42dc-8591-7aae4799b8b4", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71731faa-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520213, "uuid": "6ad379ab-395f-406a-a6bf-9d3b457c0325", "comment": "Malware payload (Phorpiex)", "value": "3cc2199412fc693e4e87f0d738b60900", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520213, "uuid": "d4d23cf3-6432-4938-aa9f-40ec62cdaaaa", "comment": "Malware payload (Phorpiex)", "value": "587f74f44407937319c3aeaf710f040a4a34ee9abd5982aa39ba1960d5892252", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520213, "uuid": "6d87be99-b35d-4355-be64-eb1b20d7d3fb", "comment": "Malware payload (Phorpiex)", "value": "5ec8f56d7735ba29a7fb2f9d791261fb38a79b90", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520213, "uuid": "e1f642c6-8695-4fd0-a3b6-7ac3999af128", "comment": "Malware payload (Phorpiex)", "value": "e5a42fcc0457f2dbea0ffda69c38e7753a560b611ab3e9f54d75a42891a1163807fc9d5059fc04e4b90799d96e36244c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520213, "uuid": "8120a9c6-39fe-49c7-8186-1d955ed5a675", "value": "T199824B0FF9814216D1E110B05675863BDAB99C72338854EFFBD48A9D0BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520213, "uuid": "782a200e-9e5e-4707-86aa-903c6bf3f650", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520213, "uuid": "d2fe2234-a47c-414d-adf4-79f4d9d2715f", "value": "384:8UIJlVYer7bskwEd0ZHu9JgiL7QWav8U9c5:Gg80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520213, "uuid": "db4d5a9a-400d-4425-8e0d-95a9968bc5a2", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520213, "uuid": "cd3b0fc3-c775-4c99-ae28-9c4483c21fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520213, "uuid": "ac5153ff-d133-4221-870e-a5ad77aa4d2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8436968f-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497052, "uuid": "4a185a91-5ad8-4a85-ade0-2cd4127da781", "comment": "Malware payload", "value": "62343079a0daf6e98c65f148e87b1f27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497052, "uuid": "6f94ea2f-0b12-4ece-a2e0-5e75d36e5d26", "comment": "Malware payload", "value": "5a9626022460002ca60c8eae58e0afad87e41b3422c4f3f63cae1d1daa66e111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497052, "uuid": "f88659e8-3be0-4cb4-bda8-923c910a0c77", "comment": "Malware payload", "value": "1567af21a78987e9b2b0665bb57a3b4f38130b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497052, "uuid": "d8980611-de08-4bd4-8d50-70f08f36a65f", "comment": "Malware payload", "value": "b69b96b9a16e6a0b276e818e921d6bca3637be822e106af137bf60f7a230ca273408630dc5f796ee0667cb6b49f266a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497052, "uuid": "67078f4b-31bc-4e50-ad89-24e5c613c239", "value": "T1E2450219750C2A32E3C7F83FEE4EC6B2A022B4F95799C0607913815EE3849D95F69F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497052, "uuid": "5e833960-ed1c-4308-bf89-258e1be9533b", "value": "24576:AO4Zz6ac2h5PFLIj5Ot/cf+MO/hff12m/AorS0Gdx1hS2RdTgSQI7Om:uc0ZA4cfjsOor7Gd9D6St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497052, "uuid": "809d6c6b-01f4-4f7a-adcb-a3a567874fc6", "value": 1242377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497052, "uuid": "6bda92c8-83ec-41e2-9730-5c1491e8bec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497052, "uuid": "e3a953e1-3e42-4a17-ab32-95f1aed8978c", "value": "czwzdzt.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2184c50f-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541124, "uuid": "77fe3a4f-79cb-4a6d-91f2-5cff9785508c", "comment": "Malware payload", "value": "0f838b45bf59ccdf4ad541aea399b267", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541124, "uuid": "0112c4fb-f5db-4e69-a3a6-e346310d2784", "comment": "Malware payload", "value": "5aaa718d290c97867f127a4dff6ca8d9afc02d7568c079f1271174fd595bc925", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541124, "uuid": "176e0627-378b-403f-bfce-f5c8b53359bf", "comment": "Malware payload", "value": "15b908c27dd51753dc3c271bf455141e29c5fadb", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541124, "uuid": "018f352e-7907-49fc-9a84-25988babb3e2", "comment": "Malware payload", "value": "ffadff2fef3d76d185dd123e4164a738ff347c76bbe90adc1f89792753345969f60aaaea10f3f6b1401e4dd7a8854b0b", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541124, "uuid": "0503b46c-f33f-45e9-a004-45f451edecee", "value": "T1F4C6123BB28BA53EE06A5A357972E214543B7AA1A5128C16D7F4D44CCF350B01E3FB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541124, "uuid": "f2d5138d-86ef-4acd-bb99-888581c5ce3a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541124, "uuid": "f7e62b02-13c0-4600-8d46-f4956a2f5ca0", "value": "98304:E5/c3zorM8TWKX7gfHYPUzmM81U9asJcWBa:gXpgf5z9RasJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541124, "uuid": "aab651c4-e678-4b36-a857-3a9abe2abbd7", "value": 11606917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541124, "uuid": "9a3dcead-8ec9-4163-bcc4-ab93059c8a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541124, "uuid": "94ccd9eb-4067-4b5d-92fa-d1ce212879a7", "value": "Activ_Kms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2607084b-566e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779516650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516650, "uuid": "c2a98d77-2e72-4c69-a4f3-b2fce60b128e", "comment": "Malware payload", "value": "eb79c4251b1def875dcb1494dacb3cf2", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516650, "uuid": "8afe6522-3461-40e6-b441-5f3670d3f39d", "comment": "Malware payload", "value": "5b2d1ae45ef10d366dfff2da65d90406fc922170f876333130da8e7d92dae4d6", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516650, "uuid": "93c5b00e-a61e-470e-a9ff-b3907f014e50", "comment": "Malware payload", "value": "9f033b4af7550b4c1b36aedd76ea2736a6bd6e24", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516650, "uuid": "ec7a3512-3636-42e9-9471-6c1f8581662e", "comment": "Malware payload", "value": "f8182538f7c48eb83870040ee9f067ddfa6dfa47954d5ffd737433fc596aec0bf17a431465a275ee6e9d5d54c308dda9", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516650, "uuid": "158c7dbe-994c-49ca-89dc-016729980d49", "value": "T17E910A2E3FDEC44AC507417B998AC2D2B5A517588215760F0A37252C1DE0B0B5FABFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516650, "uuid": "7ee74f4b-d7c1-44f5-97ee-9664cd244f22", "value": "96:NVJi2i1WXgN4T5p/NtIbKfmH9QI2kAzV6MX4+xsG62+:/lTwmS4kNyXxf62+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516650, "uuid": "19bb6e4a-e33d-4f76-b1b3-90a73cef55bf", "value": 4269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516650, "uuid": "c37cb496-0750-472d-b0b2-1ba9948b67f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516650, "uuid": "def51cfb-19e0-4ef8-b6e9-484f3e0f4c81", "value": "EchoVoiceBeta-1.0-SNAPSHOT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9d3ce8-56d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779562806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562806, "uuid": "e4f0f2b6-dad7-4949-8a9d-7f1ee2c6bdf8", "comment": "Malware payload", "value": "764777453340e9e9ef241e1e4b92b1e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562806, "uuid": "f9d1ecc6-ae08-4e30-bc32-dec7118909c6", "comment": "Malware payload", "value": "5b4e9fc4c7589dbf78e5456cd66d7db52697ba72a2653e336a0c21f48a531e6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562806, "uuid": "ee6998bb-b3a5-4b7a-bae5-083731a7adf1", "comment": "Malware payload", "value": "f679d2b2b278e919c3961820a07d6b97161fe074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562806, "uuid": "1797d9d5-5cba-4bab-96c0-cbf7dcf08968", "comment": "Malware payload", "value": "ff0363fb7334d9cc18ea9b657a60b5047c38c0e4a48af879127f87393b83b3667960af6edeb7b02e4d9b9ad51f1d20a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562806, "uuid": "271b834b-6a23-4952-9aef-7edc25b5a410", "value": "T1BC37CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562806, "uuid": "544113b8-c3b3-4ab6-bccf-f94c54ca85cf", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779562806, "uuid": "50cf7071-8ac4-435c-bf1e-6154a2fcbc03", "value": 23756800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779562806, "uuid": "e2882102-d511-436e-af99-7b56ecfd9f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562806, "uuid": "9e3c2333-e758-4666-b7ab-d2f803176fe4", "value": "5b4e9fc4c7589dbf78e5456cd66d7db52697ba72a2653e336a0c21f48a531e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be6d6b5-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1779537706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537706, "uuid": "429bc8f5-6258-4e41-b851-34b30bcee6e9", "comment": "Malware payload (NirCmd)", "value": "8345bcfc0845d0a43020db9eea35d096", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537706, "uuid": "9ae887a2-c3d7-4470-88e9-b33d592f5653", "comment": "Malware payload (NirCmd)", "value": "5d69db1c86c65a63602f18f880f3c8418374b646fb62ab467e72bbb745f1dbe8", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537706, "uuid": "24136c3d-2aa4-4813-8338-121b09a4f978", "comment": "Malware payload (NirCmd)", "value": "1c29aab3f55a57e58421fab34a0ff9a114304dc1", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537706, "uuid": "6397c664-7022-4ac9-8b63-0fc9e288e690", "comment": "Malware payload (NirCmd)", "value": "332fa7c745f62484bc054b191a2bd6d0e7d52c911e63ad160f02b9bfdd1bf05756e4308f32e84b680d00f0171a25eff8", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537706, "uuid": "b5a8a353-40a6-4b81-9058-53f044c79b58", "value": "T181A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537706, "uuid": "6e8be842-01f2-49a3-96d0-199ae9d78f32", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537706, "uuid": "ba8d2f68-f058-41c1-9406-f35e6b9e3e3f", "value": "49152:ABR9Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:avTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537706, "uuid": "4d72fa1b-8503-4b9a-a547-07db87c7f8d7", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537706, "uuid": "fa9bf312-4889-4d21-8328-62232e7cadea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537706, "uuid": "2914c205-f155-4561-aa9c-a380fb4fb049", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b049eb07-5693-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779532774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532774, "uuid": "adb8e28b-a5a0-495a-b2bc-5ce1ec8db3e6", "comment": "Malware payload", "value": "08983a77e018d225d1770c20a0b43465", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532774, "uuid": "66726f40-503c-47bf-bb2c-da6723812aed", "comment": "Malware payload", "value": "5df87bfa17e98e1a22763d1d142656dbcd2831bf577514aee6d975347d225310", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532774, "uuid": "ad7545c4-8f3e-4e7f-bf29-97e1d612cbe2", "comment": "Malware payload", "value": "653c5d050a33158f94266f1a5dcc849281439bdd", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532774, "uuid": "5f3becff-b7dd-4742-80f2-1ee8a64263e3", "comment": "Malware payload", "value": "2d687b505e0089d10378b504f603e0e2463deb67fe349387748fe4258015613f19c1fa21b7f2d7ce9ed6619556c22782", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532774, "uuid": "8212a558-432d-4de6-8bda-72a9702a21b4", "value": "T161029E26E40640B2E239B372DF7B4D6EE5F4191C175A2EB970F2A9579425C11B743831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532774, "uuid": "ff38b8ad-a49f-44d2-8e21-75f56ed390eb", "value": "192:vwJWEEc2KOW0cGcRelTSax0wLui424gnc0UzOAaBm+:vwJWEuKOzcwZLx0acgIqZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779532774, "uuid": "922c77b3-53d7-41ac-9811-ec574ef1cc25", "value": 8852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779532774, "uuid": "1007bb59-e169-48d7-b1f2-8d3232c1085a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532774, "uuid": "9f9bc2eb-c4cc-4b93-b102-1f7c38ef53e5", "value": "photo-917849926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473d7de7-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779541187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541187, "uuid": "f6abe1c2-5e82-4b2b-8159-be89a9746abc", "comment": "Malware payload (Formbook)", "value": "7a0b7100b59af841cd76ef84329ad855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541187, "uuid": "f6702cf6-01fe-4f3a-a8c6-e1e045e05f3f", "comment": "Malware payload (Formbook)", "value": "5e0e2876b259ae4c3dfdd53ac472e0759de1f00c590c6c02f3e1d9ff92e1d78c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541187, "uuid": "05c5eca8-987b-464d-9f61-73c8689bb509", "comment": "Malware payload (Formbook)", "value": "d41024cf0dab50f49fcdf058f8c2192e1f99b1e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541187, "uuid": "29d556d4-312f-4f84-90f6-dc5c414f4add", "comment": "Malware payload (Formbook)", "value": "af0e16e5a7e71d693b1dff0c33c2593c087d16f4de60371539fa937c92efacca918f213f2a48708b60b5901bce325ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541187, "uuid": "5d97d8c0-5f6e-48b6-8901-cb3428d13e9c", "value": "T1DA251215621AC80BC4965FB42C75E2F867F85ED8E821C207AFEA3FDFF47A7551846202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541187, "uuid": "e567871c-02e3-41f7-9e93-bc88832ba377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541187, "uuid": "e2ea54e0-71d8-4376-a05d-615a965c5aaf", "value": "24576:RhwZttB6sVXhFvdmn4MkcO+VSCSyvcMBu2O7:/w76AFVmn4MkcO+VSCby2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541187, "uuid": "3587a4bc-409c-42b0-ae88-18dcf043b76c", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541187, "uuid": "788c9409-5b73-474c-9348-b52d3130c5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541187, "uuid": "cb81db99-fb15-4b71-91aa-de500d72fc40", "value": "SC_TR11670000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66793b13-56e2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779566580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566580, "uuid": "394aaae2-0317-4883-b6b4-3334ce7de6d9", "comment": "Malware payload (AsyncRAT)", "value": "e2c774b042972a5743d5a85987ba2fdf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566580, "uuid": "225bcc45-af9c-4ed0-a2dd-4dc1204c5bf7", "comment": "Malware payload (AsyncRAT)", "value": "5ea18c043cab9c3b175789bac804573f11c984e3625a54a2f452a3d3383527f1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566580, "uuid": "f34d184c-6bc0-4f9a-87a1-071af617b9aa", "comment": "Malware payload (AsyncRAT)", "value": "49b3c4b87d7343d1863bc03d66e43061c4c2c916", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566580, "uuid": "9cef4c92-42dc-4566-94dd-01dd5af16b7e", "comment": "Malware payload (AsyncRAT)", "value": "016c11c03a6abe1a805a4807fab30ff08d1526f91860174fd68b166f24332ce5af9922407ef7ce7f2fa5596ce1f3efca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566580, "uuid": "bfb37ce8-6e7d-44f4-8d7e-48edf5cae93d", "value": "T147233B003BE98126E2BE5F78ACF1614187B6E6633603D65E3CC841D75B137C6CA52AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566580, "uuid": "e1768c94-2d72-46d5-9a66-7308c861968b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566580, "uuid": "d003c5ca-17cf-40c6-b9e3-29d0cdd3d91d", "value": "768:YCq/z5bX/wPLsekOicvHk3eHlWMPbPgF0qVM7UuxW1DyJsPNYI6OC22tYcFmVc6K:YC7seXvZH0ub4FrVMIux6P76O7KmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779566580, "uuid": "5d2a98bd-13d1-4a06-9670-45ba814785b8", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779566580, "uuid": "6ae48e02-c772-4f3e-8aeb-63d868bd3582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566580, "uuid": "0a876bb9-5978-4740-b487-9c8deccfd86d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfed70aa-5662-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779511755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779511755, "uuid": "9cc5a558-0f80-40ec-85b5-4fc3847c67bd", "comment": "Malware payload (NanoCore)", "value": "b75381cd12ac2715c862a6275e17dfbf", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779511755, "uuid": "f607267f-a963-4099-84a8-85be86f3989d", "comment": "Malware payload (NanoCore)", "value": "5fe8bc65fdd5c566b00f62848b355e5932a5ca5f54b3fa2c579ddb9513354c8d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779511755, "uuid": "e348196e-ccb7-40e5-98ad-ea66810d8c8c", "comment": "Malware payload (NanoCore)", "value": "db58fa8168e0853334f5cfb2850f44d9244972df", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779511755, "uuid": "030f33e7-9750-495f-b5c2-919d8082e177", "comment": "Malware payload (NanoCore)", "value": "b3a3d456ed5404925a0043f425142de3076667ae72593229e4dcd0b772ab76626b739ab528e1f4c77a437044d935ae21", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779511755, "uuid": "0809eb0c-279c-4cbb-9e2b-ac58eaba3665", "value": "T1B714CF1677B84A2FE2DE86BD711202178378C2E3E8C3F3DA68D465B65B663E506070D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779511755, "uuid": "69b89333-2bc8-4c22-89b3-0929cef25047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779511755, "uuid": "30bdf4c2-2f13-4464-9f60-7becc2b0c033", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI6Pbfp4ZaXfhRAG6KZnpGiLLO:QLV6Bta6dtJmakIM5vfZXjZZn3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779511755, "uuid": "81824b6e-263f-4640-afcc-a9bbcf788c24", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779511755, "uuid": "cff86717-622c-442c-9802-eacfdce52a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779511755, "uuid": "b2324510-aa22-45e8-9162-20e7e5a34b94", "value": "hayedi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58701c5d-5702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779580301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580301, "uuid": "e8a0dc58-ddef-49a4-91e7-fad9319c05d6", "comment": "Malware payload", "value": "e49c54249d561d0769e2d8e442ebaafd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580301, "uuid": "4d3d0d76-8825-4a66-92e4-9e955cb0f4f0", "comment": "Malware payload", "value": "607b08c7e390723ee5c1929003faebd31fe815ab9406e7047167d0131e953fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580301, "uuid": "da8e77c5-2faf-43b3-98eb-af510678db07", "comment": "Malware payload", "value": "91cac1ad7e9d6e57cfac1193163476900b911e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779580301, "uuid": "acd76611-6aaa-496b-a169-8a119d1682c9", "comment": "Malware payload", "value": "f7533566ba368d270db241c290000a89dc7668d53dc380a63c13173e1651f4bd5581ff23f33f24d33f8aff5ce7efd7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580301, "uuid": "a64ffec0-4e3b-49d3-816f-48707152df6f", "value": "T1BCF7AE1AF202DDCEEC0152BC889EC3A62361EC61CA56C3A773563B2D7FBB94C4D55A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580301, "uuid": "1e0eea9e-1a4d-41c1-8460-c8b1303f86f6", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580301, "uuid": "d16d24e9-6ef5-4324-b7eb-bf4b182ace35", "value": "786432:6ftXNlNCxdpGIpPQXRUvoMo0h3248y4kkAWOQmrqykFqiLhY:cNORBvoMo0vGAmyka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779580301, "uuid": "73c6f066-a893-4763-a31d-9fda595b345f", "value": 74344792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779580301, "uuid": "3ef187fa-bcee-445c-9c65-98c4f6d2f6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779580301, "uuid": "09d8442b-a30d-4987-9f96-7055994a7738", "value": "instZIP.586506.xpc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f96582-566d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779516456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516456, "uuid": "e0c88fd7-3a8a-412a-9972-02587142062a", "comment": "Malware payload", "value": "3b8e151e042e4fff3fd8993432b4eb55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516456, "uuid": "abc891bd-f234-4aa7-9e4f-86a9952fc15f", "comment": "Malware payload", "value": "61e83b53d9dace395f4df620c522a4108bcee0dd8949c2f6ea6cc004aded66b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516456, "uuid": "2e0ccff0-0c72-41d4-8fdd-83ebfe2e0af2", "comment": "Malware payload", "value": "3ab46d8933964d9972541866a2fc5fe7039e41ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516456, "uuid": "4b00d678-8816-41bc-b185-4217efef138b", "comment": "Malware payload", "value": "db08264061413370785db77d3aa3fa1eddb3e313e88f33554ea4801dcfce12ec806c702fbf7e1ffe9f1d9af2c418c32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516456, "uuid": "b4209e29-2ea1-4d21-bcf4-86635365f193", "value": "T16BB559C6A61605F4C389823491E78E672ED36D0016EC258B5B79A30DBFB11FA47B1FD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516456, "uuid": "87a42ade-11c2-446b-8385-6cf58b960159", "value": "ef0823bdb8c49d1a9bc4685d05c9af8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516456, "uuid": "30b10f72-d5c2-43ad-9b79-844b05dde759", "value": "12288:HAi4fQS+6Cukt0eVQWQ5B7ZLMLLuGA1+tDcH6hIxDgy7EGBTx3JfVHqH0Qk:gx6mkt8WQ5rLrnODqndgyAG3JfVHMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516456, "uuid": "dea52243-7a32-4079-aa20-eddeb9bca2f7", "value": 2383360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516456, "uuid": "6e91287c-6618-4d5c-b00e-eefb409b94e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516456, "uuid": "c45e2b7c-b52c-4d41-b2ce-f293b9884312", "value": "Hydra_Inject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f94857b-566e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779516828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516828, "uuid": "b2b06f21-2550-483e-923b-44c5b5957af6", "comment": "Malware payload", "value": "d7f684659575575e90084fe49d9f259c", "object_relation": "md5", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516828, "uuid": "cdd3dadb-2f80-4648-8323-4aeb7f5f5c11", "comment": "Malware payload", "value": "62185ce6ea75e3987a1310673fdedd8db4b1955957206c5324c8880b6f742229", "object_relation": "sha256", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516828, "uuid": "cc2ba17d-ccb4-46f1-8ca0-f2ab8af04a6e", "comment": "Malware payload", "value": "e3648f68b38c3538cc3c4b0d79b561d1dcac172a", "object_relation": "sha1", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516828, "uuid": "9217ac89-142a-4929-a78d-1f19c43c15e6", "comment": "Malware payload", "value": "031c8a081272a08d94c99588f8254b69955552c1732629ae7eca37887d6a45383b8f377b6d9d5f62073cde45ff3b604a", "object_relation": "sha3-384", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516828, "uuid": "56cd789b-efd7-4a50-bd72-574e4c8d8035", "value": "T1648523427B6598BDC864823861DB0A16A77178504B54E9EF138853BAEF373C21E3F736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516828, "uuid": "fd90707c-1b19-4e13-9dbe-04965ce169a1", "value": "80c73d5c3cd09954990c9c384d76d919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516828, "uuid": "7f87a8d0-6b74-4c70-aecf-091d80e4bed7", "value": "24576:SvKrmv69FqHQG9wXxQY4J2MckgaZNlxPUYS+p9urwPTjWEnCMDIL23JIV+eKyGZQ:xrz0aGLJBXbj0EAcPU2WV9Kv0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516828, "uuid": "cdb2b004-e830-4c66-b172-904b5b12da60", "value": 1774440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516828, "uuid": "fd9a8fdd-fd71-4107-8358-4dbdf0062ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516828, "uuid": "835d6705-7d49-4814-bd0a-da1a5d70d8fd", "value": "62185ce6ea75e3987a1310673fdedd8db4b1955957206c5324c8880b6f742229-libcurl.dll--", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed4749d-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779551857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551857, "uuid": "e18b1b69-ba67-4f5c-884f-0d1903d40863", "comment": "Malware payload", "value": "23018f6639002579bd7ff8ecb937a040", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551857, "uuid": "dbb6cae6-c66d-489e-87d6-b10b6fc5b6d6", "comment": "Malware payload", "value": "6298d0285eddfd86c68e1887758745e5ce19b327d09709352489951c3d57defb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551857, "uuid": "921c7226-ebca-4d5b-aeb6-696976e8f25d", "comment": "Malware payload", "value": "5569ca856a1fc5c6023fd8337664866eeb9909af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551857, "uuid": "04fb0d37-ff9a-40bb-9ec2-37108336cf96", "comment": "Malware payload", "value": "1300a9714cdea21bb9184cf98f7917943a4d888639565f47a36d91479a96ada9f7f40e253e705f409c2fb5213e7ddbe7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551857, "uuid": "b4ea8100-4699-4290-962f-3cf74c2e03ce", "value": "T18041468B62E090B3CC69DD41F35494C4D49B86C371EBAEBCF8BC55A2489941CF1BAB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551857, "uuid": "af1b7ea9-bfd7-44c8-ac02-7f59dc29dbcc", "value": "48:ZrcNr2b20KhxRIx/xBxPpxBpxE8xQx3xjKPpxzKP852v952v47DcHpc8rXC:FeaqsLHGeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551857, "uuid": "777ae256-1823-4eac-92b5-0bd1c7e3e721", "value": 1948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551857, "uuid": "0ba741a6-7242-4b6b-8943-d14cea3f3634", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551857, "uuid": "1e1923e3-c6d9-4186-ba95-c11f7a8bf512", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0428e4-5688-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779528173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528173, "uuid": "f66eb1a8-6309-4d6c-b2e4-8cef7d416189", "comment": "Malware payload (RemcosRAT)", "value": "a817c1da5e42c4282d199153220b4fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528173, "uuid": "4fc53853-41ac-473f-a418-cad336c55d23", "comment": "Malware payload (RemcosRAT)", "value": "62990fa81113182214006a416dd1237c51f9df7c6343f7ba0548e57a2afbba47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528173, "uuid": "b81b2911-0f34-4027-8f3f-99369e4285a1", "comment": "Malware payload (RemcosRAT)", "value": "fb4735c9b1df0c3a43816dc4f9fdc3c0f880eba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528173, "uuid": "58341127-9caf-4645-afe4-4dc156f7c83b", "comment": "Malware payload (RemcosRAT)", "value": "e3fdb707857b2b6e2b8315434d3322787d64961bf3fb24b167019e62d0c22cbee0b0242375ee9af7ce6713dd506c139e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528173, "uuid": "cc3b8de2-1ab5-4970-b6a5-37034888ed02", "value": "T17493D913FA4AD0B2E46591F145426F32CEBCBC3636492173D38FCA41AD79892D416EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528173, "uuid": "8fd4bb3c-29e9-4870-8c1b-19a5f7d85884", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528173, "uuid": "20cd6927-2193-427c-aca5-9a316802f516", "value": "1536:4hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Xrg:ehzYTGWVvJ8f2v1TbPzuMsIFSHNThy+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779528173, "uuid": "955e0715-49c3-4527-b99f-a97f331fea2e", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779528173, "uuid": "31a1d825-6221-4a47-9bb0-0a254b12604e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528173, "uuid": "90d759df-8b60-4a06-bca0-77c09f8e9742", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc04b98-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520205, "uuid": "45d7336c-1d0f-4d0b-856e-ab29fa0b5549", "comment": "Malware payload (Phorpiex)", "value": "25015a566081d53e31fa9aedd2c0de96", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520205, "uuid": "d2425547-34a1-4c21-b396-6caa05c0baf4", "comment": "Malware payload (Phorpiex)", "value": "636842a9251aed72c6a97e54579f9547f1f8c001a8309b2964bf21ba30e96032", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520205, "uuid": "fc1cfc84-3f3a-49f1-9847-fc5ec639b0a1", "comment": "Malware payload (Phorpiex)", "value": "5c57ea12a74a3566840fdf26b9cc00ed713be055", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520205, "uuid": "a98041af-6041-4782-91ca-e80267ddf970", "comment": "Malware payload (Phorpiex)", "value": "6618610feb0363e09dd15d4793a11210c52e278292b868779ac57a43b32bf836376d09bcad9e848c92f7a512a18becd7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520205, "uuid": "f9186371-b2ca-4714-9798-2d54d99ce02b", "value": "T19E823B0FF985421AD1E104705276867BDAB99C72338414EFFBD48A990BB86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520205, "uuid": "72ba0fad-1e8d-4c69-9fb4-332d99025dee", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520205, "uuid": "02715e4c-3c6f-4c36-9b98-575d177d3aba", "value": "384:sUIJ1V4+brLsEwENSZ5Hu9JgiL7gWav8U9cU:2QMUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520205, "uuid": "bf12116b-4b89-4047-85c7-91cfd62331e6", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520205, "uuid": "b6d25033-b314-42b3-90de-41ab47dd578b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520205, "uuid": "7b50399b-afbb-4628-8002-5d7f9f428d2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bf444e-56a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541965, "uuid": "228e4994-58a1-465d-89f1-5bcdc636a706", "comment": "Malware payload", "value": "10ffe324e6c1c888067b248294f1c75e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541965, "uuid": "4765d09d-59db-42d3-8094-9687e63e4295", "comment": "Malware payload", "value": "6386f65e54900c0a36f8607aaedc108bc3bbde6022cf0f37ab7b245c5726838d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541965, "uuid": "fd1b798f-7099-4d3c-a036-ab1ca9780455", "comment": "Malware payload", "value": "6d22dcfc3f9f729e78d1b2a51be400c9339ddc2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541965, "uuid": "d9e57cb4-8314-4438-8cfc-f6155bb48df1", "comment": "Malware payload", "value": "c6bcee7cc65139ba02ae0771f5a61a6f46c8ddf89b95993274aaa26fb5bad632077172ffe9e3f7d2036e3f0739b1aa16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541965, "uuid": "f9a23d69-fc67-4c3e-977b-15cd899170b1", "value": "T132A012A802B61401040CC40122D00469211CE18034D0C73BD0087661204250C3840D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541965, "uuid": "e225ad8a-2e98-491d-9938-11b8a16c00ed", "value": "3:AjOo2XVRL/L8AEwIaoLKJ4Kv:iwP/nXx4KJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541965, "uuid": "15198304-0746-498a-9dac-d8c98da8dae8", "value": 83, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541965, "uuid": "2f11b502-8b7e-4fa0-8ee2-4c47dd12f95b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541965, "uuid": "4575cbd5-894f-490f-9f03-c41513a0b7f5", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32caa3a-5693-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779532805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532805, "uuid": "04181b2d-1ef7-41aa-a09c-c45d17ec4c7e", "comment": "Malware payload", "value": "319dca059826b4f00dbada86de8e9b54", "object_relation": "md5", "Tag": [ { "name": "Astraea", "colour": "#4C6229", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532805, "uuid": "47863f8d-21b6-4af7-bf7f-df2c0fe116d9", "comment": "Malware payload", "value": "6502f300fa35de9e7fb689ed2474af50447a81f5bcc6c375ef09d23928aa7563", "object_relation": "sha256", "Tag": [ { "name": "Astraea", "colour": "#4C6229", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532805, "uuid": "4fcf7705-546f-4989-8465-6140674e50c3", "comment": "Malware payload", "value": "72fb28cc289e02b0b4b857aadf361935e76a4e7c", "object_relation": "sha1", "Tag": [ { "name": "Astraea", "colour": "#4C6229", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532805, "uuid": "7e680bd1-d0a5-494d-ae26-bff9f1c06418", "comment": "Malware payload", "value": "147beeb925d5cf61fc255d9da3175202e057bf3f7713a0cb2f38e0676363b99c9b179266f45e44f22ab0933a5e8d1f66", "object_relation": "sha3-384", "Tag": [ { "name": "Astraea", "colour": "#4C6229", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532805, "uuid": "a880f7fb-96b9-4b51-b956-b10c9e6289eb", "value": "T1CD08332A014D83BBC9BF8AF6DCF1AEB2C764A61374727C85A34830217685EDC51547FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532805, "uuid": "24fd398c-d44e-41c5-95bc-6c29108012d4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532805, "uuid": "fa685dc7-e875-4dc6-b8e1-c06160729cef", "value": "1572864:Tt9IKPN+SDRWYD9W423rJSUpgL27f17lqvLQFV9GEPRgJsGMSs7:TUKl+SDRWksxAeP9aLQzQKROsAs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779532805, "uuid": "90053b81-182e-4014-98df-e1b3b239c6d5", "value": 77569589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779532805, "uuid": "6b383ca2-bcad-4d39-b1bc-5d46f23b3ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532805, "uuid": "263b41a1-4dc3-48e1-b49e-5728db1bcbf4", "value": "EliteCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf295ba8-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544422, "uuid": "a449e9e7-eec5-4f3f-b39a-9abf0786f1fe", "comment": "Malware payload (Mirai)", "value": "3f2048e9f38ea19718a0d149a0131dbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544422, "uuid": "b51ef414-8709-449a-b882-c464121ff9ad", "comment": "Malware payload (Mirai)", "value": "658b94e551e0fe40717a08ca625ed49ae9cf5aa1f0be052b00bd3911169cfc58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544422, "uuid": "c8ccbc52-1e37-4228-bb35-7e20d7b55296", "comment": "Malware payload (Mirai)", "value": "88e9505898cfe3a28f66a784c95e066fc44f1c30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544422, "uuid": "60250953-2580-44b1-8246-b6c48114e8d3", "comment": "Malware payload (Mirai)", "value": "ce0907d42f4c7d1ec7e9d43fb2fbef64218a367bd5c06d3c0b18a96b57159c3d5fcd4eb645a6ac3d005fa757f111f442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544422, "uuid": "061c2b69-1c4c-4f56-bdb8-d4efa36e70e0", "value": "T1952301B6600E43B2F1114531CE7C0B69B8F19CD61338E89BD48E0CF2947A87B5CE9E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544422, "uuid": "30bb6974-4a95-4ee9-a66e-11a68938b3b5", "value": "768:A9kiBVrBtliBtG7pcv3gQJ4SFcSCQCaxPmiDZFvPJ20glVbsbqgIt8vBYZNSPK6+:A9HrBniBteCPJJ4gcScKfvPJ20gTbsq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544422, "uuid": "65b0374c-0f79-4d71-b41f-b4922d04f223", "value": 48360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544422, "uuid": "c45ad1ca-3435-4df1-8fed-8ff6d86e2b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544422, "uuid": "d1573baa-6fac-4640-ad0b-80df4caf5585", "value": "luxzz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8e3eb6-56be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779551259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551259, "uuid": "87a18c0d-aa61-4fe6-8b71-cba4d525cf46", "comment": "Malware payload", "value": "1b143123e7d27f4e9eb429afe465c483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551259, "uuid": "3c8c6052-c5d7-4fc4-91b2-68e6ae053a5d", "comment": "Malware payload", "value": "668f932433a24bbae89d60b24eee4a24808fc741f62c5a3043bb7c9152342f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551259, "uuid": "0862b2a5-84f3-4aa5-9e2b-025df67e6b5e", "comment": "Malware payload", "value": "22f6e2b777f86fe5445a5823b988c5618ed05317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551259, "uuid": "4cac56d5-5ae7-4043-ad72-d32159bee8ba", "comment": "Malware payload", "value": "1d3a2588f86d0f5d2f8b991bb14d426180b6f99336bc1559265b216eba1fc4ae3a39b864ea65eadc0d9019df5a221e49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551259, "uuid": "c4a75e1e-d75d-4337-8d31-5be06b7e82dd", "value": "T1C206331AB29601A5CD738677845B0A0AF9F178180360AADB479145D5EF1FFE0B23EBD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551259, "uuid": "1e3661f3-3e07-4ff1-bd58-8279096ef60b", "value": "c3f0638ae8ba5050ba7e7d6c9da6b387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551259, "uuid": "36e91da6-28ac-4a9a-aab8-20ba9ad82d00", "value": "98304:nPrKtY9b4SMx6U9pkEKBRe2SFbI278Bmsim:z990S4aEKO2SFbI2YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551259, "uuid": "d851829b-ff08-4940-bf7b-6ca1abd105bf", "value": 3845120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551259, "uuid": "75c720b3-99f9-47fa-9173-280feb67626f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551259, "uuid": "3be7530b-587e-4a2b-a873-5b0144787de8", "value": "668f932433a24bbae89d60b24eee4a24808fc741f62c5a3043bb7c9152342f40.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ed08f0-566c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779516008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516008, "uuid": "63c8ccaa-00e1-4fa2-845a-c23b4f7925f0", "comment": "Malware payload (QuasarRAT)", "value": "038e810c3e8a5afcea301027495bc57c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516008, "uuid": "13f5166e-0495-441b-8bd6-d8468c321bd8", "comment": "Malware payload (QuasarRAT)", "value": "66d2c02801bc9d128092bbcf3cb4e176c6e4e13d994167b82591c61b39c86c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516008, "uuid": "3e6310e4-4693-4860-9643-daa6fc43b089", "comment": "Malware payload (QuasarRAT)", "value": "179d9e4fe39c0fb130cf2148fa4ee80753c37351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516008, "uuid": "d7d69af2-13e3-4802-a42a-2a9703dfc838", "comment": "Malware payload (QuasarRAT)", "value": "7477f8a2641c3380b8e32ca04ab8eb2ce99db691e20392159490fe6d7deaae07f9d56f9fecff5ed3311f7f66f01fb849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516008, "uuid": "cba0a79c-7105-4564-b22a-72624246ce31", "value": "T1B9050189A6C08C71CA5A9E3584302E7802374F9D3EA5F355EE24BC7337B3BD52896587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516008, "uuid": "052e77eb-e78d-4260-91ba-0e7b5c036436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516008, "uuid": "f25159e4-1612-46f4-9550-4f3472711d39", "value": "24576:wP3yBQtY4I6q32uvOlvDRZUPbWDJeGd5nzUM9:wPmGY4I3mRpdqPIddn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516008, "uuid": "ef71fa38-74f6-4d4f-8b15-979291800fbf", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516008, "uuid": "96e8bb91-baad-424d-901a-7f81bd80a1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516008, "uuid": "a6f478f0-e6c8-4519-b7b2-e55af0f079de", "value": "rTransferencia_05_22_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b86ccbc-563e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779496205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779496205, "uuid": "b5cf73a4-fa2e-4ca0-b0db-3561d05f7cff", "comment": "Malware payload (NanoCore)", "value": "dc417c56cb492fffa1075d0c0f25d49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779496205, "uuid": "0f1ebf17-b6c5-4de0-a05e-6e40d471377b", "comment": "Malware payload (NanoCore)", "value": "67098a142da0af7ccfb8e0b22cdd6b2ed76a12b353a58654aecf444d711b2e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779496205, "uuid": "3ceced34-e82b-4ae7-ba7e-ec29fa4c4bed", "comment": "Malware payload (NanoCore)", "value": "7a50c7c22314d0583b855565e82c1d8bdcd75a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779496205, "uuid": "5163c58f-50bc-4621-8b7e-f25788de98e4", "comment": "Malware payload (NanoCore)", "value": "67dffd0d10814d6116033395dc5bf2d08f029f031118491965efa14a1fa761089bf99c67524b29809aef1d8259091448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779496205, "uuid": "38d8b832-7aa1-4c1c-91fe-4b3447f1b70f", "value": "T10114D0653BA84A2FE2DE8579712212139379C2E3E9C3F3DE28E411B64F567E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779496205, "uuid": "8c05da71-4fb2-4718-ac40-8458e31ddbc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779496205, "uuid": "3c743af3-ec5a-429e-b8ef-0c5d72082615", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI+ysC6wwBLsjAIZnB/nFgMbszg:MLV6Bta6dtJmakIM5i+LsjAcW/zhIR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779496205, "uuid": "6e07c703-5e86-4987-ab55-2a65904ad4bf", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779496205, "uuid": "d86d864a-2d7a-4128-bddb-74ff7b146389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779496205, "uuid": "06a080bb-3fc4-4ada-ae3e-d9d761d50282", "value": "net883.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa45cd1c-56a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779540924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540924, "uuid": "f93fb3c1-3429-452e-bcfc-46e5c65e2a13", "comment": "Malware payload (Mirai)", "value": "569265e7f49e2fa746a6e45bc68fd85e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540924, "uuid": "74fc3f54-868b-4024-aa09-ed3f6b2ceabd", "comment": "Malware payload (Mirai)", "value": "67197e8e9b9a767d508c7318769dc2aca0fb84270267e48cc04117f9ee5d36ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540924, "uuid": "83fd5767-3461-4182-82b7-2093cc981e1a", "comment": "Malware payload (Mirai)", "value": "91d9f47d7d2019d59615ade1f66425b394c2cfca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540924, "uuid": "ebc06806-64e7-4fc2-8486-d5f40654a2e7", "comment": "Malware payload (Mirai)", "value": "3379d9205d4ec2cd0117ce72f0f545789beb033034267988270d656807403cd456565990f6522f3a5f46a11fb7ea097f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540924, "uuid": "9e43b3fd-bb8f-4a4a-a602-3b89df4f4491", "value": "T102142A46EB808A13C0D61775BA9F42453323EB64D7EB73069928BFB43F8279E4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540924, "uuid": "00bd0425-205c-4dcb-ad7a-cceb895571d9", "value": "3072:PB6fEi2lnQI2aXVNE5+39S+tRqrrsLXgsCR0bQhQbmq3r4j3:Afh2lz2aXVNE5+3Q+tRfLXgsCqbVbmqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540924, "uuid": "cb67e8bf-eb27-47c7-94ae-ed4fc555d8cf", "value": 191321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540924, "uuid": "5dee09fa-198e-4373-b930-9a1e4aab1b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540924, "uuid": "63ae52d9-2baa-4074-85c7-73b624bf4f33", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adabf405-56ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779556392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556392, "uuid": "f4d7f7a0-3d38-4f0b-b447-a322b532d4ce", "comment": "Malware payload", "value": "9e6a5c287bdd9c0e7ed5528b245008af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556392, "uuid": "3c1baa1f-ba7a-4cd3-9447-a2b33d54c76d", "comment": "Malware payload", "value": "68508736c04c34fd3ed97b5d7ca86cbb4ec12e2ae118fe1854f6813aa7706cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556392, "uuid": "b1440f86-ef51-469e-9cc7-cc8b6d117e30", "comment": "Malware payload", "value": "3f49b44e10733a03f98d996942b90e43e2af6cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556392, "uuid": "9da08157-2821-467b-aad6-3817ed12faf5", "comment": "Malware payload", "value": "5a6003f5e186d55daa4b6a8c189c752e572c8f61532c954c924e2f80d37292bb7bcb8f9b3eed70f139b26661124a8665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556392, "uuid": "7ca99479-ba27-418a-be97-3d329abe5604", "value": "T1EE645B2BACB15472C06E94301C9F86625E6D79E20AE458F7334F7E364B90DE05A3F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556392, "uuid": "1ade1395-2179-4c43-9b71-c54106e6a865", "value": "9906ccdee80f5af01e40f1f9ab16940f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556392, "uuid": "fab387e1-264d-4eca-b583-badec4dddaea", "value": "6144:Z3o7U/O5uG54KicbByDO8dN83h7K3sNaoDmjPNns:Zo7U2Hx8DEOhRbNns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779556392, "uuid": "d04f80a0-2755-413c-bd93-f416180c9fb9", "value": 322608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779556392, "uuid": "b50b2ecf-8275-405e-95b9-82f6707ff81d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556392, "uuid": "7aff53e2-1f82-44eb-9906-febbe60ff746", "value": "Control_Panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cad89e0-56c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779553330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553330, "uuid": "71f08f46-6dda-4f7e-a3fc-ca86ee4e972f", "comment": "Malware payload", "value": "cbc911abd8c102ce4627418a0f169ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553330, "uuid": "91588709-a729-439b-800c-e7d096249429", "comment": "Malware payload", "value": "6a32dde55c2141a5f6c0d1d73f562af67cfa8238829bc72386191956cdeb730c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553330, "uuid": "e5089c90-627d-4b6a-81dd-f0d92180aca9", "comment": "Malware payload", "value": "e1d4e61be9224ae83c753f6842ab21aef2141caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553330, "uuid": "10b37283-e817-45b8-ab70-b66511effbeb", "comment": "Malware payload", "value": "1d9f39170d42c057e3af3428d80a3a111ca8f95ac2c9000f9f7f36e9e95ef8005017768edbad0f65c82e4797d8eba513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553330, "uuid": "82ac5054-736c-4c4e-a670-9ca198ce2efe", "value": "T1E8364A57EC9145A9C0EED231C5629252BA717C485F3123D72F90F7782FB2BD0AABA704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553330, "uuid": "c6b51308-a9ea-4c45-9de3-6b0c06f0170a", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553330, "uuid": "d4136f80-ba23-4b37-8db8-a0ccea4a9f8c", "value": "49152:ALtLyRe/Y9TdpEav+kf9RWt1wLvTIWSMZbTv692Y5EXLFT2PqX97/SYUX:j9fqkfPWaZSMBGREXsqtW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779553330, "uuid": "a3492c89-8e61-4005-8f2a-2372f08f532d", "value": 5159424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779553330, "uuid": "05b3b3b3-2877-4dfa-95a2-6a484185b5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553330, "uuid": "2c240cf6-ee92-43a9-93d6-6a4997c74d57", "value": "SecuriteInfo.com.Generic.Gorat.H.7C14A53E.75335936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9d5c37-56c7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1779554912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554912, "uuid": "74e76d49-75a7-4c31-84da-f8bc14253f02", "comment": "Malware payload (SalatStealer)", "value": "e06075c2a3de418d489bb4eafe3ed89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554912, "uuid": "23532c4a-9e9b-4be8-9069-17de53c35ec1", "comment": "Malware payload (SalatStealer)", "value": "6c60efcfb9fed6366ff0eed3e1a80846c1ae0b28e0b289e105e360b2578351b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554912, "uuid": "9e6b0bad-36ee-4b63-86c4-9423c47fcb4e", "comment": "Malware payload (SalatStealer)", "value": "8e9ce31b1d69b4efec6a1b29b3d7eb8f2512d5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554912, "uuid": "2a84d82a-390d-4474-b540-f9cdad48298a", "comment": "Malware payload (SalatStealer)", "value": "4c6d139ac71fe3048ce127b9f85d42ae14034ad96f081559da5d9fa0fb1b60d2eb2c8aadad92b758500a9d02016f8911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554912, "uuid": "72eb9958-0728-4fdf-8ba3-0a5174778fac", "value": "T1F116338527A616D7C06E4DB2893749CCA6F9C672C788CE7F344911688AE7FF54A4230F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554912, "uuid": "272f88a8-5ec9-4c9c-9bbf-65d0d6f9f278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554912, "uuid": "e7a82179-0304-48c6-ac70-c887569e0700", "value": "98304:yFACLB4+ZD/Xb5APHV9Zv5OdXQITSysmH5pD/sq4R:Er3/LGrZv5gFSyFZtsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779554912, "uuid": "70e9045e-87ef-4eb9-909c-1865f98f06e9", "value": 4386405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779554912, "uuid": "a83ed3aa-ae8d-4b68-bdd6-200f103f8bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554912, "uuid": "d951826d-313f-467f-aef0-a1a558aa40af", "value": "RKNBYPASS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc229ea3-56b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779549222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549222, "uuid": "9ca1ff08-23c4-45de-a77b-34964b3902e0", "comment": "Malware payload (Mirai)", "value": "afa306db72e9dfff08a72d26dfff168d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549222, "uuid": "9119983d-db75-465a-a161-079ded3271b5", "comment": "Malware payload (Mirai)", "value": "6d11a39e77367d7c4049f906fdebc02a33fd9e40afb00f784e92c29b8ff73b2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549222, "uuid": "3dccd43d-ac0a-48f2-a1e0-c148a1cad0cf", "comment": "Malware payload (Mirai)", "value": "e895f2f94ba1483de4a960de905b3f174856e015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549222, "uuid": "53bb4d65-3bf1-450a-b23a-6f03fdb661df", "comment": "Malware payload (Mirai)", "value": "fac9cbd7f08885218c6ba0b0b5ffafc2f8cbb54f41f219546096df7106d879ef3a0031c39c6f0c901cc85cedd915e9ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549222, "uuid": "3a42d5c3-3e58-4a17-9931-ed390d7a9c84", "value": "T1E5B3B64E7E318F7CF7A9C33857B74E21A25833D626E1C685E1ACD6111E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549222, "uuid": "7da9acb9-0375-4ea8-b84f-987a6a5d0cd6", "value": "3072:gzIaWCHpgXxm7De0E3os6MB7EkxOe4n/jpT0:gEGWhm7De0E3os6MB7rNM9T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779549222, "uuid": "4802b4fc-5aa1-41a9-8a78-231066a1373c", "value": 114736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779549222, "uuid": "fc1454da-68fb-4c3f-aad0-32c53a60dde0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549222, "uuid": "58cf174b-f90a-4c37-a7fe-a6d262f5828e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4c2cda-567f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779523905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523905, "uuid": "18623f69-e34a-4451-9bd5-7bcdc7bf29a1", "comment": "Malware payload", "value": "c5fb402288212319f461c2a5153a06dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523905, "uuid": "134ea0d7-5406-4add-8c0e-24e9a57deb62", "comment": "Malware payload", "value": "6dc2c0a95cae9162ad74f9ecba96825cad206d486edf5d717716247d30a5217f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523905, "uuid": "a7a10365-2415-44fd-af83-dd8e33fb0255", "comment": "Malware payload", "value": "387801e08746f5be5da92afa28c679ee7d518942", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523905, "uuid": "60826540-70ee-4014-b68a-ca9cc5b19e95", "comment": "Malware payload", "value": "47f8d6e7dc72326d1a6ecb0312176906b9b1480875f55b478bd420fc870051357030ce6b627717fbd4ae8a4789b21d61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523905, "uuid": "a36846c9-ed79-4017-8822-2449e8b30a71", "value": "T1FE137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523905, "uuid": "3cdb2c5b-ebc7-42ba-8cf5-5f98022f4ee9", "value": "768:A+J9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:A+Cco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779523905, "uuid": "0d51e98e-243e-4080-86e4-eb9b4cf7ab8d", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779523905, "uuid": "8998cbf0-439a-4d36-8ffa-d5fec20a4860", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523905, "uuid": "02118044-e6fc-42cd-a568-113b115efb8d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5bb2ec-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579586, "uuid": "b95e91d6-d07f-4889-8c1d-4f6ec0281455", "comment": "Malware payload (Mirai)", "value": "df2f2db75eba16ee1f0d8b921c225c5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579586, "uuid": "4fa05b01-7e66-4adb-83a7-9b9824841e45", "comment": "Malware payload (Mirai)", "value": "6ddcde5f118d9092392fb7a4750f82e11bcef9440a6b8912341a02c1f6cd5577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579586, "uuid": "89bc948d-c403-4e7b-b19e-1236b7fe5988", "comment": "Malware payload (Mirai)", "value": "5edac94c6efade701d1c3b356a3e32a7edd19d71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579586, "uuid": "19ad3613-3ceb-41f3-910e-d190b2a40b09", "comment": "Malware payload (Mirai)", "value": "b251f1e140491ad8cfaa59710a3a0a089f7818dca97863dc434b6c0b1036c8d4caf214a763ab8511679b010475917a4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579586, "uuid": "d07d83e3-20ca-4858-b060-e89aaaa7893a", "value": "T1B8A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579586, "uuid": "713ebe9d-b639-4355-86f8-0955769b0f18", "value": "3072:VK1z13U6HzHoXRtmTUhQog2EmmFVcqq0GnDZT:VK7DDeKlog2EmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579586, "uuid": "19528aff-db97-42c5-902c-2b90acc7cdf6", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579586, "uuid": "5fdabd89-1ef6-441a-b267-829282a2d79e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579586, "uuid": "dc3bbf3e-80de-4983-b85c-10520219ca40", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad30c4b-5695-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533436, "uuid": "2d06fa1a-650f-478d-a6c0-91ea49c8118e", "comment": "Malware payload", "value": "5239650e2d06b4a5cb34593d85558ae1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533436, "uuid": "75bbe069-6cf8-48a8-8e6f-c77d78b6c171", "comment": "Malware payload", "value": "6e637f7f066febc9b74a75109a57f5b16f5ab7d86e00e0f3ef29864e62bb09f6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533436, "uuid": "5488aa1b-a720-460b-bd70-bb29673cb6b7", "comment": "Malware payload", "value": "40e7849c523cb8bec3a9f52757d6508cb1d51ce4", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533436, "uuid": "112ea7bf-b618-4bd4-8ded-f9a5933aedaf", "comment": "Malware payload", "value": "ee63a15c1f23f390e94e9a698f61006ba3196a6d95f10c0a46bd681b492470ac52908121aa7ff8b32198aeadd47fb385", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533436, "uuid": "ce7804d2-fd4d-4417-8eb3-08da335af127", "value": "T19DE0615C72B61BAD171C8691501BFE53202A35980F9741957CF050893AC317EB18E274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533436, "uuid": "428f5f2c-6e2e-4755-8148-5126b67e34a2", "value": "12:s8AV/jGBCKKg2G1ZeOhxrTYBM51FU8fhNzI98AV/jThq:e2CKKVGzhrTnPb0t8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533436, "uuid": "80fb7ba5-40a3-4c3d-bffe-799c6ea2a75a", "value": 404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533436, "uuid": "2a527b37-545d-4c14-8d17-1c5fba8a6b89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533436, "uuid": "a1512472-b40c-4b9f-84aa-8759500254f4", "value": "jNL6pY2j.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910f7ef4-566e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779516830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516830, "uuid": "c649859e-94e5-47b7-af1d-e0fd70fd026f", "comment": "Malware payload (Gafgyt)", "value": "b64ba6cd9c41a922592f5d2b34ebe8b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516830, "uuid": "4b0f178f-5959-403d-bde1-716f2b757d9d", "comment": "Malware payload (Gafgyt)", "value": "6ec3194c794943ea35ca0adfc2f8509465a4f7fe81adb9a211d824ce30fd4873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516830, "uuid": "4d3b4bb7-aec3-4e22-9dca-887241845ea3", "comment": "Malware payload (Gafgyt)", "value": "928aaeef5ffae9500465ee04900c8373c9d5ff8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516830, "uuid": "81dc57be-a925-40f0-8d48-d26caffa3a5f", "comment": "Malware payload (Gafgyt)", "value": "038151a478fedf15e7520eba8d2de30c8cd8c8b03f9f311ac442c5e3ebf34b5d4e1fdc810e75eac1b320049c92db9233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516830, "uuid": "bf517e69-3120-4016-997d-ea95ef1aae86", "value": "T1A3358E2AF2B3F67CD00BC03497DBC6A14531F0752A323D7B2684DA392EA6DE51359B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516830, "uuid": "b1362364-9dc2-49a5-be82-3cc12d63baee", "value": "12288:eUnZfNg8i5Pswa1wecdZ1nwd7HOEMm0PySbyhzvQzydkJuGVdsdcKiayCfij2PHV:eSfNg3Ps1rEZdt56vQmiLWdcWja2a/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516830, "uuid": "6c2649b2-e9ea-46ab-9e24-cb6bef899853", "value": 1059440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516830, "uuid": "f75a68bc-7e29-40ba-954b-f10a7731d26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516830, "uuid": "5c354ce0-63fa-48af-be8a-f7aa32c21286", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdaf2eb-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544423, "uuid": "f9a27e23-2f27-4b7e-b6d4-0cf16aa2e928", "comment": "Malware payload (Mirai)", "value": "bcaf15358a6344a50a50a118a29d4f47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544423, "uuid": "cf463dff-ae9c-4af8-b24c-81cd17220ce6", "comment": "Malware payload (Mirai)", "value": "6fc10755963ee12d3be026ca4829d5a0fe6c92b7236cf5b836a0e81d3e56fa73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544423, "uuid": "d3fcb229-9149-4562-a53d-39a55ba41c65", "comment": "Malware payload (Mirai)", "value": "30ea95f84324720291fa9b104c76fe3951161b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544423, "uuid": "0f56627c-4475-41d7-b7ab-99bebe3636a0", "comment": "Malware payload (Mirai)", "value": "b7fba97921422ecb8a23fb1e23acd8413a0c5c70b21b46558e031f4ded630b0ed8f2c4df79474d3efbbb05735507e663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544423, "uuid": "f239568e-737c-4b8a-83e2-ef81253c421c", "value": "T191C3BED7F68B24A1CC6146F017C76B8E2E6361119E6BE9E76C1E663B093A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544423, "uuid": "e1004954-7b27-4529-8ce2-7221440d4c7c", "value": "1536:BH6XXWAZxg6cgoWZKqUHQEyhBGLaDWql0W4s2sieEg6tCwxZJehgxy/LWg:J6XXhxr4z+BGL+tJ2sd6tChhgxyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544423, "uuid": "3a07ff05-73bd-4650-83f8-ddc719b1c897", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544423, "uuid": "2e0aa09f-98f2-41f2-b456-8115b080d22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544423, "uuid": "c43f7f57-c8f1-4b64-8d06-04a6cfcfc326", "value": "luxzz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6ff736-56bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779550915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779550915, "uuid": "65d6761d-4bc8-474d-8b0e-8959864774a2", "comment": "Malware payload", "value": "e0d1eedaa0c1f98f50726df729594edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779550915, "uuid": "521e06ee-ea8d-4a98-859e-73d7aff154e8", "comment": "Malware payload", "value": "701d51b7be8b034c860bf97847bd59a87dca8481c4625328813746964995b626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779550915, "uuid": "95a58345-fcd3-4b27-8094-241b88f4aca4", "comment": "Malware payload", "value": "94f21c140afd18b43d5a0f274216545442b3f6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779550915, "uuid": "bbe31f06-e00a-4197-b35d-62cbaef05d89", "comment": "Malware payload", "value": "e7dff76150f06a5b8735697d46801734ea5967f7134863c011ae082852ca689fffc4adaa3d7ddcbfe0a1f0735d6e93db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779550915, "uuid": "846994ee-e363-4dee-bc4c-272fdbd54f8f", "value": "T1E6F63372B62601B8F476C2F4959D4B07DBB47C9983F08AC75BA96081DD47ED0623AEC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779550915, "uuid": "c81d879e-153d-4dee-aa94-d8159e43dfe6", "value": "eaa21553d50f176effded4a71f9e61d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779550915, "uuid": "74b58456-4bf8-44df-ba8e-7663b1c6e0b5", "value": "196608:SSgRI7ouwcNWtiUp8CWaiZGeCA7eMU3YJWk3HH6aFUWphuOabdIXQdNUDuhm68Me:hScGoIoUaWkXXU6wtNURYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779550915, "uuid": "96f47c70-3a6b-4d43-8f4a-a1752e2a1418", "value": 16603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779550915, "uuid": "1f783d7d-74c6-4697-8f1b-7913df17b0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779550915, "uuid": "f623c165-9342-4c1c-9763-96fb30ed52a3", "value": "701d51b7be8b034c860bf97847bd59a87dca8481c4625328813746964995b626.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e12b770-56b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779547534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547534, "uuid": "3148dfc5-40ef-48ac-bffe-d2a8cac56f25", "comment": "Malware payload", "value": "0eeb14da22fc3b7c1ca3946bbe09fc75", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547534, "uuid": "a613f164-9b62-4b90-b22e-30e9b7c16832", "comment": "Malware payload", "value": "72e744ebee70d30a3a075a437b44613b6163599dd898500fca0cf7e8ea20a0d4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547534, "uuid": "30364db7-69d3-4826-998f-7e7d13cc8b94", "comment": "Malware payload", "value": "12f55dd6eeb38c038d81967fd73e87741eccc4ec", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547534, "uuid": "dc3b98d9-ba91-424f-97b1-0f9a39b3c2a6", "comment": "Malware payload", "value": "ba3c52eeb2a98f3958fd9b307dd5304cbe4cc05f49e8ac8165de13d4e8aa28d38ccad9d90af4cc39c2d7118c975bd335", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547534, "uuid": "aac62c71-db42-4a3d-afd9-4d5ddac76dd5", "value": "T125E64B47E8A915E8C4AED5308A76D223BB717C494B2133E72B60F6242F77BD05EB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547534, "uuid": "72b1a974-52c2-4094-993b-3f37b3b289c3", "value": "3f6f096ee1fd11bfc8477792caa1e024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547534, "uuid": "b2c743a7-83ab-4837-b643-5ab5c4a66e0e", "value": "98304:XlNUgOtbv1lhU0TZMYB9WfC0fXryluRcEoCDDAVxHL9u:X4jtLplefCHlyVoCDD6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779547534, "uuid": "bd8c8e6d-a6e9-4fcd-bc64-b81fcdca15a8", "value": 14453248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779547534, "uuid": "e38c711f-4f83-4ec8-8164-1a288f2c1080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547534, "uuid": "f618752f-33c8-4e52-b3f7-1b208a7ab710", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e46a79d-56cb-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779556607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556607, "uuid": "b9b948b5-47cf-44ec-91e5-311547701021", "comment": "Malware payload (NetSupport)", "value": "c156814820b545472f0c6e7de38b7fdf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556607, "uuid": "048a9c08-b886-43f4-a6f4-0da029819fd7", "comment": "Malware payload (NetSupport)", "value": "751d346875d5e62f7e6ad653ab39e0d3c15b3879d07305041cbba6b13f58ec7e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556607, "uuid": "c420a4fa-b7df-4432-aa37-8e1206a8b373", "comment": "Malware payload (NetSupport)", "value": "09eb7b53fe657949f363abcedcbfd220a752839c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556607, "uuid": "180617c0-0f87-4720-b500-1302bd28e7b1", "comment": "Malware payload (NetSupport)", "value": "72e7757af3423d746bc6a5acc0df149e2357e8fedeb28d955f67ad9b4759c2f1b405a115a641f05192352a2b92edc5ca", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556607, "uuid": "74efbab6-1c60-4e00-9751-e1b36ca6e50e", "value": "T183334136D130F9C64E8E368688E44C564A5822B2C3FB5CA4DBCE68FD34D5F44EB16A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556607, "uuid": "58536bd6-99f1-4abc-b69b-482f39b977b1", "value": "768:GqsOg00iWAxhPmox8zFwkxskIkXg6RZw4v5VQLpWIJzsV:0M0iTEGQIkXg8Rv5aLNOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779556607, "uuid": "89c0f905-873a-4cee-9402-9e43848901dc", "value": 54025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779556607, "uuid": "3e9e61af-631a-45c1-a05b-a19c5c6cd174", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556607, "uuid": "5227bfb5-e50c-408b-af9b-5da73fe1d564", "value": "c156814820b545472f0c6e7de38b7fdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025118d3-5666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779513155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779513155, "uuid": "069357e7-57c0-4913-baa2-d758be61f87e", "comment": "Malware payload", "value": "8bbfc287b8fc168e2f861d5451ace389", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779513155, "uuid": "18493292-38e1-4913-a207-6933e23c6f41", "comment": "Malware payload", "value": "7601f63cb5c60cd6d60257b6102ea9e9fa2491f03625011ec92b93ca721d82ef", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779513155, "uuid": "8324729a-d823-45ce-b271-598b9f98cb9b", "comment": "Malware payload", "value": "22aae10bd4e5ce354d91099a7c362d2ed2c85f10", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779513155, "uuid": "ba39ab61-ebba-4d3e-8e48-f5e3211cb40c", "comment": "Malware payload", "value": "21bdd39a4dc19de9debe7bfcfd88e763832bf7e0dba6432179e1cb3549d82eb6a3ad8d3f00ead1e04b269f025adddb41", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779513155, "uuid": "75008a6f-e95e-45da-b7bc-49d4f065e0ee", "value": "T15885220A3FE43677E5A91B3488F2874A5331F4A11E2247DF1688A674CD23BC53E32799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779513155, "uuid": "d8637af7-a04c-4b56-b769-f0d3f765047e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779513155, "uuid": "5ce9e62a-003b-4019-af65-cda925972b8f", "value": "49152:cjnTAcrPqaGqIKQE09RRj7UWe2mSlrD4llg/qe/:WW8fQrjMj1IDKlg/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779513155, "uuid": "250c7660-ae80-40d8-92c0-1a96784bbde9", "value": 1704704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779513155, "uuid": "7e390104-3811-4c88-a2db-a892b6029be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779513155, "uuid": "c1c08a72-69ea-49c5-b85f-c209dfb1da1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0749e42-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579589, "uuid": "5a8f6bb1-c3bf-4680-8e42-02c036dc033f", "comment": "Malware payload (Mirai)", "value": "5780942ce6cfbcd714d8c526879cdef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579589, "uuid": "938c72c7-e66f-401a-997f-c42720027f3f", "comment": "Malware payload (Mirai)", "value": "7622bae978074911ea3c1594fa39c36d8c0abf3576928c7aeb33063ae6d73b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579589, "uuid": "7f84b559-ae8a-4c55-8e1e-4c60e30e0738", "comment": "Malware payload (Mirai)", "value": "4daa9c512b0fc67bdc1a98a9606840cb4b15b7f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579589, "uuid": "d124506d-a146-4319-a2b0-ad81daaab350", "comment": "Malware payload (Mirai)", "value": "7afa34984d1ad3613981108ea6a1829038fb64d922071a445014a60a85426a9ad2eaab607f7554b6948461f97b793dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579589, "uuid": "8a085ee0-944a-4a1f-8118-9571e3d363ea", "value": "T1A8B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579589, "uuid": "f62fba17-d5cd-413d-8904-e8f512ee4116", "value": "3072:MDVLSItJP+Xsp4JlN3H8jmH1cuEgvniuN/:MDV+ItJH2l3H8jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579589, "uuid": "04f78868-1ee2-4a87-9c1a-46c421207771", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579589, "uuid": "f8359090-e3e8-49ed-8cff-7a339ebd3348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579589, "uuid": "c02c9121-fba9-4f93-9394-cf1eb2f4cb3d", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12b05d3-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579590, "uuid": "61a5f215-ee07-45bf-9112-a456479c5bcb", "comment": "Malware payload (Mirai)", "value": "41ae9a9b26eb75dba9ef5e9746c71155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579590, "uuid": "2d439ccd-5629-4b19-ac95-8169898f8060", "comment": "Malware payload (Mirai)", "value": "76653e504ed64d55ead04fb2bcf943cbd1bfc235e4ac8ff137f29a86c3bd6095", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579590, "uuid": "7b836b5e-438a-4bc8-bd9c-98dc62aeec16", "comment": "Malware payload (Mirai)", "value": "eb272192118c7b885779eef9db4885c43d28f527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579590, "uuid": "2f7a4c49-6719-48f4-af25-346e5fce5d3c", "comment": "Malware payload (Mirai)", "value": "b0242d677eacc0c7656e423bc3d99a1e8f1c5c74e6d7b1fef5ff8d8a601c5f500b25df890d70dc87710b2143271ed586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579590, "uuid": "3e5cab2d-63f5-4f52-af91-1e4361d35c7b", "value": "T177A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579590, "uuid": "014c9881-1792-490b-9892-0fb0a62b0127", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fyHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fyHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579590, "uuid": "e5170da9-3eb9-4d42-9bfa-f7f86540d011", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579590, "uuid": "d9cb7889-1957-4c8d-b261-0679ee6fdc3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579590, "uuid": "41147294-0aa4-4899-b448-791e571198e1", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c891a8f-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497039, "uuid": "df9f4aa8-ddc5-4d7d-9c78-8cd32abd020f", "comment": "Malware payload", "value": "b4a5512c69cf1dc7e9d13733353da61a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497039, "uuid": "80800fa7-e53b-4e08-ba08-6b8699e0d36b", "comment": "Malware payload", "value": "7672e6298c3b94a0b3568fd69d813f44454180767df5069f0e4759fcd2bee38f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497039, "uuid": "4f0f7082-f74d-4f8b-8ea3-44306637d861", "comment": "Malware payload", "value": "385349e81be47d84f8ef8525f13f68184175e6ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497039, "uuid": "c488a336-af22-461f-a5e1-114cd9f0f457", "comment": "Malware payload", "value": "5951c266077d3cba3b318a866407dca3f25e38794194a0c256a310699557066af24b5723231c10a2739d1a1793ab5d7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497039, "uuid": "dd9832d9-8a79-4b17-b0bd-b3fa11236ca1", "value": "T15815DF66BD519A52C0D0267AFA6E8198330313BCC3DE710AED14CB3576EF89E0D3AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497039, "uuid": "e2b4780f-7d4a-4001-b33f-15c6ecb3563a", "value": "24576:G/DBKJjIp+X6tDk0BuWy22LwKbr0p3WhAdDir6:zToI0oWy22sKbr0+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497039, "uuid": "2c1b948b-070b-4596-9fe1-51b20dd54a82", "value": 885575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497039, "uuid": "9a866963-bd70-424c-984c-2cb371aaa9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497039, "uuid": "8e447115-526b-4230-a116-95958af0df02", "value": "qtmrdhj.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fd75a2-566e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779516649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516649, "uuid": "617597e9-916c-40e1-8248-b7630b9c40c4", "comment": "Malware payload", "value": "b1b48eaa032712cd68d20518bfde2bfd", "object_relation": "md5", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516649, "uuid": "335e2b5c-67e0-4ab1-b66d-fb6d5ec391a5", "comment": "Malware payload", "value": "76d8c36fe53c5f6129bd2f213b9dc011c08eded89baadb3a4176026e54402d9b", "object_relation": "sha256", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516649, "uuid": "b11b1d60-515e-4e17-92f5-6d6b426fc9bf", "comment": "Malware payload", "value": "0e02d8ca8fd8da88a689398d7212e82b3d71bef4", "object_relation": "sha1", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516649, "uuid": "a5bdb1cd-6e6b-4990-95ba-4426ec544763", "comment": "Malware payload", "value": "e157cc2298926247898834bb64dfc52831757df55f99f58d4f0a4f3fe1260aad5ed6507104a537ef20b05518a7a998d1", "object_relation": "sha3-384", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516649, "uuid": "c0114c61-7e7c-4799-94f1-4725ec7246cd", "value": "T1D3A5F1256AAC01F8E1A7E27889954507F7B6B849133197CF43E0867A2F276F05F7E321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516649, "uuid": "d7831784-48c4-42a6-a17e-6dc53b6fb9dc", "value": "49152:913cu7VSc5iGjTIG3sg1/PTN9IJ4CVkTM:nc0kpir3B1PTE4CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516649, "uuid": "d4f70775-29d4-4fd7-9630-0d68d4b0eb36", "value": 2137764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516649, "uuid": "e399c710-28d0-4c24-a970-7c608768a45c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516649, "uuid": "a559b799-0a92-40af-b9e5-17c2f9632d21", "value": "openhashtab-github-io-6.52.3.zip-", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811ae4ff-566e-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1779516803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516803, "uuid": "0f3c27e3-8f85-43fe-80a7-d34fcc34d5fd", "comment": "Malware payload (Cobalt Strike)", "value": "e7c2a4ce620b54bc75ab8b291ec8fd14", "object_relation": "md5", "Tag": [ { "name": "Asthma", "colour": "#C601A0", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "PSRunner", "colour": "#31C33B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516803, "uuid": "04909a04-1dcb-48df-81a9-1b0d48fcc84d", "comment": "Malware payload (Cobalt Strike)", "value": "782e7ae11270cab0f597849df2269380548078228bbe47ca69d41d7dddd2a20d", "object_relation": "sha256", "Tag": [ { "name": "Asthma", "colour": "#C601A0", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "PSRunner", "colour": "#31C33B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516803, "uuid": "fd21c0c5-96d9-4160-a10d-5e5a5df7b857", "comment": "Malware payload (Cobalt Strike)", "value": "d716adbc2288e0250faf62164e4d7992faeea67e", "object_relation": "sha1", "Tag": [ { "name": "Asthma", "colour": "#C601A0", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "PSRunner", "colour": "#31C33B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516803, "uuid": "fd3f9b47-a57a-462f-9a84-d9d4a84010b2", "comment": "Malware payload (Cobalt Strike)", "value": "d5b1c645123578843599bd3d87539363e2c1011c63b472e3a96bc8ec4c614b63f15fc1edef0d91bf05f79a52e1c74117", "object_relation": "sha3-384", "Tag": [ { "name": "Asthma", "colour": "#C601A0", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "PSRunner", "colour": "#31C33B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516803, "uuid": "3b4a1928-612b-4af0-b272-46508f01c65d", "value": "T17002136ACD71BCD447AC3640A7A52C5E22A9151783739F74C6091CF73E61382EF2AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516803, "uuid": "9b525158-16a6-4425-9d9c-4cc43020e6ac", "value": "192:+n2jh1hqT2gowoI0uT7KLv0Bkh3hVDkmhJPNR65lD9b0ocEJYX/F6hd9d:+n2jh1hs2woIP7fBCVxJPNR8lt0hkhdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516803, "uuid": "825f5343-efaa-4b45-835d-ca965a3e32c7", "value": 8434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516803, "uuid": "1b967490-877c-4015-b509-a66b53fe903f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516803, "uuid": "69e4ef35-7eb2-4bfe-ac8b-981b86176758", "value": "price.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f5bae9-56ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543952, "uuid": "f1dcfa83-eefe-49b0-99d2-c3cbddeedd34", "comment": "Malware payload (Mirai)", "value": "3f34a78a5758778eb46e9e29f7f6dd8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543952, "uuid": "c85ca851-1c79-49cd-9bc9-786ece9cbc97", "comment": "Malware payload (Mirai)", "value": "794e08ff62bbde29cf8158330362e7ca0d3bde297346e95521ba27540982da64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543952, "uuid": "2996f9f5-b03e-44ec-92fe-6e19f05daacd", "comment": "Malware payload (Mirai)", "value": "87d1e55d673eae99170645c8a191521f4ba4d232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543952, "uuid": "82b18d12-842b-4f8b-b1f0-1926044e2d3a", "comment": "Malware payload (Mirai)", "value": "119bae096fa29937ffffba6d8e7fec070ccc8288eaf2b5c8fc4ca81fa2b95c096f6070312655ce6d5e97d179624bee3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543952, "uuid": "c06dd028-42d3-43d5-a023-a66866590018", "value": "T135242B41F8415F16D5D012B9BDBD918E33132BB8E3DA72269D246F70378A87B0E7AE05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543952, "uuid": "c5fa680c-5eaa-45f9-af79-6e30325fb6fe", "value": "6144:0cQXUKRK8unx99W/4tEiXEmOayeB405H:01XU59W/4aiXnOanBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543952, "uuid": "3e923f2b-2d3d-4b28-ae1f-3f3ed1db658d", "value": 217852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543952, "uuid": "00f26c25-ea2d-45c9-9a84-95fe82da1511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543952, "uuid": "b7cec068-0317-496c-937d-caad3a89c51d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d305676-56a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779540661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540661, "uuid": "c820881b-5282-4654-8aee-71b054dbafa1", "comment": "Malware payload", "value": "18a8cbff0217089db8db10f842abe160", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540661, "uuid": "6e7a77a8-72f1-4c6f-9b07-544e404c002e", "comment": "Malware payload", "value": "79ac18f4734d50ca993681ed7c951b1c706ac3468017818af1b78228acc10984", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540661, "uuid": "24dd3be3-6699-47de-970a-c4f89af4643a", "comment": "Malware payload", "value": "13e7b46ec8a105d3c0e0e566d9d3dc99dc03bfad", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540661, "uuid": "e0ed929d-7f29-4d87-a8d1-0a16577d83ba", "comment": "Malware payload", "value": "1994e4704d54808a7f2d2252586875ea7d4f0c6d577fe909b683d9be75679111adeb8469da2c5ad424d5535620cd8ffe", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540661, "uuid": "8c51300b-f2e0-4459-8f56-d195487edccc", "value": "T1E9657C1BE2A344ECC56FC134C3679775BA30F42942287D6E1A94DB322F21F509B6EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540661, "uuid": "117cf088-b058-43a2-a16f-319e3068b18f", "value": "7a5413de416c5f0e70a3552b6de5f85a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540661, "uuid": "fd8523ff-1999-49f4-bf07-fb6bfc2a3388", "value": "24576:Z4F+QD1CRdaFp/3Oo++lG0rBVw6rnNZTvC3arbBA:2F+QD1CRdaj35+SnxZTvPtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540661, "uuid": "e7de49b5-c9f0-495a-97b4-774f41548d42", "value": 1483776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540661, "uuid": "336d44d7-e062-402e-8bf4-6cc6a1962884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540661, "uuid": "419e7775-02d8-4c73-9bbd-b88f4a7b263c", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a6ea95-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497049, "uuid": "f6cb3e20-e23a-4e84-908a-781436586d55", "comment": "Malware payload", "value": "ff3304cb9c16cde7521b0b189ba43ed3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497049, "uuid": "12e6fc94-1a72-4f31-85c5-da427aa8549f", "comment": "Malware payload", "value": "79f0577f46508d20bb6c98ea584bdecdae92c8d4fe0ada5c55f8531aa527d253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497049, "uuid": "812b1800-1533-4d89-8b98-26eb62a6c237", "comment": "Malware payload", "value": "ebd889bcfa9b9fe0719ce950634f8b3a5105828e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497049, "uuid": "29b8018f-14f9-49ba-9925-38f8f5b0163b", "comment": "Malware payload", "value": "a30208111303977313be8d2b8fc27f7fdbfdf521131a3131de4587b0fde4a2f6c5bc80a360ce3b03e6fde256cbf7a0c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497049, "uuid": "345247e8-98ca-4a6b-98e5-3d1177f290d0", "value": "T1F335E10ABB441FAEC05DCF70827EC7174329445F8BF26A15BA288641BE5D3962F2BD5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497049, "uuid": "ad93f7ce-91f3-41fc-9abd-9b36b6f68d67", "value": "24576:jRO05/8N1OmMzjZ9kBS9iVlMDTda7PfwXyoE:lkPdMzjIS8l57fwX7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497049, "uuid": "3854022f-4806-4648-a587-799692952868", "value": 1080503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497049, "uuid": "cf877e57-ebd9-4306-b026-a760e63642de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497049, "uuid": "c1d089f5-7b8e-47da-889d-bdd7956ff552", "value": "uztbtfs.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc7c690-56ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543237, "uuid": "8cb810be-660c-488f-a406-48ac76c58b8d", "comment": "Malware payload (Mirai)", "value": "b7dbceea0244bec814eed620ec25fbc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543237, "uuid": "9bc27b10-9c71-4d56-ac7c-ab726a6067cf", "comment": "Malware payload (Mirai)", "value": "7a460dc9b24df54b4c5f91014af47bdc7022b27914b8f17e5a7b4d05691ab44c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543237, "uuid": "0030376b-66a1-4492-b735-3663fc18c9de", "comment": "Malware payload (Mirai)", "value": "672764802e0bc8c2e47ff213fedddece9afbf8fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543237, "uuid": "4b8f5883-3afe-4fdc-8bec-8c26113467d7", "comment": "Malware payload (Mirai)", "value": "16818850fdbf976bb5b80a6c342d69d1f3b60d56ed8e266b9877fc5c27a9d97152884363cb1d6d2da04d2154eae87715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543237, "uuid": "98999318-2029-4436-9905-3ec4d7d7442b", "value": "T148736BC6AE83D8F8FC1205712137EB335AB7F63A1069D686C7699A33DC52A11D1173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543237, "uuid": "d8be6b84-ba9c-40d5-85b8-047722ddd9b9", "value": "1536:D2riM3DQ0zGF3gV6XoLFc4P8KsjFJKhm8nCYjntxZfmZ:DVM3DQ0zM3goXUFc3KspCmHYJD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543237, "uuid": "bdb60997-f64c-4d4e-a87e-0d6ec9919d26", "value": 75500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543237, "uuid": "70983076-4905-4be0-80f9-4520167b2a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543237, "uuid": "03e928e4-1bbb-462a-8811-04cdd0dbaf2e", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1934cc3-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779537930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537930, "uuid": "612a24b6-e072-440b-8cb2-216e8598239b", "comment": "Malware payload (AsyncRAT)", "value": "13b4a64e1d3bcdb32fa67ded7760e10a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537930, "uuid": "d1ff1cee-e7b0-4429-a405-a998981c9ef3", "comment": "Malware payload (AsyncRAT)", "value": "7a95e73032cb2cd22407c35cdd6b04b77dd9735c2b1931e9af03f526dc75d7c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537930, "uuid": "1cb43c1f-5477-430a-9e33-b7248865f489", "comment": "Malware payload (AsyncRAT)", "value": "f4cf07f5b106c2a4d160644077dbf485b62a9fc2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537930, "uuid": "7580f4e0-45d0-4ed6-b9e0-451ab24abc08", "comment": "Malware payload (AsyncRAT)", "value": "2898bb0c8f993b6a49ce96310cecac68b1de736adaf01251cf680c3ce830a8844e983e5760886426557f879889f3704e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537930, "uuid": "a8340b51-5dc9-4d83-8b28-11f463d9547b", "value": "T1B6233D003BE98136E1FE5F789CF2214186BAF6632603D55E3CC941DA5B23BC6CA516F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537930, "uuid": "5483a0fa-55a0-44f3-b984-fad0c488cf76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537930, "uuid": "d7889efe-cd8c-4a22-9256-d3177a4f6705", "value": "1536:Lhh2/8kdibpm6bTgJAdEadIxFY6OgKmVcl:LDKibpm6bTgJZadIxW8K8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537930, "uuid": "10157709-c47e-4146-8ffc-495335942b9f", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537930, "uuid": "804563b6-d2a5-425b-99f7-13057a243dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537930, "uuid": "016671b5-af99-4f4b-be46-7861c8d4f444", "value": "Tngandth.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacc4199-56c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779554776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554776, "uuid": "f020dfb9-6920-4edb-bea6-844a652a43f4", "comment": "Malware payload", "value": "d33faae831659662d5fceaee4bf97cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "PassCrypt", "colour": "#B604F2", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554776, "uuid": "e5b407b1-39a7-4121-9b90-368546393559", "comment": "Malware payload", "value": "7ae5c0db3e68a6b6daf70ae0c7eeeb2e07eb2d1b808f9656462759bfdafe835b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "PassCrypt", "colour": "#B604F2", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554776, "uuid": "7eeb130a-bae7-4996-8ae5-67efdf5429e3", "comment": "Malware payload", "value": "eea366a554b08743adf046b41833b699b954212f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "PassCrypt", "colour": "#B604F2", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554776, "uuid": "436ac425-757f-493f-8d2a-6fea987aedf2", "comment": "Malware payload", "value": "c0087bceef6e92e380e704a765c9707c4cf865eec9a30dce7d8232ce1dd1a399bca5fa52db68f670ebd9a7c30e1338eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "Marsilia", "colour": "#68CE45", "exportable": true, "hide_tag": false }, { "name": "PassCrypt", "colour": "#B604F2", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554776, "uuid": "5153ba2a-c8c9-4d5d-9926-02d04becaafa", "value": "T1E526230223EA03D6E06F5D79C5B64999E2F6B471C764CEBF628401298E67FF04DB6306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554776, "uuid": "7c66c904-4c50-4a32-b0b2-465677224e6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554776, "uuid": "00e7b814-252e-4fd1-b31f-4afdcddb88ee", "value": "98304:/FACLB4+2La9ec+xKdOEykp8vUQvBcUnxV3RlprqlA:drgLKecykp8vUiBHx1RlUlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779554776, "uuid": "451bdb07-8baa-42f8-b9f7-f3d8b26b670e", "value": 4555698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779554776, "uuid": "e255b002-183e-48da-a25d-1ee949b72d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554776, "uuid": "79ce806c-3b09-4ab7-97f4-bc36cc401955", "value": "Sexsoldier Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a926748f-5694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533191, "uuid": "db3162f9-cc9b-42dd-875d-5844029e50a4", "comment": "Malware payload", "value": "666ff7648d737a57dcd1293c0f0d0c28", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533191, "uuid": "d3efa267-b3cd-4c18-a682-ef347adb5798", "comment": "Malware payload", "value": "7af9da9e044088b508dec4049de963562be4b1bc8dec7c82d8260a728c2767b5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533191, "uuid": "830d28fd-2e9e-4dd4-a6ae-b0b2029e8b63", "comment": "Malware payload", "value": "294a469c7862d1cb2944fb5b20674ff66407bfe8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533191, "uuid": "4f0dd98d-565a-4eeb-a2d5-37636e5573d8", "comment": "Malware payload", "value": "48bb0ded19d3c127fcebf250ca89854f8cff1e596fb89c82dcfb1f6054e46c32141bb9d986ea75ee6352e3eb38bef885", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533191, "uuid": "bf8fe8b5-18db-4e49-ae59-c9f4827061ef", "value": "T1BA4100502BB90238D6F78B38D8F96352BA657807EA219F4F0184039884B4920FC66B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533191, "uuid": "2e5a2aa8-0d37-49b8-81ca-c3fa002252f0", "value": "48:8v4jmeKpUQyyulvpAhxqbiyJt4wuJKUIA6q6Cax:8AjOCByqGhcuKt4wWKUl6q6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533191, "uuid": "0489e420-368e-4409-b53b-b025dd5baeb0", "value": 2099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533191, "uuid": "61b1339b-1e1d-4d19-bf67-363b881e0520", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533191, "uuid": "0dc29a61-04b7-46e6-bd42-17a7b0d92006", "value": "7af9da9e044088b508dec4049de963562be4b1bc8dec7c82d8260a728c2767b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d911ab25-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541432, "uuid": "f8258695-434f-47f3-80eb-948f0239c3b2", "comment": "Malware payload", "value": "64a2c055dd60a819c8cbc9468fd500ad", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541432, "uuid": "c1d6eaa7-c1d1-47bf-b3a3-77423e2a2947", "comment": "Malware payload", "value": "7b0251bec676ff83899d9822336221898e84f24c9f1688a024f8d7b7f9b3dda0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541432, "uuid": "d6490aa4-9e6e-4997-8c0e-3732779d70fd", "comment": "Malware payload", "value": "b167cc2056ed7278a0166c8e5ba5a7041df71d7b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541432, "uuid": "2375ab75-ead2-4323-82f5-41014961562f", "comment": "Malware payload", "value": "67f0d1ce23d9d41d3dc5f61f6e32b153baaf8ced5cba740eb133e5743b31c0011d5e8e9269683874af2f1fea48fdd1fb", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541432, "uuid": "3d046d93-b7be-469e-9ebf-ef6a3a4901e4", "value": "T164A501C2EB901A67D87A5A36C5A34E5113376C79D762276B03C8B72A4D072813E73B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541432, "uuid": "bfcc7789-efe5-4739-80e0-35d63955d98d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541432, "uuid": "0d856e39-ab37-407e-a30c-d8b358ec93f0", "value": "49152:wjdwIw8gzwfjnO12rLRa0oeZrDQk6NoLtuEqGyUK6O:kwIw8gzwzk2HRa0oeZYkXLEEqnN6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541432, "uuid": "3d941d81-6b91-4301-80a8-262fb469d586", "value": 2190488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541432, "uuid": "5718115a-c2b9-4b53-acd8-f100d0432a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541432, "uuid": "863eea05-d134-4a3e-977d-a7657337faee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a720725e-5694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533188, "uuid": "5e2811e6-ed6a-4dc0-8609-bd19ccef0f0e", "comment": "Malware payload", "value": "e14721acba44bd0c25c7ecaba0e67b99", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533188, "uuid": "0b0a0c05-6e72-47af-93cd-1afba6d2d83e", "comment": "Malware payload", "value": "7d635f45ae11f1e8e6fe47a2b2d5506c1d75e5475898da718023b09a66616eee", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533188, "uuid": "460625db-d93b-43a3-bacd-8ec134067533", "comment": "Malware payload", "value": "113954412646df41c6990c4c01a7b1611bae3f7b", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533188, "uuid": "5f42995b-063f-4700-8149-df77451ae718", "comment": "Malware payload", "value": "7fc59d4bf894127f2387299916dc73161b94bb7403c0b25a31c8104a2c393779e621ded97603936b299bd69e4900891c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533188, "uuid": "84b2f25e-1d8d-47ef-a06f-0349822227d0", "value": "T1B641001016FA1324D7F78F39D8FD7212E6617816EE224F9F01D1066849B4611E866F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533188, "uuid": "c7bf8867-1251-4d86-906b-15d3297bd07a", "value": "24:8THkdmGjMDvSwjKUaWU3AcPWkp+/CWApLvX22AKBY4sEZnxElHl4wZCr4I0WK6cn:8KmeKpUQoVX22AkPqF4wMUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533188, "uuid": "369dac31-ff1b-4ec0-8cdb-82163cce966e", "value": 2095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533188, "uuid": "dbadae24-d72f-43e1-beb7-b1d2c3cf3cea", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533188, "uuid": "04fbc6a3-290c-4d7a-bbbb-a75c16ac5b65", "value": "7d635f45ae11f1e8e6fe47a2b2d5506c1d75e5475898da718023b09a66616eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f91d98-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779537637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537637, "uuid": "8ed3acf4-2783-47ee-8a90-35a90716dcf2", "comment": "Malware payload (Vidar)", "value": "5c4f8f3834f1197e2ba3e731975306c9", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537637, "uuid": "e62a8ebb-578d-45c9-8114-87595e957500", "comment": "Malware payload (Vidar)", "value": "80cde2e72a387012bf786d041683c50f1e53596170c2971a5cd07583334c4fd3", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537637, "uuid": "2ad72cd5-8a12-46e4-9dd7-a9ed62d3d04f", "comment": "Malware payload (Vidar)", "value": "e8c0318d5bd678344740359a4c8b6ea8c6a9d17e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537637, "uuid": "0ff3897c-b5f8-48c1-8644-63554cce5558", "comment": "Malware payload (Vidar)", "value": "237c06c28294d549c0a8be54dc9315da95246f7c523a4b3fad630ad3c2545cd7576ed89eaca6fc3f2bdc7f98f7c8447b", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537637, "uuid": "27194b42-cb55-44ea-8a78-6b289f6fdb96", "value": "T117B4232B88227A9DDAA29171400FF9BBB4E412EF0791317ACCC5CB61947C5F4D6FA522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537637, "uuid": "29b4a01e-616e-4f23-bd78-cd630cb4cf7f", "value": "55395f8f9ce057344afeef3409f7b5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537637, "uuid": "198ca445-041c-46eb-b882-62dacdd97cce", "value": "12288:awz+uAESTF8gxXO5DxpY3OZ14GnUF0DWiOGjoIHCk7z2L:awCuAEmxe5Dw3M4Gn2GTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537637, "uuid": "54ab47b5-bb2c-4ebc-bab2-63b8b5a31fa7", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537637, "uuid": "5ce8a326-2b18-4ae2-ae7e-4fb5e15193f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537637, "uuid": "d82a5033-27c9-44b8-abc4-14a32adcc0d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06397df7-56de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779564701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564701, "uuid": "4207231f-fbd6-490d-bb3d-8e30ed4b4a15", "comment": "Malware payload (Mirai)", "value": "b51ab845011a03dab05886d74cac1d41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564701, "uuid": "ff4456f5-7b64-41ae-8a3f-1c6fcec952cd", "comment": "Malware payload (Mirai)", "value": "834df45b239cfd655b4f4a7be2e2a960b160fbc642b08aaaa90181e1672ab489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564701, "uuid": "5228c341-8818-4286-ba3c-475209610a19", "comment": "Malware payload (Mirai)", "value": "9d5b77fb132190dc08c42e4cce5e0b6cad5d663d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564701, "uuid": "17086e8a-2566-4bc5-845e-d8cb78252b21", "comment": "Malware payload (Mirai)", "value": "661c235d799bc1c7fc872fb53c52948beedf58f547fe3e609dc1f56cb8a41aab9fdb4d7adf2e8441867a130d8f71b848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564701, "uuid": "ecb8f2b4-cfbf-4e53-8061-aebffcf2259d", "value": "T1B1B3A84E6E31DF7CF7A8C33457B79A61A39873D622E1C585E1ACD2011E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564701, "uuid": "302439fd-1be2-49d7-9d2a-0787a0dfe0e2", "value": "1536:pv6pbp/+unURJgxDfmOetlhtaXYEKB6eIr7Bwbkvuop6nbe4eoFqC2:pvc1Wun+JiKOerEKB6eUibkvfpBqqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779564701, "uuid": "1dea5dee-d077-4204-a659-a5f28d27cbca", "value": 111932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779564701, "uuid": "7f222be1-8801-4292-8abd-15dad7896580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564701, "uuid": "13235545-1073-40fa-90d2-17a082bd3972", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a559396a-56e2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779566686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566686, "uuid": "d0999388-6eca-47c5-b4a2-6c3ac8d64058", "comment": "Malware payload (AsyncRAT)", "value": "52b79bb53e47e65d30b9b12aecedf92d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566686, "uuid": "8ada9979-17cb-4390-87e4-96dee863c200", "comment": "Malware payload (AsyncRAT)", "value": "8356b227590d90eae41ed3b9e503ef92c09be93314910f743390aa1f8be6ed07", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566686, "uuid": "38201b20-5fd8-418f-8982-65eef44335d4", "comment": "Malware payload (AsyncRAT)", "value": "ccab7da97df074ad4ffc36124dc7c4f800e369fc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779566686, "uuid": "b209fa85-4fea-40b2-8764-5a701b9881e4", "comment": "Malware payload (AsyncRAT)", "value": "b290a26faa397150de2a70e186efec6703f48707bb15caab9e7e0832632f6aeb635ac02b3182c9108b9b1245aff0f0a4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566686, "uuid": "5a954f03-5dc0-4907-813a-9edce526d388", "value": "T155232B003BE98136E2BE5F789DF151818BBAE6233603D65E7CC841D64B137C6CA51AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566686, "uuid": "55e377be-d0d3-49f4-ad39-36ea8065622b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566686, "uuid": "8b459eff-6a90-4179-a1c5-3a9f2b231ee9", "value": "768:tjq/z5bX/wPLsekOicvHk3eHlWMPbPgF0qamEFbOL1yy1YI6OCbKtYcFmVc6K:tj7seXvZH0ub4FrVEZc1yyT6OSmmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779566686, "uuid": "8147f878-de8d-49c8-8006-a9e7cc5fca39", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779566686, "uuid": "3faa9720-de7b-4002-a003-dad8eac3c83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779566686, "uuid": "3d146204-9ea8-4479-9533-332ea7aaabb6", "value": "KOP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed92bca-56a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779540744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540744, "uuid": "7a0b880f-e30e-4752-b00a-eae7277f7195", "comment": "Malware payload", "value": "b563c00e667fe0f6e9ceb2ef2c3c1e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540744, "uuid": "2026a854-73e0-4523-9738-7b5f90177a4a", "comment": "Malware payload", "value": "83ae3600c27b63fd6344bf4cbe75b88efaa9b70ecf4cfedfe7143bcb2750b264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540744, "uuid": "ffd91cd0-7ec4-4ee8-a3c3-4267acffe2e5", "comment": "Malware payload", "value": "8a9691b2954dd2420708e227951b1bf7d4c09394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540744, "uuid": "f12f1642-4433-4d26-a252-2f636d231f55", "comment": "Malware payload", "value": "27b7f13fe1f4051c79c711ed568d8f155a1e6ada0f03011c23e865333ccb660a1958a4b043264e8e216ac7f36dc19187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540744, "uuid": "b72483a8-c4b4-4167-b611-10d824422755", "value": "T190658D17E2A345ECC52FC134C3579772BA30B4295238BD6E1AA4DB322F21F509B6E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540744, "uuid": "1b4456cc-fa7c-488d-bdae-9af8f9b9d6ed", "value": "6d6570a1bc27b0cc2392803ac71dda99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540744, "uuid": "03fbd6da-d4e1-4ded-90fc-f3ed9b8447a6", "value": "24576:5C3IQmnAL1oFshs3cYxnHbVdGf7DJ4HVaUTVivzcmH+BEjebfcoWrnJ:yIQmnAL1oFl3cYx6XJkVaU5cz1eb0rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540744, "uuid": "161189f1-a8a0-472f-8089-ec37c72be60f", "value": 1547256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540744, "uuid": "f972b714-a230-41d2-a3d6-d9d24f613080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540744, "uuid": "32c6fa5b-60d9-430f-b017-d029b11bef5e", "value": "GGWP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a500789-5644-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779498592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498592, "uuid": "b0c4113b-b917-4972-ba25-a1c35be6f372", "comment": "Malware payload", "value": "1016a33b93fb9d2766c7fcfbd1bede1f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498592, "uuid": "2bea42e3-31c5-4673-98fe-89a2d05d5294", "comment": "Malware payload", "value": "842a02c26989629c2d82bbf50569efce51943c9f2f4b7cb841e80b6ed29fa794", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498592, "uuid": "33ebaee3-e409-4f7c-be70-3cb3c7702b47", "comment": "Malware payload", "value": "a97f9b28ff2c359a77a5602a27efd8c8489bed91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498592, "uuid": "57642775-2e73-4a94-b0c9-f4ea0c4beead", "comment": "Malware payload", "value": "8123db80323fac4f693cca0c6e0fa6909fe9441846028bfe7e1aa85f90e8fafb65cab4bfdf1330883a5de947466788d0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498592, "uuid": "0210a4a7-73d9-489e-9dc2-dd912d573e9d", "value": "T17A7134E2B934D972724E007DEB8E6230699315AF0414741874DF1D848FACB6D2279A7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498592, "uuid": "7f756bf1-bc20-4d61-bf78-7eeff8f7477b", "value": "48:BMFwKSKuMTRW0ueuLhamfAGHZI/OIz7HlUmMlE8Xt8960fm2pcBrY/GPsDn353zJ:iFcrVJdVDI/OQaC8Xt896RE/hr33JDvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779498592, "uuid": "d9157082-e061-4a48-84a4-b8727a31b4c9", "value": 3522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779498592, "uuid": "d6d3965d-32bc-4df5-861c-6166c4990d19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498592, "uuid": "c894ee16-96ee-4832-a163-d987a9c5c55d", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a3f68f-5684-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779526204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526204, "uuid": "afd5f98d-1d31-4c85-a946-f3f0d5980359", "comment": "Malware payload (NanoCore)", "value": "56b03464761d23145b6dce8d59f5dab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526204, "uuid": "2ab6b676-f2e6-449b-aa48-ca3e0f80d6c3", "comment": "Malware payload (NanoCore)", "value": "847532126b0bb10c442c0b7543a44cf980df737e3db3b36cd2118ab90b547673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526204, "uuid": "6fd7edb2-907c-46f3-87f3-9aa7a9405fbc", "comment": "Malware payload (NanoCore)", "value": "53270615d5e62daebbc0a8b02199a8576f170dc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526204, "uuid": "36e470b9-7fae-4a8d-bf79-01c9d7d688f4", "comment": "Malware payload (NanoCore)", "value": "e1beb062c371ba07d78f0996aa0dae9e48470b1e820a876c077d2fe0737404df883d6a9190f56daaaa42485b62a6831d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526204, "uuid": "1ffc789c-a4be-4dc4-8e02-56504db5e3dd", "value": "T12714CF257BB84A3EE2DE8679612202179378C2E3EDC3F3DA58D454B75B267E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526204, "uuid": "54cc198e-46b5-4a2a-a602-4265b9fa1746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526204, "uuid": "342c6bf1-85c5-4fbb-bfc4-46c09c2b20c8", "value": "6144:MLV6Bta6dtJmakIM56plNzULgm7SB7e+O:MLV6BtpmkNzcb87eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779526204, "uuid": "acba3833-72e2-4fda-bf11-cf7210e95914", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779526204, "uuid": "d45f7ab9-4276-44b2-90ae-4105a5856977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526204, "uuid": "83bd8e5b-b0c1-4755-8855-1588e9d6be7a", "value": "backup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e43857-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779520306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520306, "uuid": "0f0562a7-01a8-47f9-81a6-49d4890c1d47", "comment": "Malware payload (CoinMiner)", "value": "bf5d5248730ef60cd04698ac3e5a59e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520306, "uuid": "faa10c72-d630-46de-8dc2-6f138045e76e", "comment": "Malware payload (CoinMiner)", "value": "8532673f1c48bde8b03103b9dd18e56d548763996b48a106c68625834a99e5da", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520306, "uuid": "6bc93c4b-1d4c-4950-aebd-d0875c16f48f", "comment": "Malware payload (CoinMiner)", "value": "2d932ad27440013f625ab6acc508fecf62e0353f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520306, "uuid": "0041cd3c-2328-40f7-a611-3690030c78de", "comment": "Malware payload (CoinMiner)", "value": "bde79378fb193f906f869ac067e7ec431bea53e66e713fd29a32d671a5d2370d57dcdcb2b004eb0d0917225b6efeb9b1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520306, "uuid": "ee3e9a8c-86c0-434d-b715-fd4479b79afc", "value": "T1EC32E829BE810331E3A049B854794347957D2663E793E3EFF337A59E49A63488C41E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520306, "uuid": "169d038d-0e3d-4a9e-971f-a2ff5c3803ef", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520306, "uuid": "bdafbe82-09a5-4ad6-8973-061a85403760", "value": "192:yIcofWXvy8BqOx+eEP9PFJxTEZmFhS+cHf:y3o2vyfOwLPFwZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520306, "uuid": "cd6d9f18-39c7-47c9-9bdb-becd90507cf5", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520306, "uuid": "0e66a9b6-c54f-4a45-a96e-5df43184916b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520306, "uuid": "0da27ead-d0c6-4e39-9d26-79c661c93f15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdccebea-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544420, "uuid": "335a7c3b-60b7-43cd-98b6-81c2fc2dc1a2", "comment": "Malware payload (Mirai)", "value": "a1febce58a6c6fcaa99b4376059c1a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544420, "uuid": "d223a44d-9258-4ae5-ba28-fae28636c50c", "comment": "Malware payload (Mirai)", "value": "85f219d3cde670a8a58d12bca0565a0f02d8f7184da32e4515572198582c05cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544420, "uuid": "7d197049-773a-4cb4-9f4a-a23f33e8d79c", "comment": "Malware payload (Mirai)", "value": "8e091711439327ec448074103e807b68c5a6aed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544420, "uuid": "5ef3aefe-a1b7-4884-8bb2-6deb90cd8c5a", "comment": "Malware payload (Mirai)", "value": "9fba795d081af9801a896be413535dbcd323a18147a66600ec5790666749de3530f47a02922cd6dc3c86e3ef881194fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544420, "uuid": "6fd72c07-3306-4589-abe3-ae5126ec3b7d", "value": "T1D423F19C8E20899FE2DF86AE0F9B1D64C1F30DA6ED0ED04D6AD25096A10493D77A9F10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544420, "uuid": "6261df77-34c8-4c53-8e81-e8d430e8abc9", "value": "1536:jOIHu9FZgqUbl3LkH2k0ION4qCnBUOIGQHAq954:jU9FZgqUbRAWf2HBU5HJ54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544420, "uuid": "dcef5ba3-0607-4cc9-9837-2795b0e76934", "value": 49744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544420, "uuid": "11463e21-ed70-4214-98f5-9987226c75bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544420, "uuid": "d90fe39f-c16b-47f2-96ed-f57eeb03fde6", "value": "luxzz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314f1032-56c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779554465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554465, "uuid": "56f159fe-84ad-45b3-8a12-9cba9224f9c8", "comment": "Malware payload", "value": "594d70a72d90ae6a6c11b60cb6cb967f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554465, "uuid": "784a05ef-fe7f-45a3-8e99-d3dcc2081f79", "comment": "Malware payload", "value": "860623d199c9763c1b195cbe21ea78914ecae8d24a7e7c048ab325b8d9eb4606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554465, "uuid": "1832329b-22f9-45c5-885a-ca1b249440fe", "comment": "Malware payload", "value": "d1221ff62e38cb88941f98f1364559fa15d78b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554465, "uuid": "e82bd4e3-3fb1-4bc0-afed-4a5f42e16952", "comment": "Malware payload", "value": "7d171a7cc19cb3a62283d2821147580d4bcd2c973df0702f655457b394d7a5892621c738f1e36c2291841010c9851a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554465, "uuid": "1fb73893-d028-4a89-a5eb-a43a43cb4b12", "value": "T1FDA63341552358F7D4856A33CE3FE6A0AF39B774D50E769D813EA2A73E402D06E386C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554465, "uuid": "5d7cf1e2-6c5c-43fd-955c-eea551b53342", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554465, "uuid": "c80cb67c-6de2-4f89-a2f2-b621c2f59f21", "value": "196608:dWhdj3IIK+wB6oZWngA/+g02xo11AT5+7mgqyXtUnhqoV8c+FIt0vuVBUVVr:omILwBbkng0+P1eF+7mydUnhR9+FYCuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779554465, "uuid": "b7b86144-2ed2-4979-90c1-2a75d720f404", "value": 9885423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779554465, "uuid": "9e8eb26a-1eaf-4a22-a3eb-fbc5db4e67bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554465, "uuid": "dfaaba50-a7ee-4c6d-be23-b8f2566bb5bb", "value": "flowhelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ad15f3-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544413, "uuid": "4f773935-61ba-4a3a-969c-045dca221f83", "comment": "Malware payload (Mirai)", "value": "88743ad002d13ab18f485cdb6c7e32ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544413, "uuid": "956e99a6-bf99-484a-8c13-e9031867ba67", "comment": "Malware payload (Mirai)", "value": "86a17bc49df6dd76226a6b0666982ab05767f2efcea5b0d65f86bb59711e5b06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544413, "uuid": "fd590768-0773-4982-9daa-6a7012bc9e57", "comment": "Malware payload (Mirai)", "value": "da7cb90bba6d601f146cc8f5bedc5da0466e983d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544413, "uuid": "161f49c8-364b-4e52-a1b8-7cdd10c88961", "comment": "Malware payload (Mirai)", "value": "6ce66895d78992645549d93d627d9cecb293465fc08812d84122acaa517345c035ae6c27bee5f25e68ba494961d09896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544413, "uuid": "416c527c-521c-4ebb-9477-387606ff593f", "value": "T1D21302A1FE65583FC97871F41F8594039A115DF6AB024C8F1A748F972872605F9C6D0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544413, "uuid": "ce7aec88-85b6-4833-b6b1-47c77c246fa2", "value": "768:DWnhkpHhY5T62BSJRacEdB8ck+JKyusv1vVaHq2zDwhxr6s3LXIk96qbW4h:DWnKpHhY5m2CacSEEkp3w/6cYk95bFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544413, "uuid": "b36e3b07-92be-4609-a0d8-de34314e8716", "value": 44412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544413, "uuid": "e540013c-421a-4d35-a0fa-4c0a22a0fe08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544413, "uuid": "b761fce8-6aaf-4c1a-9551-4c8cd475ec2f", "value": "luxzz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306ebf0a-56fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779577227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779577227, "uuid": "3555b6f0-d2cc-4727-8a21-542021f2a703", "comment": "Malware payload (Mirai)", "value": "37c2847f39de085ea7bfbcc4f4211d87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779577227, "uuid": "62120d0e-3535-40c0-ae6f-c91c6ddf6270", "comment": "Malware payload (Mirai)", "value": "86fbce0753a371babee4fd2683be1b2fb622ba59fe1f21f41ca14bbfc0648a78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779577227, "uuid": "88b14a3c-d512-466d-9050-3f60a9cc1328", "comment": "Malware payload (Mirai)", "value": "6a5fa0e1f5f8feb80e6a3a0323ad22cb64191d73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779577227, "uuid": "1998b643-a935-435a-83b6-cfc1755223ac", "comment": "Malware payload (Mirai)", "value": "69b3bb2f7bcac4b27c6ee742a1bbefa689c24107990b92ef0f78c652ee47363b54fa67fff2a987952d0beccd36ffef04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779577227, "uuid": "40b9a119-0c91-498a-8d03-b1f38a03ef18", "value": "T180B38D35B97A1E17C0D1A4BA11B34326F2F2975D20ACC99EBD620E4FFF216502547BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779577227, "uuid": "255d90e5-fd8a-4e0a-a5e4-e857eca8a516", "value": "1536:B9VUBUhca/NCBYFy1B2ZLmFWdlgHtTOydmosWvT08NATnXwjS/lbxFOu7mY1tCRE:BThcaRy1BfFQyaxF57my4R5eQSr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779577227, "uuid": "5d04253a-e48b-40af-867b-ea4593e024f7", "value": 113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779577227, "uuid": "cce046bc-d753-4f88-85ca-2566941649a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779577227, "uuid": "6cae231c-5c43-4af5-ba27-502ee2a1c30d", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9e9175-56a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779540745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540745, "uuid": "965d6899-dbb6-45ca-acb8-49777da72c69", "comment": "Malware payload (Mirai)", "value": "10e354e1cb94c57c4d3af9d7c954d560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540745, "uuid": "cbfb7903-1a58-46fe-be3d-83b102ea424e", "comment": "Malware payload (Mirai)", "value": "879958868dc374d683be69ff469a497816e858916d65349bcb9336f9f2100490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540745, "uuid": "7850482f-12c0-46e1-87f2-eae078bdc4e7", "comment": "Malware payload (Mirai)", "value": "540c357e035d8d5bee04e33a9282cf826ed699e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540745, "uuid": "43098930-4187-4428-acda-0668c27753ff", "comment": "Malware payload (Mirai)", "value": "d49cae3c5cdd3050b3a21e467fb4e20696987d75f98189a8604c1178a41eb9411d75fcdda36129377759f51209c152a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540745, "uuid": "ac787147-a5ef-4eee-b08a-9d689e79e151", "value": "T105732A56B9819A17C9C416B7FB2E518D372623F8D2EE32039E255F2137CB86F0D6B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540745, "uuid": "bc172227-818f-44db-985c-b1288ce11d83", "value": "1536:5CUV/T+IKIN92kKBbe98K8KBWH4pnjPV6uQbFYYPz:5CUV/CIVN4J/K894pjPV6bCY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540745, "uuid": "bee535e1-ffcf-4422-a264-03cc2db4a3da", "value": 80592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540745, "uuid": "8ce1a19d-b243-4430-be78-00caeb2930dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540745, "uuid": "2b5334fe-ffcd-4397-b420-0c71ff55568c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6f2c45-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544473, "uuid": "666de785-12e8-4e4c-a5d1-bf5d50a7d3b3", "comment": "Malware payload (Mirai)", "value": "14658dd067937716f45f94984e347c39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544473, "uuid": "8418204b-4ec2-4a78-8059-8766706ac66b", "comment": "Malware payload (Mirai)", "value": "87b8a94249ca64d61bb139442b61f863eedd2175e3739dcaea1b2ca2c56f91cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544473, "uuid": "39b91b91-1642-4afe-801d-19b187e50d5e", "comment": "Malware payload (Mirai)", "value": "c63e7a9df07e58e9e145bd61e984814e34c1b800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544473, "uuid": "bda01743-6d04-4b41-9955-64947e18b0af", "comment": "Malware payload (Mirai)", "value": "c819b2b45179af1f8586014c1d1615ca12b7bbd1d016ea38dbf2945e59adf26cea7f8ae310c1134f4a3ec333a81b2d3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544473, "uuid": "ca7f0e84-cc72-4985-a8b3-577b335c3368", "value": "T1FE933B45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544473, "uuid": "e69445cc-ee8f-4fc6-b94f-8e7f81bb3df7", "value": "1536:lOV4HFG59DYFVayhw8b8pPRLQ0YeKXffd6bqmv1o:lOV4HO9E/V0pPVQ0+Pk1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544473, "uuid": "5783fae8-f0d9-4ddc-8eca-18f287cd9ce4", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544473, "uuid": "3f25b32a-025a-4f8c-a151-7953b9afaa97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544473, "uuid": "40576bcb-993e-491f-8048-cc95af8436b1", "value": "luxzz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb59f25-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544416, "uuid": "88148f9f-4cc1-40fb-9af2-7430b2e46ce7", "comment": "Malware payload (Mirai)", "value": "abcea54052cd8c46bbb9c301c00b079f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544416, "uuid": "278731ad-7e8d-4f68-a1fc-2de0c45ae9d6", "comment": "Malware payload (Mirai)", "value": "881835b1946f456484a0c73f55949bbdda9c06a4a30fc80ec8556bce3bc5d75e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544416, "uuid": "17f82f0a-e123-447f-8f9b-1153b4f2b2d7", "comment": "Malware payload (Mirai)", "value": "d776eb2da6c136cc2439be9ceae915ae951fd89c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544416, "uuid": "d59bec33-d989-4121-ad39-8d465978c13a", "comment": "Malware payload (Mirai)", "value": "41d93b0de4ed9d59c9091d975033e65e8d879a39523bb57e449ee709ffab9f2632acfda3c0712ab7afd64dd4a11b2da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544416, "uuid": "05f77447-83c1-4377-bdb8-83cc6d540e45", "value": "T11E13F1D46A887B4BC78492B7DFEE2C812766DA6307FBCAEC36D4975086B32701125099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544416, "uuid": "34d079cd-5a8d-4157-9834-fdc8c4517166", "value": "768:a3/FQh9sCCiwPUIIGDzrYmVDOKUDCUrb2IBJN28AyQU/:avFw9sC4nDzr7TUDCUmIBJJ6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544416, "uuid": "e199fe92-c716-457f-ae76-c2a99b2cb23e", "value": 42768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544416, "uuid": "22ea6c4f-30e6-4bff-8d9f-c000e9506148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544416, "uuid": "96b64b3c-008a-4678-a734-26a591eb1508", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0f73f7-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579587, "uuid": "1a6710ce-2146-48b0-ade3-d22fed1a9e6d", "comment": "Malware payload (Mirai)", "value": "5aaac11cf4d39ea2c4fa9f7cbdbc104e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579587, "uuid": "a7786b0a-dc02-4cb1-b6d6-c32fdf320561", "comment": "Malware payload (Mirai)", "value": "89ae7e96b58074be21444875d7497924624b70bb4c12d04af75ed57e104b6a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579587, "uuid": "96db69cf-4a84-4223-8df4-082a067366b9", "comment": "Malware payload (Mirai)", "value": "58351f7a989b039af007850f23286f709c9ef5f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579587, "uuid": "85fbe630-52ad-4b26-bb6a-85976ab56ccd", "comment": "Malware payload (Mirai)", "value": "07b9d97996d9de44f2be2697df498c0f84ce58235612f378ac08d4fdfc2e006c8fb8cb5f56d816476b423d2a6aad248e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579587, "uuid": "14ec50c6-153e-4c91-b168-763734d6a41a", "value": "T121C3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579587, "uuid": "9b3324f1-1196-44b7-81a9-e3dc8997effa", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPDL7ymm/QMurB1nKGNb:SMQplVDamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579587, "uuid": "1330fd8a-cd57-4ca9-a089-89aa19e96dcf", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579587, "uuid": "015371bc-ec87-4670-aae3-bf50edd21077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579587, "uuid": "cace53ad-93ad-4c33-ad6e-9e84cf1c9767", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4769e73e-56be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779551066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551066, "uuid": "0a382b50-b559-4f92-8595-30554f818648", "comment": "Malware payload", "value": "d2ca15781ebc104a7031c8982dafa8ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551066, "uuid": "4cb1b5e1-0896-4f15-8a8d-17597ef92fbf", "comment": "Malware payload", "value": "8a174aa70a4396547045aef6c69eb0259bae1706880f4375af71085eeb537059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551066, "uuid": "c7a9d7d7-ac6a-457d-ae26-438c1b556f94", "comment": "Malware payload", "value": "4544e11195c4ccea90a0482a6ab2d38cc0e5f253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551066, "uuid": "6c8905aa-dd65-441e-ad89-cb1261a1e8a9", "comment": "Malware payload", "value": "c0ee459979caec4b53c9aff1ce563d818a6f66a2eb8096e567388be2c04bc9d16c7f26402423fb40973c4f5aa336ecea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551066, "uuid": "cce2c91d-853d-42c6-bce9-530e3abc2092", "value": "T1A3063324B25200A9E977517A023B5B2FE6B53C2813604BEB07A08155DFAEBF4537F7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551066, "uuid": "c2b17b68-81bc-410a-b6da-246689b5ad24", "value": "c3f0638ae8ba5050ba7e7d6c9da6b387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551066, "uuid": "bc2ae714-7869-49dc-a32a-d4f4de6534bf", "value": "98304:+Zuq4kUWhOA6IqJAJ8m7uW4+NDiCYjvvSD+htuv:+Eq4kpgpSg0DiCUvy+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551066, "uuid": "376bb6b1-e4b9-4a8d-a866-fc3bbeaec37c", "value": 3844096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551066, "uuid": "f3cbc54c-1c90-49b6-afef-eddf167d1c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551066, "uuid": "889a865f-217f-4833-a428-51cd189d7c7e", "value": "8a174aa70a4396547045aef6c69eb0259bae1706880f4375af71085eeb537059.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36801857-56d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779561775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561775, "uuid": "48c5e5ec-2730-4f03-9508-7a43b9b4fbdd", "comment": "Malware payload", "value": "c8cd43a0455da0b8ec96f2ce89f49049", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561775, "uuid": "382b0425-5c66-43ae-8deb-97aa906abf7b", "comment": "Malware payload", "value": "8ecba4a76ef917335c54ac35fd608bbd57f1457292cf731da3eb5f60457e4a81", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561775, "uuid": "b35849b1-7f12-49cf-9c74-c558bc6037ac", "comment": "Malware payload", "value": "b58849857b183d1f01d88ca9b04bf9b4c001a5a8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561775, "uuid": "ed0e5c70-1268-4730-9447-958a81d78d1a", "comment": "Malware payload", "value": "ab1bcd5351f2972aa87c4f43ccbda78c4d7e5660ab285db92afe70b01a2f2f24ce9931ca66b72c298c190bf63069a1ac", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561775, "uuid": "7807e3fc-4e18-46e3-b751-87c28a969298", "value": "T1365733E81BC692C626C9FD787DBE03F1619FC97362A45A4341D2B4D1D27A733CA8B910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561775, "uuid": "89cfb18d-4404-4f4e-88ee-f5e8c36a64af", "value": "786432:+odRbxVOot8AqnT8Qpg82oYpaX+4zwhFNc9:++F3OozqnT8UHYG+4Mhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779561775, "uuid": "88abf9ff-e816-4ef8-91b8-7b50ed46e822", "value": 27037322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779561775, "uuid": "63701f7d-d268-4b10-a609-78ca0b8c17e4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561775, "uuid": "7d092aaf-a48b-4c1c-b0b6-ac1622eabd99", "value": "OhMyCream Skincare Sales Funnel.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5953bbc-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544406, "uuid": "b0061887-ed63-49c7-b287-5bcc4eb35ff0", "comment": "Malware payload (Mirai)", "value": "d6037b6c940d12f0a49aa183a9668222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544406, "uuid": "ea478e29-c9c9-456a-b22c-14dcaf5f100a", "comment": "Malware payload (Mirai)", "value": "90028b9fdb38e57ec656ada217e69657a89894450d75af850f4288163f99bcba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544406, "uuid": "3991adfa-8718-4fad-98b4-8b8b26a61d5e", "comment": "Malware payload (Mirai)", "value": "95f8c5b5b6b1f515acc9ff2149dc39a5ae83111e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544406, "uuid": "cc1f58f9-a873-4852-a578-d550b212f39c", "comment": "Malware payload (Mirai)", "value": "47f1863ebc3c9dbfd62333cce5202f14b00faa683e5083194a593d1e8abb580f9b7f55a1a8345c767a648d3b056e019c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544406, "uuid": "1e0937b0-c431-47d2-9e47-babdd3d12880", "value": "T15873AE73D8297D64E1588A70B0A48E384B33E490C6573EFA5996C3B9D047EECF2097B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544406, "uuid": "489fea40-b83e-44a6-84a7-f236f526d5e3", "value": "1536:Sau/T4YiSTVNh+4rw2LdukOcKzvBFX6K0xTCxs3bF:SrLTL84hdukODzn6PxT7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544406, "uuid": "908f4abe-f657-4cd8-9452-bd6369b7c822", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544406, "uuid": "e0d9fbd5-004a-4de4-b8f5-b58b3064d207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544406, "uuid": "4ac4d10b-21b2-4b98-8890-acddd89d1917", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa7f27a-56a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1779540978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540978, "uuid": "3ddd4497-52a2-4371-80db-3474c6883bef", "comment": "Malware payload (Stealc)", "value": "a5be24b553259264a5bf097f83b3cd45", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540978, "uuid": "695eb099-0e03-4877-aa7e-b52baf21a6a3", "comment": "Malware payload (Stealc)", "value": "900c1e1788b833ff8a8fe8fce3afe33e7049c0af9e9101c65b6db968938b8a0c", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540978, "uuid": "de912c0c-3488-411b-a4ac-8b110dc60038", "comment": "Malware payload (Stealc)", "value": "fae0f40165dc220f7c0bb2b402e9c31b1179c87c", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540978, "uuid": "43783fbf-bbeb-46af-83ae-57ec61fc6fbe", "comment": "Malware payload (Stealc)", "value": "875494b4647e8c200b9930df651ae462cbc65d4d4fd91d549f4fee0099cae57ebdc5e643b713bc5344c543ab59f39c3a", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Patched", "colour": "#B4905A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540978, "uuid": "1f0cbce2-f06d-4261-9460-20be91d51ede", "value": "T1D6F6123FB28B653DE06A163A7A73E210583B676164174C169AF4C88CDF254B01E3FB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540978, "uuid": "f883ffda-a97c-442a-b669-21587204e5ee", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540978, "uuid": "b06e48be-c92e-4201-850c-73f4d5ec42cb", "value": "98304:85/Yam3MrUGky3gABvvA/Xx3Acfd9qZ3BEsUIB:YAMXj3gA9Y/XxQcLmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540978, "uuid": "8999b1d1-7c2f-4acf-b12b-d658b6832e7c", "value": 16023009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540978, "uuid": "5ad4b102-df0e-4611-bb64-b550b89a5cbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540978, "uuid": "1d734cea-64b7-4f5c-9e02-3fe0537b536d", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79a9644-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544409, "uuid": "82ac9e37-66b8-4076-ba2a-3bf245afa4f6", "comment": "Malware payload (Mirai)", "value": "56c6b6c7fb37e4ec0eabca1df29ca30b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544409, "uuid": "3e049117-1fed-4708-8692-6b0d4b9c23a2", "comment": "Malware payload (Mirai)", "value": "91e1d93bcd43bda9e44da5038567aff744afd2a9cec546aea9de16d5d1dcf8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544409, "uuid": "ac4078ed-00bf-4a53-b86c-bdb29b8bf417", "comment": "Malware payload (Mirai)", "value": "279fec5054d9aa0e96cd1ca716390eebc8c31674", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544409, "uuid": "b31a42c4-ddfe-4d78-8c6e-c181001f6285", "comment": "Malware payload (Mirai)", "value": "9ba1b5cd43e62b9db9f63028fdc1569813660834b79231af9ecd8d0eece62228809fb02b82cd302470a827bf0245b9a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544409, "uuid": "51d38449-910e-4f48-8955-34271bb4a244", "value": "T1B223E0C6F11B123AD3B5297B14B2B914225BDF589BF041EBB7C1309B4775C8AF622A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544409, "uuid": "7280200f-f3fc-4436-aa66-0940d5c3621c", "value": "768:+I+eg11UY5hgLnHzt754NqzoaVZIoXWjlDaNJUbMXtkz6j/ETjhTSuPs9XsidR3:+4YcL512ajUwJQMXo6jOheYs9cIR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544409, "uuid": "2d8ba4ec-e852-48ed-93d1-9109512c23fb", "value": 46748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544409, "uuid": "030f7421-7aaf-4684-9f36-77a4dfcc6024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544409, "uuid": "4e82083b-df37-4543-870a-324f8ec9ced9", "value": "luxzz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09f8315-56af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544773, "uuid": "b88bdc48-010b-478e-9040-551f1fc233ce", "comment": "Malware payload (Mirai)", "value": "1eff6d5d6465bedc7dd3fa6dacd8b39e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544773, "uuid": "431300bf-e70a-42da-a333-613257d0f1da", "comment": "Malware payload (Mirai)", "value": "92b689d81072611a38b73285951194dfc68df07f554b70176adeef5ab03070ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544773, "uuid": "542ee85a-6999-4ef1-afce-2790c058f29f", "comment": "Malware payload (Mirai)", "value": "8c86f46c0076cb94305b5a6df0fff9992a3450bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544773, "uuid": "02fa5c8c-abe0-45d8-8505-4145d1a75086", "comment": "Malware payload (Mirai)", "value": "83fa57da69a97985fbef8ed2dbbe859c23a5d598a914e04ad492fc8c22e9f25ccc746f8a403fa47607486df671e2fe84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544773, "uuid": "94e4a7b0-f477-477d-83b3-2041a01945be", "value": "T173C39D97B74B6591D86202F407CB4F9D6E6321128F6BC8EB2C1E663B587D0CF491A392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544773, "uuid": "6f4269d7-4824-4c29-ab49-cb0ab0048f19", "value": "1536:e2X/fbw4zpbcZ9K8gtXlpoRWG4rsBBNbEUNzlcMc6Smx/LWG:tnbwZBgtXlpoRD6gNAURO6Smxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544773, "uuid": "7c058a81-6c51-4cb6-9e39-325326abd3e8", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544773, "uuid": "ae95645f-c570-432e-8c18-87710bbcc653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544773, "uuid": "d141426b-a920-4f8e-9179-c97bffe148df", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b3f7ca-56c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779555169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555169, "uuid": "19abfbe1-aa0f-41ac-9a5f-80303b655b67", "comment": "Malware payload", "value": "78b8ffe21c274931148bb5d25c458708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555169, "uuid": "7a5d44d8-2c8f-4783-8cf9-e2327bb265e2", "comment": "Malware payload", "value": "933d8df496e3eca4254bccf831549803daa069b3ee515e85b7e699a3e2e67800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555169, "uuid": "129d33f0-b5b6-4e9f-8a2f-67c08144f807", "comment": "Malware payload", "value": "29c04b9009b735c3d03ff54082336ff67f99bbfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555169, "uuid": "57af2b16-df59-419f-b2eb-51cfc87529ed", "comment": "Malware payload", "value": "df1575cfa94d2d477bab8dd6579477de412008f5da2e4910a630b9b64a0aebf634dd9bbe02e6d72cac534a42eb6b4e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555169, "uuid": "5ab2b32a-7cd9-4c6b-8c97-17960a269b5c", "value": "T109C66B11FADB95F6E903583100ABB37F63315D048B28DB9BEB547B2AF8776A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555169, "uuid": "45994d23-a77a-401d-b866-3d4d721c4a50", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555169, "uuid": "5a0e1602-0d95-4986-bf7c-ad51e25a8944", "value": "98304:JB8AS4+25GYClCRcmKbFsaeMQ04j3HxmcEKEO/:FS4EDCmyarX8MLO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779555169, "uuid": "bc43fe71-c29f-4187-86e6-a25c77ccda94", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779555169, "uuid": "07639287-2297-457c-b475-f26c0beb969e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555169, "uuid": "35fbe7b5-9f0a-4f87-8ec0-faba07077c10", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa862e2d-5694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533194, "uuid": "4b2fa20a-37b3-4d2f-8f2a-f597cf2ab5d4", "comment": "Malware payload", "value": "dd16ca1c8582655e1e1883b88833721c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533194, "uuid": "f0d2a184-eae2-4f0a-9193-cd1d777650fb", "comment": "Malware payload", "value": "933dccb05412c6bdb11044daf1d00365699248182607301b9b717ac5fe76a547", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533194, "uuid": "a1d5feb1-44d1-4b7d-8dcf-852f3ee94f4e", "comment": "Malware payload", "value": "61e7c9f8b03327dcbbb1a6f8e82671684c1f295b", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533194, "uuid": "e36e124b-e8e9-4dd9-95a3-f2f2aff7bc51", "comment": "Malware payload", "value": "4799f7734211775826aaeea08f38c0f8aa4ee4660107f67aab43d2f93361c1c2bcdf05dfa59dea79803c3893c04d0d88", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533194, "uuid": "1dba5f76-dce0-4490-b849-449566ef4400", "value": "T196B1AE02CD77C084C66BE47E68A82C2C40A09A5D2FAD2C06A9251C0D9BAF6C18744B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533194, "uuid": "9c64e885-9112-4ece-94a6-f2f83bd0c7b5", "value": "96:R6yjm7ogQWvn9vTZ9LLieoVf74XAb3nOewmKnsZj94bkaNABH8:XjCogQk9LZRieoN4u3nOe5Kng94AaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533194, "uuid": "abbab162-003e-493b-b03f-1894bb86c57e", "value": 5386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533194, "uuid": "c9cd21a9-daf6-4623-abed-5652b1459ab0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533194, "uuid": "badf4c62-9bff-4a5a-b1e8-b34411d5754e", "value": "933dccb05412c6bdb11044daf1d00365699248182607301b9b717ac5fe76a547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d8884a-5681-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779524973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524973, "uuid": "fc42b253-7c78-4cb5-acd3-44d04e5b7bdf", "comment": "Malware payload", "value": "68a7a4e8f5426e604afd1718bed8cd03", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524973, "uuid": "0db5f507-e413-4e3e-9a22-e246f1fc3e66", "comment": "Malware payload", "value": "93d2d449b5f8b065cf53757288310765c6ffda420dacbcc06e27839d6a57159a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524973, "uuid": "bb4dbe66-b7e2-449f-8f3e-b1926ad62029", "comment": "Malware payload", "value": "33e66238d4153bea5cfa0c1a1534d287d9b281ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779524973, "uuid": "2ffd19d0-8889-4257-b5d5-f6571c8fed74", "comment": "Malware payload", "value": "e525082df8936c58143b308c97624a563822ad08635d7a21659dd8ccfa2513397d584d04890480fd2f2b6a6747969913", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779524973, "uuid": "e5345715-d0d6-412a-95ca-e4aaf08d7603", "value": "T127136D6516953C25AE99883B5C7F2F0CB9A983E1304491DDBFCB3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779524973, "uuid": "9666262f-1da2-4cc1-8e7c-00ecd656c186", "value": "768:kr9NyXsZztCjS9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:CHusZG3co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779524973, "uuid": "263d82c2-974e-40c7-9f60-df52f60adbf9", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779524973, "uuid": "29aef5ea-e8ef-47b9-a377-3295aa76bd26", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779524973, "uuid": "4b4e5b30-aceb-44ec-a5d9-3470379215ce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776ae382-56a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779541268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541268, "uuid": "7e953b00-0752-4298-93d6-3fff6e3fd23f", "comment": "Malware payload", "value": "1abf8d434d51f11a79e1b4ae689a2bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541268, "uuid": "19fe3601-3d53-482d-89b5-3e1b2710e94c", "comment": "Malware payload", "value": "95ee4b9f039d8491f6c3b537a57a8a16349bdf63cb1d0d69e291b0fde580e4cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541268, "uuid": "d6929725-d892-46ca-a289-6d701f85d11f", "comment": "Malware payload", "value": "70e061ed9387f807bdc5e7b7db3b0d6da6a7348a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779541268, "uuid": "9820a35e-21b2-4493-ba65-554e670b4a2e", "comment": "Malware payload", "value": "c34079e174db43f59fb5635b2329d15b93ccea9b6942f6b2aea02ff94b2b11753d4bde2bb208555ec56520d0b66b4703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541268, "uuid": "1dbf8e8e-5cc0-4c5d-9ef5-37bc465d91da", "value": "T1B702D64293D44372DA7343B77D779381CB36AAAB1C865BE8748C821F3F2655187233A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541268, "uuid": "6bc2ca70-2a4e-4535-88a1-060734900bdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541268, "uuid": "feab7577-fd0a-47fe-abfb-8925e5873bc1", "value": "96:VuC1n2uo8ciTtath/Z6ejVAkJUpMwI3WNtW1jYcFKNVcz1W4oKYMsLYUa:f1n26csath/VAkJJL8stYcFwVc03KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779541268, "uuid": "f628ed68-590d-471b-9496-4eef58de08f6", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779541268, "uuid": "ca451945-faae-4f88-89b6-9347cb176bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779541268, "uuid": "7d9fa801-3442-4d48-8a67-8bbe9231697e", "value": "KMSELDI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1761aa7e-56bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779549697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549697, "uuid": "15850957-554c-47a5-a8f7-d0d551c30e91", "comment": "Malware payload (Mirai)", "value": "40b1eafc7d83e380556aeff4b8f8d373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549697, "uuid": "28bca2c9-0505-4fba-8f25-ea1b369f51b4", "comment": "Malware payload (Mirai)", "value": "97dedb3e78b097a72cfe53fe9d6d0486674ad5a1de59cf218106e7e2c7616d04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549697, "uuid": "8a2a9954-e6c4-47fc-9402-f22911b4e3f4", "comment": "Malware payload (Mirai)", "value": "9db4ae6fefafbe158c6b5727c4c99d215d1fca33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549697, "uuid": "1023df7d-5726-4ecf-8d2d-4e250ffed260", "comment": "Malware payload (Mirai)", "value": "5c78b57a9dffb689add200ef49a046dac059ec254e09cbbf2f5d28a348b038383e6c79b365cb02c420563a840be16032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549697, "uuid": "0ef923b8-c3cc-4c80-8f6d-a44cc7476cff", "value": "T15E143B46EB818A13C0D71776B6AF42453323EB64D3EB73068918BFB43F8279E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549697, "uuid": "7913d2f9-a837-4450-a868-b04ceebfcfa8", "value": "6144:MlOn1D2llto+ia3+6e0s3eyVvlHOL/Kdmk3e0t3:MlMDktga3+6e0s3eyRW/GmkO0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779549697, "uuid": "75069f44-e891-4694-b93f-d5772e373863", "value": 196881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779549697, "uuid": "c65a7a00-16d0-410f-94d6-ff6c71a381b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549697, "uuid": "3d58832f-2118-43e8-96df-c0d515c00e07", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3888cb4e-56e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779567792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567792, "uuid": "50fc61b9-a2b7-4e22-bfc2-5d2b5ab61060", "comment": "Malware payload", "value": "26c2530b1bd9d0450a9967501ef68b79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567792, "uuid": "137db9f6-ab66-4148-a39e-a8dcd568b0ad", "comment": "Malware payload", "value": "99674e4a80ac3bb427590e1db2fb66a602804c38444bb6b5c0ea57f9855bb712", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567792, "uuid": "fac912ab-3c4c-4167-960a-a0e950b31503", "comment": "Malware payload", "value": "5c8219d0d6953563b64fab7ca069aaddc3db0dfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567792, "uuid": "bcf6e2ad-1678-4e30-9146-16a0a641361d", "comment": "Malware payload", "value": "9cdec4e9a3a31f9ce175c0987b96cae24dcffd941e7a06b8957130787f9783fd360a5c268821733237f2847e11f79b1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567792, "uuid": "287e38d5-a05a-4ef4-9c23-37bad4760a93", "value": "T12873F8B9F5E1B1325A23F970413F500FBA3B646BE44C09A8F254D8F06EF69894463F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567792, "uuid": "233b274b-5094-4943-b1c8-f1c591aeec9f", "value": "1536:rFQo7P+Sq8Gc1o8iFFVuvXg+7OqttIQNtQ+CjS+:FxmFFsg+7Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779567792, "uuid": "72790a28-70d5-4a6f-8d83-72c45d07d2a8", "value": 80631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779567792, "uuid": "3551f794-1cff-49e8-b26c-efa788e3e483", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567792, "uuid": "f7c8b2f0-e2e1-4094-8f96-c74d470ac6c1", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19996b22-56c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779553566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553566, "uuid": "257abd3e-4259-41e3-ac26-b83d47167327", "comment": "Malware payload", "value": "7b1a236a3dc868f4ce9a9a3430363259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553566, "uuid": "c699fe4d-f3ea-4a48-b501-2f20fce7003e", "comment": "Malware payload", "value": "99921cb2e67ae6b2b77ad716cb384d7edcdc258956a428b0d1d4390bbc91a50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553566, "uuid": "ab8adb7c-193d-41a2-b374-46544c6d2434", "comment": "Malware payload", "value": "b94afb8a871adad82790620c8451605dacd54009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553566, "uuid": "fdc1c1ce-3b14-49b5-ac7e-ae462973f99a", "comment": "Malware payload", "value": "42a716377eb2e7e6a9c48e257ef9213e74ee50aae57a93fb93977e8a3af0a199be9e7fd338a21628216e183e7afe714b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553566, "uuid": "f12f1270-59ca-4f52-988f-af9ad223d81f", "value": "T1B2D34B1773A630FCE1A7D578C9451A06E77278320B61ABEF039443662F672E49E3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553566, "uuid": "c1d0169b-4db4-4bdc-ada1-ff92dc2d4127", "value": "cc7a18f08212d5ae9a7d90c67ebfe6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553566, "uuid": "61bcbc98-e2eb-4412-9bc5-cde1c2d356b7", "value": "3072:BYQMGluKsFzHUuRS+Uljyh3DiuKEmwzUmVm3oPhVPy:BLMG+zHUuwQiuPXM8hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779553566, "uuid": "a864889a-4312-4a72-a772-a374bfddcd5b", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779553566, "uuid": "a7d5fe23-7d97-4f3a-b64c-4a7e897be7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553566, "uuid": "b9032204-5e87-4615-80b9-37151cf0bc9b", "value": "1.\u70b9\u51fb\u5b89\u88c5\u6c49\u5316\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88369a5-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520332, "uuid": "9b5cd332-5608-4afb-b1cb-58e747a1bfcb", "comment": "Malware payload (Phorpiex)", "value": "b25ba0317c5e2b7685ff4faf6ae7ed84", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520332, "uuid": "5b627657-2230-4f7b-8df8-2439e4e657fd", "comment": "Malware payload (Phorpiex)", "value": "9db0c352d6ac27dd14a0e1be6fe1c4d366739baa037901bf7a2a03685b433ac1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520332, "uuid": "ea546143-159d-4381-91ca-cbcbd5ce584e", "comment": "Malware payload (Phorpiex)", "value": "d74cf13e39972afeee59be1778c64e8a3e8abd58", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520332, "uuid": "ea41f47e-f808-473e-bfc6-e0f6ff8a7874", "comment": "Malware payload (Phorpiex)", "value": "5843feb3c4e53309184b475677a8a4c3ac5bddf954bc226d821733aea5e6522add36cc1d8521d48a2f88d9fb5b45c470", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520332, "uuid": "69de9555-235f-48e9-8e95-c6ad3d5c25dc", "value": "T1E3824B0FF9914216D1E100B05675863BDAB99C72338854EFFBD48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520332, "uuid": "5aa71b15-004b-4b8c-8275-ff7962f0ea82", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520332, "uuid": "27ac3f2c-2bd4-4ddd-b230-864ceabc4342", "value": "384:5GlIJlVYer7bskwAd0ZHu9JgiL7QWav8U9cZ:0Qgw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520332, "uuid": "bd2473a0-5b9f-469d-a2d1-8563a81df7be", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520332, "uuid": "0c872d66-8cec-4d3c-bcbb-37df26628a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520332, "uuid": "fcac7cfe-220f-42cc-8499-359535e5765f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cb7085-5682-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779525368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779525368, "uuid": "88376823-4ec1-46a6-a6a1-778f4bf1950e", "comment": "Malware payload", "value": "9e185f03fedb2824328e33c6f510fce8", "object_relation": "md5", "Tag": [ { "name": "cloud", "colour": "#8EB463", "exportable": true, "hide_tag": false }, { "name": "imds", "colour": "#82EBB2", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779525368, "uuid": "62ebcf53-6f9a-4825-8390-05d2cb03263e", "comment": "Malware payload", "value": "9e8e5f217a03e4fa008cba8a2df97743e66970a99ff917e86d58036d067a552a", "object_relation": "sha256", "Tag": [ { "name": "cloud", "colour": "#8EB463", "exportable": true, "hide_tag": false }, { "name": "imds", "colour": "#82EBB2", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779525368, "uuid": "d1ff0efb-99a7-48dc-a681-394a0b09a6ea", "comment": "Malware payload", "value": "ac059cffc3930a4aeb12ec2e642946bc92a30ab7", "object_relation": "sha1", "Tag": [ { "name": "cloud", "colour": "#8EB463", "exportable": true, "hide_tag": false }, { "name": "imds", "colour": "#82EBB2", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779525368, "uuid": "9e793787-dca4-4fcc-ad3b-896079a03cbf", "comment": "Malware payload", "value": "1a3b1087d0281a41fadf5e85beba81102358b355adea00f3b21f5c42ec2ad94c8921fffb710f1103cb382a26b775983b", "object_relation": "sha3-384", "Tag": [ { "name": "cloud", "colour": "#8EB463", "exportable": true, "hide_tag": false }, { "name": "imds", "colour": "#82EBB2", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "nodejs", "colour": "#23C8A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779525368, "uuid": "206c2523-8608-47cb-9f27-48c0101dce3e", "value": "T1FF12F646A3BF052309CF07E2B06F121254A5664B3D80F9E47ADC6E451F4E640B6B3AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779525368, "uuid": "5cdd9ae3-7ef3-45a6-a232-c12df6d526ad", "value": "192:HBkRsFXxQR7gYq079iZcxAQ+TJVxDSGeBXP5x5yf/5ZdhLEDBQ2UpBK0DC0C:HBkWxQ1gYq07o6x2JVBSGezC/1E62UpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779525368, "uuid": "9c1d2010-887e-4d4a-bede-69db206f0aa4", "value": 9591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779525368, "uuid": "f39210fc-daa9-4250-afcb-420626d77682", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779525368, "uuid": "4c78fdb6-e918-4bb4-ab98-5f8336bbd8f3", "value": "fast_recon_v6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f97f46-566e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779516919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516919, "uuid": "f21a4ebf-5937-4505-a8c4-245489554bce", "comment": "Malware payload", "value": "7c861aeaf08af55988b8290aa0230a4a", "object_relation": "md5", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516919, "uuid": "c845eb2b-300f-4af2-b0f5-34f14261acd3", "comment": "Malware payload", "value": "9fa05b1e13bcb3df918eabc09317cebe183a0e880667ef281fd68fe5efdabec5", "object_relation": "sha256", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516919, "uuid": "82708a17-390a-4962-9e4f-e2d527d90d14", "comment": "Malware payload", "value": "4c948aff153f4869c24f4cef7514839fa59d92ec", "object_relation": "sha1", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516919, "uuid": "caf84ac1-7d52-429a-91da-01babc71c9d8", "comment": "Malware payload", "value": "f7a5c77ed6e01b9844619ac609bc6be3709844cb64543de934da678145260d518d0f5d2873789f8cb228a302d7da2963", "object_relation": "sha3-384", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "BoryptGrab", "colour": "#59DCA6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516919, "uuid": "fb5e36a6-41f3-48d9-b884-17b47a7393e2", "value": "T1DD155C16A6A800BDD0B7C6B4CE665D43D771F84B03706ADB03D05AA63F277E49A3EB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516919, "uuid": "360349e4-e796-4fc4-82fd-dae694e05021", "value": "12288:W9KG6EwibnUchC97UlCiYUZshreupPVNMe1R/OiMWAYNt2vpfj4flmDxcTgKpNEW:c3zqchwucVNMe1RXDHt2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516919, "uuid": "8608134b-6f2f-4279-a394-1ca5ab982e5d", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516919, "uuid": "1aa1ae3e-ef6a-4573-84fe-0b71446b02aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516919, "uuid": "4eaa416c-f953-448d-bd7c-d0f5fea89c7a", "value": "9fa05b1e13bcb3df918eabc09317cebe183a0e880667ef281fd68fe5efdabec5-openhashtab-github-io-6.52.3_dump_64.exe--", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eae1fef-568d-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779530140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530140, "uuid": "1b055077-40f7-40b9-aa8e-570c0065dc65", "comment": "Malware payload (Prometei)", "value": "768bc3050756f77ca0808005823d5222", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530140, "uuid": "62d76705-8173-48ec-a6ac-1c5272584ddb", "comment": "Malware payload (Prometei)", "value": "a0244f5f959cad99467f98cefa91d71c91cfa1623c675a95eec158a429c5d21c", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530140, "uuid": "be9ab50b-1d1b-4095-99be-1ab04dcac3a0", "comment": "Malware payload (Prometei)", "value": "ab98b4777deafb2ec73c9ba09e2fcd9e93d068c2", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779530140, "uuid": "5b7079e1-defb-4744-a17b-27e21d846087", "comment": "Malware payload (Prometei)", "value": "c2bca432c08667e1e71bca7d0075a4bb3fb129041279260e33ea69e11aefb9698deaf6d8a4bbd216307a21a793e6e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779530140, "uuid": "27c8c011-a087-4d42-8efb-09347ec8f017", "value": "T11D414356705221FC5AB9803ADCF3A4193105400343409CBDB89FB9BCBF649A9F2FA3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779530140, "uuid": "0226da3b-4d95-4f2a-aff7-8c7945cfb672", "value": "48:3FVpzjfZq7B3nBABXVB7v0d/t8DUL7Sad/5N:3bLuYUL7Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779530140, "uuid": "b16b156a-4b6a-4492-a9b9-2666a0322ab8", "value": 2104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779530140, "uuid": "737766a8-b054-453c-89e8-fb685b0ae733", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779530140, "uuid": "1daaac06-78e2-43be-b4f2-d78174d60b14", "value": "a0244f5f959cad99467f98cefa91d71c91cfa1623c675a95eec158a429c5d21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6cb406-56a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779542246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542246, "uuid": "3bcafac0-af95-4e38-94aa-ca8cca3ab599", "comment": "Malware payload (Mirai)", "value": "c5aabc57b308f925e5271a116dff956d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542246, "uuid": "3562034a-1356-4e34-af48-64dffe2ef177", "comment": "Malware payload (Mirai)", "value": "a25827f718b3378375b36fb85fa2300b373c4a795f44aa13f7640c23ac68ad98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542246, "uuid": "9c9ddefe-43ae-4a56-bd29-1f151369bb2e", "comment": "Malware payload (Mirai)", "value": "3c5483f4e9501b2ea3249917735e22fe0af21b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542246, "uuid": "e7fff637-817d-4699-a1ce-b02e24f4d6e4", "comment": "Malware payload (Mirai)", "value": "f5445cf87ae9a9a1dacf83730b747b96756e73aeab2d986c719671717cc03566910e9cdf2f4a1360139c96e496daccbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542246, "uuid": "b61c17de-8392-4bd8-9e86-9ba2d8c99023", "value": "T119B3B74E6E31CF7CFBA8C33857B74E21A25833D626E1C685E16CD6111E6024E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542246, "uuid": "bd636ed1-e78d-42dd-9a64-2c2686094290", "value": "3072:LTl1v+HpYXtmjfQio+wpTVpjMqBYAns7p:LTqOdmjfQio+wpTVJRLip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779542246, "uuid": "c59c3eff-52c6-4666-b14e-9da783b62e1f", "value": 114300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779542246, "uuid": "73f6a29b-6b91-4c81-a813-3001a3f5b0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542246, "uuid": "f18dc763-3dee-468e-9dc6-4e73eccee71d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5181dd-56ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543505, "uuid": "b6f1e2d6-6409-4396-92cc-9b3f77d4fd36", "comment": "Malware payload (Mirai)", "value": "24f57600f26f3b39fcda91de9de80f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543505, "uuid": "6ba7b6c0-4f51-4de4-9a95-701d9b1c6a32", "comment": "Malware payload (Mirai)", "value": "a32cfaf60ebefb3de4e039447ab57df227457bc3c49772bc64ccbade10a3e748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543505, "uuid": "da4b5253-a461-4763-8f96-4768b038c015", "comment": "Malware payload (Mirai)", "value": "77690fcf335c7bbba946ab011f6864a7f64aa2ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543505, "uuid": "f856ff5d-6bc6-4886-bf55-85a7bfd5878e", "comment": "Malware payload (Mirai)", "value": "96e9508c64c7e79ccb60056eac368df72350f95fb48ddbb54fdff6014d502cc28380be94bf10faba78fab0b7d903f169", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543505, "uuid": "ce1ac0b2-b5a8-4d44-9993-c54d6d3b236a", "value": "T131933A56BC819613CAC513B7FB1E028D372623F8D2EE32079E115F6173CA96B0E67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543505, "uuid": "dc7b5e8b-9eb3-429c-bd9a-5fcdfe741279", "value": "1536:fhI+lY+vGuqNHgJPX8ZBsTDiDuWHMd6vYfD4dGGffWM/YZgaIapXGisW:JIwY+Ouq2q7dY0tfWfZg925", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543505, "uuid": "126b3f7f-24a4-4704-a4e3-a6bb0d623267", "value": 92372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543505, "uuid": "74f81a66-753c-46da-9de9-94b34d3f2b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543505, "uuid": "99fe3422-6966-4f7f-bb79-66cad4a43722", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa5995-56f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779574059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779574059, "uuid": "8c921429-7955-48e6-a6df-94fa7866dce3", "comment": "Malware payload", "value": "f90a7367111fe2fb5893cb398170dc67", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779574059, "uuid": "27b4a6de-0b84-4f69-abba-947a7f0a706b", "comment": "Malware payload", "value": "a48c459759d2e9d401f360e23390ccaab1b83b29986fe138392fa4026a58b07f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779574059, "uuid": "0e7b0ebd-6f12-4206-9365-ff44190563f8", "comment": "Malware payload", "value": "703e878ca20fc12406bba6e0007b4f22016362d4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779574059, "uuid": "b1647d32-7816-47a6-a2d1-9daab0379822", "comment": "Malware payload", "value": "4238459d21dea4785f84bb744a02f2733a8f5f07502fee2f6c2c55f510ad0930669a777e4abac161ca40bda7381e580b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779574059, "uuid": "f5aa679d-4f2b-4bd3-bc3c-1ae4fd167c7d", "value": "T11D75221A3FE52277E1B91B3488F2874A9331F4911E2647DF1688AA74CD23BC53E72794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779574059, "uuid": "bc53cb51-99bc-4b14-9c30-da6ca188c091", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779574059, "uuid": "b5308f18-1ca3-4325-b2e5-e5e1e8073863", "value": "49152:4jnTAcrPqaGqIKQE09RRj7UWe2mSlrD4llg/qe:CW8fQrjMj1IDKlg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779574059, "uuid": "2863354a-a40a-4faf-9fb3-4d49f014d5f1", "value": 1691648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779574059, "uuid": "6ebda100-d3d6-44c0-9a07-6173277f0293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779574059, "uuid": "54f02030-0a0c-4c32-92f3-263e94c1b497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a7323e-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551870, "uuid": "7e22b888-e19e-4c65-adaf-3562f6757467", "comment": "Malware payload (Mirai)", "value": "cdf9a2354923693c1b1c75cf5f000dc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551870, "uuid": "f7c3b5a9-25d2-4283-bb75-d3080cf426a8", "comment": "Malware payload (Mirai)", "value": "a4b9431b109670773925f8da721c0a10342b4e3986b2f18a5d380e109a9c0fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551870, "uuid": "9fdf81ed-1abf-4fc8-afac-6a4cfad4199b", "comment": "Malware payload (Mirai)", "value": "f175e003aebb4fd25512f6b6e17b8d8df890b5eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551870, "uuid": "874c08e8-bb7c-42c5-91a0-9ba2181e67d1", "comment": "Malware payload (Mirai)", "value": "b370521335279cd5ccaa517309bd1602ebbd1626e01218d05b5cb18fdcf85c19acc507cf6e75e87a220d545fe0bd6be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551870, "uuid": "547af113-7a0d-4162-8db3-aa9caa980530", "value": "T1EA360997B8D14A43C4E43676B8BD81C833A34EB99B9713666D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551870, "uuid": "4aa60558-e05b-409e-bf82-192ffd951d15", "value": "24576:J1aBkWO3wadzwaH/9lRO8wi4HUFJAlR1anVX0ruJJeiP68sLNBojZw99oPpOiDtI:FvIhO/TvWdiSd9wwycyeLlA1snv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551870, "uuid": "f71e5e89-9cad-44b7-8f07-f3c507c2328e", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551870, "uuid": "a17439d1-3535-4ebc-9e48-313e0d082473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551870, "uuid": "9a132c32-3f64-40fb-9043-f38d882fb056", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54ffdd1-5669-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779514770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779514770, "uuid": "938c424e-4457-4059-b7d4-66a51eab644e", "comment": "Malware payload", "value": "b624dee2080e2feb8729cc704a31518e", "object_relation": "md5", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779514770, "uuid": "22f88d2d-3fdf-4b4e-9302-bde2e78ea632", "comment": "Malware payload", "value": "a51b5907be21d3069cb5d7088cb16501d0cf3f5f3465ca8e14507e5eabe7d0bc", "object_relation": "sha256", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779514770, "uuid": "ad97f8d8-9766-4909-993f-de4a4131ae6b", "comment": "Malware payload", "value": "0480880e94280f7a70e8dd67394edc5c61bc4594", "object_relation": "sha1", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779514770, "uuid": "de5b4543-4397-40a4-9e93-8b7d2fc63d9d", "comment": "Malware payload", "value": "1e91bddc211fcd4dc1157e154af9a7f4f508f5d5e4cf40170ae18880df7a19696d6b02b988efa466e532b94c38a473cd", "object_relation": "sha3-384", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779514770, "uuid": "639ec209-c740-4876-963f-dfb880156205", "value": "T169656C17E2B345ECC56FC034C3639772BA70B4294638B96E1A94D7322F21F509B6EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779514770, "uuid": "0e46c6f6-cd58-4f46-9ee8-b7bc45db3cdd", "value": "d3a615b1875384c0ec55dd8588433cef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779514770, "uuid": "43fe57bc-a228-410d-87ab-12848fc9ac8a", "value": "24576:Gny6VqPYY9HL0Q0vgTuH87P6sjaMfHwYqUyznan+abJt2:3iqPYY9HL0Q0ITuH8raM4fHnannt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779514770, "uuid": "1b25b30d-775b-415c-85db-845f6f5f7b58", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779514770, "uuid": "e83ab17d-6c8e-403c-81c4-a0f36a3b55f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779514770, "uuid": "c9a35e9a-4bf6-42c5-a0f7-66350b3f1739", "value": "GGWP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd7a1ad-56d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779560093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560093, "uuid": "1a3a30e7-2d3d-4122-b5b3-d284efc9f97f", "comment": "Malware payload (Gafgyt)", "value": "e92502aeaf993106ca8ba0b819470574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560093, "uuid": "b3cb803f-6bd2-477e-ba81-504cdb8b502b", "comment": "Malware payload (Gafgyt)", "value": "a58080863e501b1e93337d702fdeb425c91ab23a081b59deb87b03aab784002a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560093, "uuid": "e31b1f60-1706-4548-8ac4-5ad7750623d2", "comment": "Malware payload (Gafgyt)", "value": "edb8fe9b9ba887b8f9363a56db2e1ca27c11e536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560093, "uuid": "27323051-9f82-42a4-9a68-ba34bc60fb7c", "comment": "Malware payload (Gafgyt)", "value": "c5ba097f76987f17e8fdea9822ed78a3f127a1a26428ae139cfd33068077bd858c96d68752b0aec2626e886d8d73de39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560093, "uuid": "3aa0ed96-b4be-4792-957d-1fd17dc2c68c", "value": "T160C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560093, "uuid": "a0d61edc-654b-4f78-9b89-6e6125521f05", "value": "3072:4jDy/+mh1vtbPIKaibpcUPium7/L7QsvmGfIiNb:mOJ1vxfaibywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779560093, "uuid": "40b4065d-91b7-4b29-86cc-f5b0c629f2ac", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779560093, "uuid": "6be1147b-e2c4-43af-b971-a2349e8aebba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560093, "uuid": "76b05ed8-d09b-49a1-90f2-17d5d88e2c1d", "value": "a58080863e501b1e93337d702fdeb425c91ab23a081b59deb87b03aab784002a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e767de8-56ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779549333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549333, "uuid": "d619dcf2-2c86-4ab1-88de-405ff6dc3282", "comment": "Malware payload (Mirai)", "value": "10ee14482e11041fb972fd56f8fe8282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549333, "uuid": "e6670103-77cf-4b84-912e-89a0d7508855", "comment": "Malware payload (Mirai)", "value": "a5e66eade1377efff6603b4a636a6fd4acca17d6f3ab875b3a7d2695ee3e21ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549333, "uuid": "bd185057-75fb-457c-b1d6-f7270478fce3", "comment": "Malware payload (Mirai)", "value": "b7ec444071a5c8128cf3daece3ec945dbe03b5c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549333, "uuid": "2d3a2a73-0021-4025-8be6-8590f71cc706", "comment": "Malware payload (Mirai)", "value": "0c8f5e0798a6323f066d985511bb581db913f97c48ae327a5a208984d3ce7ecbdc3bc73311b8f5a42551ddfb4f1a10fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549333, "uuid": "969e052c-7135-4005-baa8-1395bbcf7604", "value": "T186C39D97B74B65A1D86203F407CB4F9D6E6321128E5FC9EB2C1E663B583D0CF490A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549333, "uuid": "c21483c1-92f7-4abd-b021-3b96d24d3dd5", "value": "1536:a/2XvHPwYF5pDVRb0y8gtX1egAWh4rkhhxN+wQeVlERA2bmZ/LWO:9fPwwbAgtX1egAg6AxdQeVH2bmZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779549333, "uuid": "d5b6a7d4-3ca9-4957-9ce3-73572187e960", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779549333, "uuid": "534afcc7-af88-43d7-b475-fa9264594f1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549333, "uuid": "14f65502-010e-44ca-a59d-b793b5838c3f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144a94c7-5688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779527788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527788, "uuid": "ca0b75c8-9871-483f-9935-704fb447df13", "comment": "Malware payload", "value": "45c9d25305fbc171a5b1b189ef527467", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527788, "uuid": "2b0bf68e-d723-4294-91f6-e030faabfc1d", "comment": "Malware payload", "value": "a68be64e01f2eb15167e470a5f8e1744b59b0787a3c1744dba0b5bb2716227bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527788, "uuid": "16dab4ab-46b0-4257-a49f-14f82d034dcd", "comment": "Malware payload", "value": "3c25ea9f8a0ff06b1a02b5735d0625e5f0bd65cc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527788, "uuid": "2e39834e-c03f-4a5e-af53-6956f5cd4cf3", "comment": "Malware payload", "value": "7ab288aef4579bbb921c0fa3c64431abcb0ea904563c20970db7d2a599e5de3d0cee8f7820ab9e83d9069ec770d1e02b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527788, "uuid": "e585fecd-a5c8-4778-aba3-f9a9fce4b8b8", "value": "T1E031093042DD49E1C86FE37C7F2E80915082C6118B476E37894EAC56AE862EF5E65860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527788, "uuid": "cac2e0f0-c7ab-4add-a106-95d783c79ed7", "value": "48:9FuOAjF4/KkvGnGF6sIetMKIjL9zrP/p9:XDAzIVF6K+KI/9Tp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779527788, "uuid": "8b3ecd35-cdc2-45a9-9a2e-a1fc1f3f76d3", "value": 1844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779527788, "uuid": "5359f8b8-021e-44cc-9c93-071389f1dbc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527788, "uuid": "2e0f374b-f04d-4672-8a6a-9c5dfab6620f", "value": "photo-933497914.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3ff6e9-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779537708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537708, "uuid": "244eb099-b790-40fb-83b2-6ffcddf6d1eb", "comment": "Malware payload (Vidar)", "value": "5fdb63871ccd592ff0d798e81d5e5507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537708, "uuid": "4d935fac-3ecc-4469-b9f1-c742fc586d76", "comment": "Malware payload (Vidar)", "value": "a6befbbc50604a9aa0064ce384c9ad8d2c9c5b30868371a81e2a77a0ac9174e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537708, "uuid": "cb32c0fc-c3ad-4517-b9a6-4afe91191950", "comment": "Malware payload (Vidar)", "value": "6e495b89390ad91a823f8c89288256b0c9a92982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537708, "uuid": "2816a1a6-f5a2-45af-8623-fec525c7e8b7", "comment": "Malware payload (Vidar)", "value": "9909d130f5005bc49b22011c1e22c5131f06ba2fb4f90e3adb51c50a7eb2ba7535c3db8be066e406750beedc984656b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537708, "uuid": "c1a9d55a-b9cd-402a-bc27-1b438574df05", "value": "T1EDF47C9B5B6353D8FC3BC036D169AB57F830FD668128CE7B09900D569AA1A31923F317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537708, "uuid": "d90c95c3-d8ca-4b68-b691-3451674aa58f", "value": "83c7b20f16615fee0572b5c3cd3984c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537708, "uuid": "ed5ba56a-071e-4612-9537-d686b80d6994", "value": "12288:Pg+NB8t7sAw3xoIDh6u89Nw5X6om0AFh9dx49LGwGRxYyX2kSCMfK4kXL6bavAX0:PT27sAw3xoIDh6u87w5X6/0AFh9dcLG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537708, "uuid": "5d9c5a81-f2db-41aa-9a37-8e9642015e55", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537708, "uuid": "78f44810-5ed9-4f00-970a-9cd0ff9b614d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537708, "uuid": "67f2e404-b4f2-4955-80fa-8548f351e224", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5846f0-56b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779548501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548501, "uuid": "d3e6fdc7-b895-4c15-8e65-5d8210a6adef", "comment": "Malware payload", "value": "8235bd843dbcfd21f1e92c9252471186", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548501, "uuid": "3888fd25-426e-4aa8-a43b-63974c6ec097", "comment": "Malware payload", "value": "a71ddfdde4d404531e6d9ae2e90657021f4a41e52e2fdecd95cd5c0a61ed1a53", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548501, "uuid": "f4481ab0-c496-485b-b639-1ff7e980d297", "comment": "Malware payload", "value": "dbefec49ce9c0d3e176c52cc66e5679e1ceff5f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548501, "uuid": "748e334a-dd56-4737-9782-c362185a6923", "comment": "Malware payload", "value": "32013b82f9bb3648daac7772e1f956c70e6004222c227e3d1b3c1968e706dd88ebdd7e08feb5eb32dec60538231afbfb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548501, "uuid": "49aa4042-5b75-474d-bb0d-e6de4b26b5a8", "value": "T1C1137D6956857C24AE9988371C7E2F0CB9A983E1310451EDBFCB3CF58C19B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548501, "uuid": "ddad3073-9952-4604-916c-83ba8cb8a6f5", "value": "768:1+79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:1+Mco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548501, "uuid": "cd9ea28d-bd79-42d9-914c-24f4a9cbf032", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548501, "uuid": "05b43cac-d28f-492b-bd0d-d614a5d3fabf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548501, "uuid": "4e2731af-2dde-460e-968c-88364ff68f97", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3801b2-564b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779501949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779501949, "uuid": "76ee370b-04df-4a5c-bba3-961965fbe68b", "comment": "Malware payload (Mirai)", "value": "c0aca767c21287e057c0745f8a17b62d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779501949, "uuid": "42369d52-89ab-4991-9c9c-bb6e405af1c9", "comment": "Malware payload (Mirai)", "value": "a7d2465bd9f87988a23979b0adc7d4e660eea1ec1fdad21792e1500b33b6a4da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779501949, "uuid": "31d7b9e4-cccd-41a1-9b5e-048745d9d763", "comment": "Malware payload (Mirai)", "value": "d87d40d1b8ee86e0af1d27d0a991ddc5fe967d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779501949, "uuid": "1b104365-c540-4e6c-be0b-09e52e5e1ef9", "comment": "Malware payload (Mirai)", "value": "11f20e55222c3bc276c7e0eeccd673df3ef71291f461d61e831aa8cb25218e0f76202a10076e07f39c557d71f671de67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779501949, "uuid": "b11f7317-415e-4f97-8810-7170e8be5461", "value": "T1C6445C45EB404F13C4D62779BAFF8245333397B493E7B2069924AFB0378776A4E62A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779501949, "uuid": "1f6631c0-bcf4-4bc5-b378-020ef3ffdb26", "value": "6144:W4rC/HrCRK8unxe9JzsvEMWzaQorL4Atjq5+zX6h1V/GvK:WuC/LS9JYEMUaQorL4APq/AK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779501949, "uuid": "d1872964-f834-4254-bf22-a83d73a3dd85", "value": 273937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779501949, "uuid": "fccc1451-6526-48d3-884a-2b33ac37e13e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779501949, "uuid": "158e48c2-c5a9-413a-b64e-f8e5b51fe805", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f3461a-56c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779555807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555807, "uuid": "4a009b50-7388-43b2-9710-7d89569fa3eb", "comment": "Malware payload", "value": "514e3882310d248bcfc228e035cc6380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555807, "uuid": "01e7ab3b-cdc5-4ab2-ad53-d34582618e38", "comment": "Malware payload", "value": "a938540cfa39fdab381935985d751aef864f70c0f380df3b70f6b351eb202801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555807, "uuid": "ef8a330d-d6b9-43ac-b50d-a4c41e731d39", "comment": "Malware payload", "value": "97132ab05b2aba6436c00786aa35171ed31d18cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555807, "uuid": "f3891bf2-010d-44a2-b2a0-fa8441fbd168", "comment": "Malware payload", "value": "8636e437cd7f28ee958b6742c8e9ac7b9b0e71016bd2602dafc11c0fd2c1887975d6feb9c12cdba57c42118e6092abe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555807, "uuid": "74f80427-d452-4307-80cd-b91381b2a705", "value": "T12BC7CF23F4424079D6D302F19ABEBA2A96FC9A25033959E757CC5C489BB05E3733A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555807, "uuid": "68428e94-d8c1-41d1-80c0-633ad6483595", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555807, "uuid": "6723115e-4bcd-4dbb-b37c-99d3ed12a6bc", "value": "1572864:u54iBYeujdTMWh+5QjyTezIQH+i1N9qdADiU9T:BDjdTMWhaQjyl6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779555807, "uuid": "a922ab07-2059-43f6-bc93-1d73e8f47ed7", "value": 54243000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779555807, "uuid": "bef69145-8cc5-47d7-ade2-f550d0b03110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555807, "uuid": "a5deb10f-876a-4d38-89c1-159dd50f0554", "value": "BaiduNetdisk_8.4.0.103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f0d948-56b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779545613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545613, "uuid": "2467bacc-928d-4a50-a480-c896d968276b", "comment": "Malware payload (Mirai)", "value": "f26004fe5853633bf67cce2f351d209f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545613, "uuid": "307ecab0-e462-4fd3-9c50-9ef2d8980732", "comment": "Malware payload (Mirai)", "value": "a9dfb2492c0e7c7f335370e6ea58767824d79c6c0065bac310d93f898825fe3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545613, "uuid": "d5b91eea-e3f1-41f4-9798-628bfd434e1c", "comment": "Malware payload (Mirai)", "value": "9a3a0de38c7f5812a4b2650e2515c9aed3b5c1c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545613, "uuid": "c910100a-391e-4e8a-8a0e-224f86faa3f2", "comment": "Malware payload (Mirai)", "value": "da7f9c174f61ddb40353d26c1ca4104d964b4122ec690708eca4ca591ead05c826b6b8e97ffa9e731f15c02981f9f185", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545613, "uuid": "f262d6df-e421-478a-9f4d-60a2caf252c9", "value": "T154B339C1BA43D4F5DC1641306177F73B9A32F0791239DA87E7A49E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545613, "uuid": "1d4413db-197f-4186-a642-8be2f3ed02ae", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wrzSr9bMFfli:Pbj4doYGFB0/45gdj9uli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779545613, "uuid": "80f285ef-4607-4a4c-bd08-16a0a95d15fe", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779545613, "uuid": "dbb94a6c-ac9a-4452-85c6-585d9923f8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545613, "uuid": "6e59700a-d9da-48f3-9ab1-5f66c274e442", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b341cea4-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579594, "uuid": "2a15e85d-fd36-4328-9e7c-7afa2f9011b6", "comment": "Malware payload (Mirai)", "value": "e1ac0e9a692fbcedbf2bb85b63a919f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579594, "uuid": "73ec8d71-4e11-46bc-b9f4-918488960884", "comment": "Malware payload (Mirai)", "value": "aa195ee158d977c751cdebc33e6c84a085997800ebedb52306fb9a2be93cac31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579594, "uuid": "af113367-5f08-407f-bea4-bfc4859159d6", "comment": "Malware payload (Mirai)", "value": "a41587852e95c83e6ed2595a37509c27a8d592fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579594, "uuid": "1d6034e0-d410-4413-9224-e5d3d3b8ace7", "comment": "Malware payload (Mirai)", "value": "2eeeff781fd47d7e236db2d84a89a0c869ced3f09385aa5b8c24e021447511d50ec4a3b5066ff8ad768e3cb564e9c1b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579594, "uuid": "d75f3f0d-50eb-41c5-a551-94355efad658", "value": "T199B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579594, "uuid": "204cdb52-125a-498c-9363-18f5bf45745a", "value": "3072:pC/4rdZHsXsZwwR9sNk5mm/QcuLmHniPNb:pCwrvHwsZwY9sOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579594, "uuid": "80d16643-e54d-4c99-92e3-b8941a2a5f3b", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579594, "uuid": "734ae3e4-8278-4e30-b720-1d3cba5b9617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579594, "uuid": "2b9889c5-5b8a-4f8d-91f6-6adeae297138", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b33655-56b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779547015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547015, "uuid": "5ee362d8-ec82-44e8-93dc-4eba672e5c45", "comment": "Malware payload", "value": "a34430927c095365194cc68c9e34e5d0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547015, "uuid": "8ed564a0-f8f5-40f6-9581-bb8d6d95b674", "comment": "Malware payload", "value": "abc703dd071381640dd661eeea884f42e1359b1a3409b8ab1163e03e2b845e45", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547015, "uuid": "de718966-901f-45ae-b559-846b44b01b70", "comment": "Malware payload", "value": "298b4ead7d436acbb22bc62a7c901793c94c4973", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779547015, "uuid": "4a068abe-90ba-4db8-b110-c9d747650ce0", "comment": "Malware payload", "value": "fa1df2af2cca2c86f4d2a5e9d7df2aef35826df1e9384bd09041d9a3fb1c522a4846f1f1e88e1367b86968cb0a898b2b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547015, "uuid": "3b443aac-0fe4-4a5b-86d5-cd843c9601eb", "value": "T159F095B5D35BF354054746B19419DA0A841DA1648381A84072F4D554F0413DCC7F8DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547015, "uuid": "35a3aeca-b0f6-4cae-a044-75898179c7ee", "value": "12:/PZYVJcnGHp8Y09t2imXK7H4oAGw2LgyaISB655SksCRLBz:gSP/xYdGrLww5wkDLBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779547015, "uuid": "2c2ce466-aa37-4e0d-bb0c-f14d5fced4a8", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779547015, "uuid": "51a43f8e-9d7e-40ff-97a4-931cf0213411", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779547015, "uuid": "9b83d238-aa56-41fa-a453-5166c3e0a105", "value": "a34430927c095365194cc68c9e34e5d0.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61335f1-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544487, "uuid": "6dd9bf93-25ce-4125-8cfc-54477110fbdf", "comment": "Malware payload (Mirai)", "value": "b1ee2b88602833f1ca2863d4ab52eb07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544487, "uuid": "89c4b08a-00d6-4f67-b932-03d39a37f201", "comment": "Malware payload (Mirai)", "value": "b310361e8628ca51fc78b1682d8dbef11229d3f996ff76921653363bd9047e86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544487, "uuid": "b0554824-b680-4471-be89-669566738a30", "comment": "Malware payload (Mirai)", "value": "efbfd3c8e8a0f1d405a081193dc00086f568aef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544487, "uuid": "cfa0321b-0e25-4015-bb29-febd6a03e995", "comment": "Malware payload (Mirai)", "value": "2373863c758e4c698a5ba415d70dbe0c1fe1f800d7dff6ba62fb1bbfdcad2de431d1add8485599724c760d6b1c9f8baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544487, "uuid": "4fd9008a-7745-4e4a-89f7-02c7913879aa", "value": "T1DBB3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544487, "uuid": "b3e5cdb2-e9a5-4abc-9349-763356eccbf5", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4uPrs9j4ZWn+E7+TeVedVPneQBZN01s6n:gni50poFLP49j4+7+Te0dVPZ01s6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544487, "uuid": "8c6ef989-02e9-456d-854e-b8b775ef7255", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544487, "uuid": "dcbbd227-428a-4793-9372-a3342977e8df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544487, "uuid": "2226fac3-79d5-4b00-9bf8-870bce180d93", "value": "luxzz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca600b54-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544414, "uuid": "dbf3ab4f-70bd-4da6-b372-07735e81225e", "comment": "Malware payload (Mirai)", "value": "010f3612120c96827a91310bb04e63f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544414, "uuid": "aa37c9ad-eb4c-49dd-86b3-11dd779779e5", "comment": "Malware payload (Mirai)", "value": "b3551a25bd8dda176ce69119b6512959f7210634f6ffa3e029604b09811c9bb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544414, "uuid": "1e606f43-36dd-4f97-86cf-e95071d491b9", "comment": "Malware payload (Mirai)", "value": "f037f5fcbb999e983b2b311b98f0b39b997d2e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544414, "uuid": "09593f60-74ea-4b01-95c1-e266c40f54a0", "comment": "Malware payload (Mirai)", "value": "ac62c3a17b4ccf97700a89deaecfe218f390e83055aa66a92b08f3d96f51742f5894fe7312a06f668154aae8cd604e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544414, "uuid": "9d6e5cd9-185e-4c15-bb6d-02e5ad29c2ae", "value": "T176739E23C87658ACD25842B8B170FE3A53B3E51056572FFB069ACA7A9047EDCF5493B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544414, "uuid": "be4748b1-4c38-4a6c-83bf-829bc6814d43", "value": "1536:0/Zd1XEc589P/9E++KrpgE7YgJMiCYKkN3skA:0hd10L9aIrbhJMiS68kA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544414, "uuid": "71022567-1788-4d09-b174-66ab34a63ad5", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544414, "uuid": "2328a7e6-ef7b-460b-9149-a76820861a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544414, "uuid": "a7f2b8d1-d7f9-4e67-b631-2e401ae95070", "value": "luxzz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bfb46f-569f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779537674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537674, "uuid": "44143264-4181-449a-bd8e-cd212d9f8254", "comment": "Malware payload", "value": "037efb106ebe67836da5e2b792e17074", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537674, "uuid": "e948746d-b2ad-4968-838f-79debeaf38a5", "comment": "Malware payload", "value": "b81e84454bf9503edf094aa264c16ebc2a9c22cd1c2b867a9d5d56f768a5dd6a", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537674, "uuid": "3e56e317-4dba-478e-9fa8-79c73bb8846f", "comment": "Malware payload", "value": "9430b66931bee13a1bd72d89bc691e3d7fa9f81b", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537674, "uuid": "074fcfb6-8565-40fa-bae2-16a11cd036d1", "comment": "Malware payload", "value": "812abb9127916f5ad29e6034c0e0c69b300cf8101fe735a421ad87c4d56d41a722e989f26aeaaa3a01b05707220b9016", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537674, "uuid": "7c3aabb5-08a3-4907-ba85-78a814c6c180", "value": "T1A1B523E019CB1677E92DD23D8889A08CB51FBF4CDDD65602A7BD5A943C8361204ADF8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537674, "uuid": "34b76bf4-ef75-4abd-a5d0-ea207d04f5c0", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537674, "uuid": "19ec29d4-8df9-487a-93af-951f0e5bee3b", "value": "49152:JuzSZnhdhwX80omlSNAhCESL6ibDQeelPze9meL2XMT98cs9WHEgd6F0X:JimnhdmXQ4SVESb3cigJXMu8Egdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537674, "uuid": "70f95f4a-5bfd-4dbe-9779-6b259f29fdb9", "value": 2384896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537674, "uuid": "6977dcff-91d6-4906-8dbc-a50ebed6e86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537674, "uuid": "ec392a28-b91e-49ea-83e2-df422b1d5e14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1bc8fc-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544419, "uuid": "c39e7bb0-41df-4225-93c9-ff9ce4702342", "comment": "Malware payload (Mirai)", "value": "5bcc9fa755ebee870e8bc75f2e903264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544419, "uuid": "71ce65ec-e770-434f-8681-a9e68b91546e", "comment": "Malware payload (Mirai)", "value": "b849d71d6ea3348cfb905a2c1212e44ad2aaae4694c106e1e1f1da188992c66a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544419, "uuid": "5f827a52-3284-4021-b381-6473473cdcae", "comment": "Malware payload (Mirai)", "value": "6c4c60e32541d83f359c8a7ffbc580fc6c7f54c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544419, "uuid": "138748af-8f4e-4886-b113-36d509269b6b", "comment": "Malware payload (Mirai)", "value": "907c3f6406589fd0077563faf7e0b14d2a7b150dcdd0e307b6688831544374cedeea0032070c9003c99875184c8f90bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544419, "uuid": "06d76dce-c8dd-4c48-a21f-6936b5a127db", "value": "T1D5935A22B539193BC4E4953722F35326F2F6438A14AC8A2E7E710E8EBF156D026477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544419, "uuid": "8077e458-25d4-48fa-80a0-e3bad711d2d5", "value": "1536:zCTLJ0Jld13m/EqBtgagvStPhYm5roASoAte85:GiLuWha5hYOc485", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544419, "uuid": "b55c2db9-6f73-486f-8b3c-f08ac359b298", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544419, "uuid": "5f3cbf5c-e312-4865-b305-3a6868a4e1c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544419, "uuid": "38105594-775a-456d-b19f-cc8f878326a5", "value": "luxzz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52d7a1f-56d7-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779561961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561961, "uuid": "61474f13-07c8-4b61-9d8e-a415f0e864ab", "comment": "Malware payload (NetSupport)", "value": "f07b78d74c2929987bcdd0a20532c8f9", "object_relation": "md5", "Tag": [ { "name": "151-240-151-46", "colour": "#24C9F6", "exportable": true, "hide_tag": false }, { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561961, "uuid": "22efb668-a6af-457e-b377-463423595847", "comment": "Malware payload (NetSupport)", "value": "b8ecb1b1fe55098c8ca8a50118771d450fed775066bd81bd7827060cc0ae5ceb", "object_relation": "sha256", "Tag": [ { "name": "151-240-151-46", "colour": "#24C9F6", "exportable": true, "hide_tag": false }, { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561961, "uuid": "6cb722e2-869e-4303-9b56-3028d2f74584", "comment": "Malware payload (NetSupport)", "value": "26f213aebdf540c5ef1e4b36d7e87516760dfdcd", "object_relation": "sha1", "Tag": [ { "name": "151-240-151-46", "colour": "#24C9F6", "exportable": true, "hide_tag": false }, { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779561961, "uuid": "38657f9c-fc97-4c8b-b9c5-1db722978c00", "comment": "Malware payload (NetSupport)", "value": "50ed7709d51120a27f6566aec253da5f9b4cd5156226d28534d71fb7dbf0b3874c798ffd5163f3962f7ba4fd46ed940e", "object_relation": "sha3-384", "Tag": [ { "name": "151-240-151-46", "colour": "#24C9F6", "exportable": true, "hide_tag": false }, { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561961, "uuid": "098a9321-8a44-49af-97f9-033e33935621", "value": "T16516E021B6CBC626D25D05B2E92DEE0E543DBE77473040D7B3E8399A68718C26336B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561961, "uuid": "a2cd7494-7124-4c58-9761-4c2ecd8e6d4f", "value": "98304:73ESkLB0rul7a3oUOpr1nmt+mpMxALQ+8EF:bESQ2ul7woUurtmfMxAPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779561961, "uuid": "e3c2db77-63b0-420a-9ca9-b2c7fd45b397", "value": 4033536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779561961, "uuid": "863ac2fa-b3b8-464f-bd3f-2e9b835d0608", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779561961, "uuid": "73eea63b-8a8c-44c8-9684-53f6abef338d", "value": "Invintrum_first.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2324ea-5694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533119, "uuid": "2fac340b-bf4a-495f-a631-215b2de9716b", "comment": "Malware payload", "value": "2d1cb8f0476871f2062ee81a1d2ed35c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533119, "uuid": "149260f2-ca4b-4e91-a71a-84a41f21e433", "comment": "Malware payload", "value": "b91ef750004082c1b891479525592d894d55028402cef655e87a29cba032574c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533119, "uuid": "b80db254-5922-4f1d-8b6a-9f487bc95226", "comment": "Malware payload", "value": "1fc85092950a9e07ffda8f8d9361ae4f80ed6ddc", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533119, "uuid": "b23a57d6-ae56-4213-bd8f-24d3970961ce", "comment": "Malware payload", "value": "2a73c419ea8b1a18ed140ee445aec03534e99309653469da5b9a36507e88269486fdb999f903d52cbaf1d3603d56f12c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533119, "uuid": "35cd3883-dc64-4a31-9b4a-7a34172e29c8", "value": "T19E9423013FE545F9C64D415AB8A3761F20646ED80CDFAE5E71ECC2C92B2F1A24926D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533119, "uuid": "9d43d7c0-922c-4140-b48c-445f5154c967", "value": "12288:jNojOP8VW+iMdW/UJV/lZeriruRLak0Q3z2qshf+i:jNojk89dkUJ9u+ruRLarIz2JWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533119, "uuid": "25060b22-579a-4217-ba0c-b580b4303b62", "value": 429271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533119, "uuid": "ce3f477b-f62a-44ec-8c59-76c06de7fbad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533119, "uuid": "994e98a6-eb92-403c-aeb2-69511191c57c", "value": "photobookadm-pro.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65063fb1-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779520192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520192, "uuid": "cd9d5a88-b5b5-443c-90a6-b97e916a51d5", "comment": "Malware payload (Mirai)", "value": "3710d750c0795890374e8e8f147c3642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520192, "uuid": "299abc6a-91d0-4c5d-9830-68aeb0243842", "comment": "Malware payload (Mirai)", "value": "b986faacb2a5310721800ec5d2c6221bf70bb4f92f72910e4fa67afc2d45cc68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520192, "uuid": "0f95d56e-5119-4a6d-8764-98903a99657e", "comment": "Malware payload (Mirai)", "value": "54fbec6e56c8413f074ebc4d7ae89906de22cf08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520192, "uuid": "e68b41d6-3dc1-46d1-b7d9-70cd45a141c6", "comment": "Malware payload (Mirai)", "value": "b5282f71bad4916419594adf216a19d1a71927f0a6017184d708a6615f119ad67bfb1f300e3d1e1a61bcb2700dfea84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520192, "uuid": "72accd63-f29b-4bdf-9abb-fa210dd8d32c", "value": "T14DD35C0673180E17D5A349B02A3F1BE083FED5D021F4BA89691F9B6A8676D3B1485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520192, "uuid": "702c3ed9-67c3-4522-a772-6fe2fb1c66bb", "value": "3072:CV0zui1ZhMHJ6A+qrxfbOUm3+Q2Mc9Fkhn:LP1YO8dbOUmuQ2Mc3khn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520192, "uuid": "1416d132-a6e4-4f1a-a8b3-902a61506c8f", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520192, "uuid": "d9d0833a-d146-44a0-86cd-2b617b837bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520192, "uuid": "ceccbf80-31a9-49e2-bdd5-1cb742381315", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd49995-5645-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779499192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499192, "uuid": "2b697c34-38c9-4001-9df1-09e56ed19adb", "comment": "Malware payload", "value": "2cccd61e533469a19f2a89b89eb0a56a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499192, "uuid": "f5963fa5-47c3-4412-9516-9110af84320f", "comment": "Malware payload", "value": "bb1d83bf2f3b09d9cd630ab0158b11c0dbced6df36d21a99e0ea723eda3bfd8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499192, "uuid": "35e268d7-0078-42c7-a954-4800f287dca9", "comment": "Malware payload", "value": "a881f16578b30e668fc21409de37fe87d81b72b5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499192, "uuid": "ee1d2b48-20d8-4653-b2ad-d55acf456b94", "comment": "Malware payload", "value": "4e4c3b1cddfed63be9e0d85f104b26cf1737e901a13595cf40b46d5cdd6aa4bac4f06d0f566019374071ef549c7fd331", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779499192, "uuid": "46d564cc-82d3-4f08-b67d-34c2b24a02de", "value": "T1C0E0CD9645B3C5F74C594C60E0B33D14E31F647AEF3080606A0395737A8F106B8694B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779499192, "uuid": "82b0b1df-30a4-456e-97d7-c276227a203d", "value": "6:h2K6PqhwQLy4IHphUOzNXsmIqwXw81CXD7m+bg6KNXYaF:4Psy4sphD1wXwrXDqiKiaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779499192, "uuid": "a61554af-63f7-4eb6-96bc-0344dfb0a9c5", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779499192, "uuid": "d4df618c-7f31-4428-bd8d-14be1aca9e35", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779499192, "uuid": "84d513c3-a1dd-4324-b6bb-80796b301ec3", "value": "bbcl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af10cd61-5693-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779532772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532772, "uuid": "ce4c9e4f-09a1-47ce-bd9e-ab392a0f4651", "comment": "Malware payload", "value": "09029b2d9d4e3954d75dc8a41bfaede1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532772, "uuid": "f7269e08-d887-464b-a090-022b0caf38e9", "comment": "Malware payload", "value": "bc689629d4dcde10898875d6fc21c832ddcdc940072ca7735a3be35e5f19e89b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532772, "uuid": "038f1ea1-7510-4826-a8e6-e008ae0d8349", "comment": "Malware payload", "value": "c6d60bb0f109a3a881eefaa685b2c5c59a2a94f7", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532772, "uuid": "3f2dfdea-11c9-4579-97e0-591b6b04cd66", "comment": "Malware payload", "value": "3b57d57f3a2d69c547ed207602bc9c20cd5df8ab6388ff7c9e32bfae49154706878f69c50ee4970be59adfc0da52e62a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532772, "uuid": "19d3f565-fb8e-4d72-a8bb-75fdbf21e493", "value": "T1B272D14EFEA65020C5FFC276B2F8E83D99F520CB299E316BD07764DAACE25520510DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532772, "uuid": "20e13a25-4981-475d-99b5-6101ea8bb9aa", "value": "384:hg++tYUxFXsIdF/t5P6uJBqn+7gL21PvCHNa0cEQk5dN4fp:sqUxZsIX1t5D7gS5CthczkjqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779532772, "uuid": "20f28805-2c8a-45d2-ab4f-16a7fd81d040", "value": 17351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779532772, "uuid": "6bd364f4-a256-4525-a8f6-a035fe7672f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532772, "uuid": "d0f2a554-0d38-4e70-9c2a-7b7170a6f973", "value": "photo-469710932.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8660e954-56ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779549454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549454, "uuid": "f5640aef-6148-4304-9ebc-2730dcd98817", "comment": "Malware payload (Mirai)", "value": "d07a6dc160c725353dcef3d897431150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549454, "uuid": "0cfc3114-8364-49da-80e3-b76a7948d9ba", "comment": "Malware payload (Mirai)", "value": "bce288d3b9c55fe643e3599eedb8f72f2a97f5cb4b19f337db88abd9ea8433ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549454, "uuid": "fd447e3f-3da2-4ed6-b21e-50d026ec26a7", "comment": "Malware payload (Mirai)", "value": "1f99e63834c426cc6d6f3223693c917d74952011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779549454, "uuid": "c951632d-a27f-419b-a5fa-6a146b3cd4f8", "comment": "Malware payload (Mirai)", "value": "67fa087881d08a7429a7abf863da8407a6ece9667e496703b97e761777708d44ade45f24aad6ff301244e3b31ab28630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549454, "uuid": "b6b088c2-bf06-47b9-be23-0b053facf99d", "value": "T1BD933A96BC815613CAC513B7FB1E028D372663B8D2EE32079E115F6173CA92B0E67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549454, "uuid": "b4105704-9257-4f4f-95f4-875af6968705", "value": "1536:/iQC8+M5ZFCf38eYO5HuzpYnvAK6PPYPIvYfD4dGGfSaIuCZs6LubeVYu/:aQC9MEf38oGiCY0tSadCZ9B//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779549454, "uuid": "bce07a0a-3d15-459f-82c3-84f3e0b9cb54", "value": 92404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779549454, "uuid": "788ff5c5-7fa7-4d3d-abce-2b4fd28b6882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779549454, "uuid": "a49f6962-f7da-4bef-8ea8-3678ead6706a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7816dda5-5679-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779521513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521513, "uuid": "0e0c5870-0b28-41ad-b24c-2df97e313e71", "comment": "Malware payload (Mirai)", "value": "5c6ce1ecb3c949d0b8ae3ca02e5b1d3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521513, "uuid": "b59b0743-9040-46b1-9c7e-318bde9dbe84", "comment": "Malware payload (Mirai)", "value": "bf91ce41d1be03c78418d9e719237baf68c387b83612091f915f5b09f93bbad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521513, "uuid": "c6202ce0-8f3a-4ba8-9ef0-675ef75f58d5", "comment": "Malware payload (Mirai)", "value": "167f23ce447328c827a55d0d058466c42b793a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779521513, "uuid": "f6673444-3319-4ce8-a0eb-083a025048b4", "comment": "Malware payload (Mirai)", "value": "a7ecd88815bb4785bdc913bb944439ab615b8a035d6e02aa9115ebfbc860789e8ceab3d3ae6ddbb035c51146eb05024a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779521513, "uuid": "5db6ae3e-f0e1-4c96-b337-98eca286230e", "value": "T147E34A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779521513, "uuid": "f98671a9-b45c-46d1-9a50-7f18f595fedc", "value": "3072:ENUkePbhroLLyLbPDADuOu1sya89LjPEKe2+IOkH:weRoLLynPD2u6yawpe2AkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779521513, "uuid": "6c888e80-a3dd-4e3f-b8be-c1b1fa86bf45", "value": 145544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779521513, "uuid": "fd2a1424-529a-4c64-975d-888372b17c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779521513, "uuid": "afd86ec6-4ea0-4375-b3e7-f5cd3390425e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2394d152-5698-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779534685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534685, "uuid": "a50b18a1-c8da-47f9-af3c-679de2381d3b", "comment": "Malware payload (SilentNet)", "value": "09700ccce7af73d0b3faa885d22960bd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534685, "uuid": "430d21f3-babb-4546-8958-3d3980eac1a9", "comment": "Malware payload (SilentNet)", "value": "c042ee032dd3106edee7417d8c001dfc2bbcc01ae80b82eff501f30896c8a49e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534685, "uuid": "2ebdb731-4092-476b-b05f-a6539a6692b6", "comment": "Malware payload (SilentNet)", "value": "45a550a7c09e6d4f283d4eb69a091b6050235ba6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534685, "uuid": "1f277aea-1780-4b42-aef8-b9c7595cca61", "comment": "Malware payload (SilentNet)", "value": "5de4cc7ae726f42d3e9a724648af371c4a2dbebea6b0244cba2662971ab772ae02b68c18cbfb37318b091380ec048d00", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534685, "uuid": "f703af07-80b0-4655-80ce-6de1cd213949", "value": "T13C7633BAC97D1188D5DF733090D387886062B7EE4811B49E9235CB47940FB9BEE8716B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534685, "uuid": "2f393232-160c-40ea-b126-a6a096689cbb", "value": "196608:rEmXwNEmcn86SSYvbgf0pbbhdgPSzrrcW8kjHa0/zHoft:NOEbyq0LSPSvw0jLH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779534685, "uuid": "cc38a95a-686f-43c4-88cf-41635c55e0f8", "value": 7444292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779534685, "uuid": "0ae037fb-a33c-4578-91da-a0992633adbb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534685, "uuid": "7a360bd0-01ee-458a-869c-d8d0cea165ce", "value": "dupemenu-17.0.0-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd047b65-56d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779562538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562538, "uuid": "1df94a6a-1f6e-4a79-a7e6-8feed6d31326", "comment": "Malware payload (Mirai)", "value": "b8aca7b2e26cdfaead405ff87fa56331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562538, "uuid": "fb55ac65-9dfa-42e2-8c31-4692253d9694", "comment": "Malware payload (Mirai)", "value": "c0c956428141632faa9d55d7a648fd58a0f2e2aeb774c7986a0bd2fb46be21dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562538, "uuid": "e65334a0-f463-4172-bf39-cd12e6cfcfda", "comment": "Malware payload (Mirai)", "value": "14a31aa92c583a7bf0cba09d4675c8224785a3fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562538, "uuid": "b16f3285-a78d-40bd-a3e2-dc813db5af9f", "comment": "Malware payload (Mirai)", "value": "3fa762dd62ba47f2713790391e9c4ca2f0786c25200845c5f030141988799b8bb58c473bdc2e92b9911f50107a616e6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562538, "uuid": "77e8e0cc-5c41-4b5c-a9f2-9a727cc0b115", "value": "T184C3AEDBF74B6490C86243F107D75F9D6E2321118F5B88EB2C1E663B197E0DB491A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562538, "uuid": "2ca033b9-05db-4404-a826-6ce8b533ccb9", "value": "1536:e43dNNqx8Q1qm2E8gtXqkwsWdMB0RUi+KgvlIVUkrh9/LWUA:e4tNNyp1qXgtXqkwsEkc+Kgvzkrh9qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779562538, "uuid": "e369dc3a-5cbf-4535-a192-73bbea674ada", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779562538, "uuid": "ec90176e-57e5-43a2-94a4-a6b9fd36516a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562538, "uuid": "36281ac7-4eb9-4d25-a7c6-39f67a88e259", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292ee607-56aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779542426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542426, "uuid": "d8646357-3958-4360-b5a1-c2e7d8f35d78", "comment": "Malware payload (Mirai)", "value": "c350563a959a928a8a328d802ae02356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542426, "uuid": "82e6f537-f5c3-4127-8001-7621d11ebed2", "comment": "Malware payload (Mirai)", "value": "c0efb936f70376ba129d0e807d644acfbb7cfa842348c10c4e1bd2c645dfa69f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542426, "uuid": "5dc0c419-31f3-448a-80ab-2485bc64c7aa", "comment": "Malware payload (Mirai)", "value": "13c4199e9be4a50e95470a3949f9853c3c39efc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779542426, "uuid": "c2924f18-83b7-4588-a807-600ae98e1996", "comment": "Malware payload (Mirai)", "value": "9ac1a1016508cd57b1e71add3efcf3ef65d4e9912e05674cc1a25521e9e7eb527d7cea496401dfcb5144634b88578744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542426, "uuid": "2f6b5ae8-c2aa-45ea-a8d1-fcf4f524860f", "value": "T1B9143A46EB808A13C4C61775B6AF02453323EB64D3EB73069928BFB43F8779E4E62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542426, "uuid": "ed17d8a7-94ff-437d-86a1-01899fcc9f8c", "value": "6144:61eulRtQAloF1a2YESokE9phptHqoL/Kh2Xmk3/0t3:61FtNo3a2YESokE9pDf/xmkv0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779542426, "uuid": "ead7fc0a-d077-40fa-9fe5-05a2dd31b020", "value": 196817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779542426, "uuid": "7f617755-94aa-4cc0-a9ce-eb373b58fda2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779542426, "uuid": "cef0142c-6484-4e68-90e6-ce28e17c6e16", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9cd350-5642-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779498056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498056, "uuid": "737f75ff-1840-4de1-ad5c-fb3ccff00b88", "comment": "Malware payload (Vidar)", "value": "f523d43a1c60d1c4933b3970c66dee2a", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498056, "uuid": "72cbb9e6-5b67-4154-864f-10d7b7b4b3f2", "comment": "Malware payload (Vidar)", "value": "c19dffe186ef7aba7332c45dcbb0b7b225c9c9d1894f1c782784088ce8fac7e8", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498056, "uuid": "84b51d80-4d2b-4850-a934-fa9fa1771ba5", "comment": "Malware payload (Vidar)", "value": "83b613ff9afa7e58e44ddbafc9d6dac006e2105a", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779498056, "uuid": "faafbeba-980a-4577-934e-73c9a36799bd", "comment": "Malware payload (Vidar)", "value": "e7d067942d3fc00afa412f8354dc0bcc7992b3b166a1f3d5bf7a70b35503410ef54f1e12ef96e249fecb285c47226535", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498056, "uuid": "2ae4134c-8e6f-4d04-a850-8858a1cdf860", "value": "T14A94238EBBD7DC1EE9E0863DBEB21AAD70014014F7A475A5EC075E341B732DA8769603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498056, "uuid": "46e6ce96-ba4c-4e9e-ba1e-7b714a3fd968", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498056, "uuid": "bf85b1f7-6534-4a76-9372-e1040c9c542a", "value": "6144:WJf3I5HrygJGDQEaluSrieRY0s4ou/S6nDO5jbjojnwzVxbETj2v68:yw5uUEUuSrfm4otoO5jbjojeV1Ee68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779498056, "uuid": "f5cb3eb1-8828-45c2-9d0e-e3d1366a9fd4", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779498056, "uuid": "3b7a9579-1d41-443a-8a69-4e89cc9a4646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779498056, "uuid": "098030e1-84a4-487d-85cc-4f56a902586e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41af123-56d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779562067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562067, "uuid": "64f1ead0-d28d-4f20-b82d-1cf75c029bb9", "comment": "Malware payload (Mirai)", "value": "0d206b6dee5ece29ae331ebaee362dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562067, "uuid": "af68b58b-32f6-4e5d-a771-7c3b67d43add", "comment": "Malware payload (Mirai)", "value": "c316ce84dcb87d0eb3473b771875d618cb2bdaac9ac41841681992e2247d8b8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562067, "uuid": "b5d0d2ae-91cc-404d-819b-8566beb09eb3", "comment": "Malware payload (Mirai)", "value": "5e749a0a6267c907581e241b13640f826b994f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779562067, "uuid": "476bcc90-805e-4150-bdca-cb28821d3cf5", "comment": "Malware payload (Mirai)", "value": "2f2f21c0961c11fa1b6fe4afe0860b40db4268c06f21f46f97368e0f6d138fc5570347f25818432a8efd38aa0e9a59c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562067, "uuid": "7843103d-017c-47a1-810c-f84647d6c550", "value": "T147143A46EB818A13C0D61775B6AF42453323EB64D3EB73069928BFB43F8379E0E62515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562067, "uuid": "e0d69a49-f51c-4ed5-b3a2-f893d450f80a", "value": "3072:3UfQcoDCmIc5K1lRunsaAeUrllYNlx2q/eJzHIrL/KiiMLmk3j0M3:3UfkCmI91lMsaAeUrllYXx2TzHmL/K3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779562067, "uuid": "b83efe6b-042a-402c-b2e3-fc4741ea2882", "value": 194343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779562067, "uuid": "29e6d466-84ad-49bd-8f11-052dc17ee378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779562067, "uuid": "553150c4-d0f7-43bf-998c-e1e20f88c85c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6cc57b-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544417, "uuid": "8d5d6488-e2d3-4917-9a71-30714d713768", "comment": "Malware payload (Mirai)", "value": "597df558cf033d71990005462885675f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544417, "uuid": "c11ce800-82b8-4c62-ab42-46e0b4880907", "comment": "Malware payload (Mirai)", "value": "c49cea6913d1bef8fcd6ad12e05e2d9a99e099ac3c6c96e32573c527579d210b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544417, "uuid": "1fc5e968-0d01-4180-b861-956ccb754881", "comment": "Malware payload (Mirai)", "value": "dfa9a7fe2add42f67d705ab3e0a304f631f262c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544417, "uuid": "901e030d-3d41-459c-b5d2-8fe2ec85e991", "comment": "Malware payload (Mirai)", "value": "8ddcb09bb8114ec99e3ba0133193948ce9e00c28dced7012a695a8163077bf131599b27c52d3259d42e6c27e7406ca83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544417, "uuid": "6950dfaf-5c6d-4592-af97-b858d0bd7815", "value": "T10E33025D275193E48A6F6430E07778EEB801434168B3FB9A1090D7172BAE95B8F3BF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544417, "uuid": "b43fe441-e8e0-4f02-a823-8fa6b17b1640", "value": "1536:tNRtXYi7OE31Ds70YSRQXfHQ6sPzoE9lDO:Dr7f5s7uWf1ucEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544417, "uuid": "6ccdc933-921a-4ca9-8985-844400a52930", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544417, "uuid": "1e0ca93f-c1e6-45dc-83f3-b2fe9d70ec6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544417, "uuid": "5e8fb6b1-8f4c-49c6-8b23-a803f70aa3d4", "value": "luxzz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9b165b-56d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779560096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560096, "uuid": "5d10819f-595f-4e50-ae58-2dc51e7698ee", "comment": "Malware payload (Mirai)", "value": "861c5f7a5fb4fe2f6a755b13ca0dc838", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560096, "uuid": "593a1298-b6bc-4dd9-be56-fc047553872f", "comment": "Malware payload (Mirai)", "value": "c4dde645ff4fea90df0bdad4030a21ad7d49f82780cf37957a4879f9bab66e97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560096, "uuid": "e57ef8ba-fa4b-4948-9fe4-6353e72c7256", "comment": "Malware payload (Mirai)", "value": "719e7947f220dcf4a501742cb90014ca68ccba1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779560096, "uuid": "2518da14-5dd3-497b-8563-24e4c89fbfb4", "comment": "Malware payload (Mirai)", "value": "50397a017b9ad4959c6860b43bdbb836d6539b6be7d82437d93aae947042d092466b1f9773109dd0ed2159f529739027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560096, "uuid": "f465b0a8-c746-46c5-86a9-7da601bd0b60", "value": "T1ADE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560096, "uuid": "8692fac5-4daa-4db4-860a-d53dcaedc8a3", "value": "3072:Cv/WwsLgaq353qHiCOvhOp4qkDQHbeskmhxQwoVSUNu:KPLaq351hOp4qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779560096, "uuid": "0fe183cc-05fb-4332-9363-7ffedb3bb598", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779560096, "uuid": "d4258e9f-63a7-4ed0-8d11-256d1adca9d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779560096, "uuid": "fe134510-a73a-4e27-b5fa-551dc102b80c", "value": "c4dde645ff4fea90df0bdad4030a21ad7d49f82780cf37957a4879f9bab66e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da58609-56b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779548500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548500, "uuid": "c572d6e6-8f73-4876-a44a-b0c2cc830cb2", "comment": "Malware payload (Mirai)", "value": "cbd257ce08e1c127e531a2cc6c7632bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548500, "uuid": "44eff902-f8f7-43d9-a437-23b9665c7385", "comment": "Malware payload (Mirai)", "value": "c67b24792339d11f5e8ce60ba4c31876794a5e63c13df45d09bee58bede09e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548500, "uuid": "e5cfc6d8-8b84-4955-a810-efdf393f1ac7", "comment": "Malware payload (Mirai)", "value": "e08abb1e9d9ec534e1bedb7e3c495da841628024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548500, "uuid": "ad773f70-b683-47a0-9d8e-d936afa00b79", "comment": "Malware payload (Mirai)", "value": "facc9a43515371de08887146a867e12593064941b78474a82ec54b6780d88dcf18385515a743d4ece6b53b57b75bf41f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548500, "uuid": "cd9c2933-94cd-417a-8a9d-8590f7c3b655", "value": "T1F2736AC6AE83D8F8FC1205712137EB335AB7F63A1069D686C7699A33DC52A01D1173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548500, "uuid": "b79ab7a8-e4ee-4971-98da-12848b382551", "value": "1536:D2riM3DQ0zGF3gV6pjLFc4P8KsjFJKhm8nCYjntxZfmZ:DVM3DQ0zM3gop3Fc3KspCmHYJD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548500, "uuid": "84b4a704-2c55-4ce9-9730-5015bfdd0d41", "value": 75500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548500, "uuid": "1fd1b44a-ee28-4218-bcac-dcd8355d6c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548500, "uuid": "fbda889d-749b-418e-b366-c3f820ad28d8", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb27043-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544475, "uuid": "8a2021ba-72eb-410d-ae5a-76f7d5fba0c5", "comment": "Malware payload (Mirai)", "value": "3a335b5169126b4580b7dfa45d4f8606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544475, "uuid": "88b41535-8be3-4e24-bffb-2222f4429bc4", "comment": "Malware payload (Mirai)", "value": "c7c7a2a0719a02d10c021a5896e9a23c83f395675ebc13467be1a36d18f9bf59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544475, "uuid": "4a9ecf6b-d8c0-410b-b79e-39865b83b9df", "comment": "Malware payload (Mirai)", "value": "5b8a5b3626d0cd4ca05785a65be7c7cca35cbd38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544475, "uuid": "39c6b1a7-935f-44fb-9d2b-cbbdcff49744", "comment": "Malware payload (Mirai)", "value": "57209fe75de13b0f225dcfc52399093f60f0226d4855b54a0c88310732ba26e30778b4926dd0bb3c6947621e92d8120f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544475, "uuid": "a82684b8-be90-4845-888f-929ceb008555", "value": "T189044C46EB814A13C0D62779F69F524633239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544475, "uuid": "a0c0d3ae-d24c-442c-8ddd-90d7e6d8be4f", "value": "3072:/lE4Po+DImaehF/h9PZpgBmsXCKiHUddQy3d0fM/97ezERM:/l2KLaehF/h9RpwJCDH0dQy3dEM/9DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544475, "uuid": "9bdf1db9-9b94-4de5-86df-1d25812de174", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544475, "uuid": "6df78856-0201-42d0-bbf6-85303ab105e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544475, "uuid": "00374dd2-7a9d-44e4-b126-12c9ac4c36a7", "value": "luxzz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12da86e-5685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779526735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526735, "uuid": "78c7f441-1213-41eb-96d0-760198373969", "comment": "Malware payload", "value": "a9437a37d2c22131316a8a85bc0dc2ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526735, "uuid": "f350e099-2dc1-489e-95fe-4a8bb9b223b0", "comment": "Malware payload", "value": "c9257b93e44ec96b03415a0a3bbd9b49cfae8979445ae309d6d915e0374292b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526735, "uuid": "b6c4b0ad-f7cb-4541-8dde-a98cc3b96623", "comment": "Malware payload", "value": "b12fa69b79f3c16b99589ec0584e3ffee3dacaaa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779526735, "uuid": "3caf50eb-c66d-4794-a5a2-60c78cf641f6", "comment": "Malware payload", "value": "c0289e732f9be827ad54350d3369c8edd9b98262486baa35cb167460e102c0cc13e6fa11fc80956940e0c0a597d6090e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526735, "uuid": "3e9d36a1-7738-4c18-98c3-ab276e2c46d1", "value": "T115F02719EC8848BEA03FC49EBBD63D8D120F5110068B2E2D96B51C07B8B9C485091833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526735, "uuid": "5d14089a-4ba2-40b3-bad2-c647f122a196", "value": "12:/VJ+TNLI5DXYEzniuy4ghsesFrFBEGghgu+hYuTyisJF8EpASNyiiuyw:NwTNLI58EzjZrTBEGCnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779526735, "uuid": "b3401090-07d1-4b9b-9471-bf5223016c52", "value": 470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779526735, "uuid": "dc58d428-a161-45f2-8019-4e2f6c2bfa88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779526735, "uuid": "47582c71-e78d-49bc-9137-7e3a2c81863a", "value": "shr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b912f7f-56c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779552818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552818, "uuid": "16e7d160-a65a-4707-b567-86298593b44f", "comment": "Malware payload", "value": "164d354cc1aeb7c8e0a50d16ca79415e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552818, "uuid": "a4d80189-92da-4001-8d87-9a7e3c5e9ddd", "comment": "Malware payload", "value": "ca85e1a7b11ca6dbfe60c3113490f39883158098803a2e20ef76a9046bc8feea", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552818, "uuid": "690ccb23-ebd7-4ffa-8f1d-2e9d35a11ed6", "comment": "Malware payload", "value": "35187491eca3ce47037aca2ec54fe9f1fe9cda38", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779552818, "uuid": "52f3e794-eaf3-4330-a147-59bf33cc612c", "comment": "Malware payload", "value": "7398ebf1703a8f8faa7ce5c1e3656ebebcdb42da15c02a8f780a371028399e836a0ebc50c2332ebe0c60139d1449432e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779552818, "uuid": "93099bc5-6873-4252-9d65-1a3c95995804", "value": "T1A0048587E79505B427F116F7464BB022A2A1F0079475FE2C7F2CA6E43F1C69182ADBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779552818, "uuid": "e6022e52-a08d-4cb7-82ca-4dc68cad58f1", "value": "1536:Erat/94QIzZpRZajpySVf/Fa8u4ezjFfr6HmZjgzE:AF+rFa8u40hGHmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779552818, "uuid": "9c25386d-c049-4f54-bc2f-3e0ffa08b144", "value": 181130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779552818, "uuid": "99bc4c9c-d53d-42b2-9c52-9365923dd6c1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779552818, "uuid": "3af56841-533e-4aea-bf63-f89de3ee4750", "value": "Config_New_v8.6.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111672da-56af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544533, "uuid": "52e563ea-c29d-4aa3-9917-e0ff91687829", "comment": "Malware payload (Mirai)", "value": "27df55a596600372c75f488c8acd301d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544533, "uuid": "444030f0-61fc-4a1b-abbe-8a33ba18b4f4", "comment": "Malware payload (Mirai)", "value": "cd6413b80635379dc01476aafa4a8ccf68c603effe50e94df647bdb55568f90d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544533, "uuid": "067319e9-c1ed-443e-8910-9544ed1d5430", "comment": "Malware payload (Mirai)", "value": "455f4dd29ece161a45bf51dcc61d08bbacdd61e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544533, "uuid": "b802086f-3d68-400d-ace6-74ee5f2ed3f5", "comment": "Malware payload (Mirai)", "value": "bbfd0657af3dd67463730d11aa2a8b9265dc268eccd0b980e8a7d6f2f125e74b132b8e4928d7eedc48f714214b64ff4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544533, "uuid": "7cecf068-ad0d-42da-8ee4-cbe95411d2da", "value": "T1E5C2F1C46F71A70FEB804A31879249D5EA3738081A79853A505C5962CC6FC4FAFCCD89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544533, "uuid": "76771476-ee44-41f3-aa27-ea6ee7bb7583", "value": "384:+hJshc924eUP2IuwTEvf71rKVTMPjvggzLbJkMlFKZVby3axk2tto9ahKh6ovbha:Qshw8UP2T1rBPUg2xu3aW2fon6ojdRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544533, "uuid": "6da1b720-1ae2-421d-9991-450a41b45b14", "value": 27084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544533, "uuid": "47716b27-c0c1-4156-a46c-6471460a512a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544533, "uuid": "fa47a99e-6a00-4f5d-a4ce-ce5edfb06025", "value": "luxzz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7428a6ed-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520218, "uuid": "3e8218e9-bf8a-4864-b640-9fa0a647ab42", "comment": "Malware payload (Phorpiex)", "value": "b710f1efaaf6103798b59c7d9a231099", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520218, "uuid": "3756fd57-c574-4acb-a580-8f3a0a66e3a6", "comment": "Malware payload (Phorpiex)", "value": "ce1313e3e792dba5a6fc733bef3d26dc0aa16436a2dae6d5f3945515a5ce31f5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520218, "uuid": "444be4d4-e2ab-482f-a662-db760a91434b", "comment": "Malware payload (Phorpiex)", "value": "2452b64560b6340396e8c5dee0cd32cb7c93d729", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520218, "uuid": "1a744cd3-bfcd-4afd-81a5-3ea7390ec58b", "comment": "Malware payload (Phorpiex)", "value": "b994319ed59bf520c674b8178babe03810994469cda755d2fa3195fde6a377681c8c1dec1045bb7c7991de9737e90f70", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520218, "uuid": "cf14c79b-51ad-46e3-ab53-ff656882a91b", "value": "T1F3824B0FF9914216D1E100B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520218, "uuid": "4f912187-5fb0-4e09-b4c7-a0e0119e71f3", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520218, "uuid": "a5424a3e-e675-46a8-b530-806700b3d911", "value": "384:32IJlVYer7bskwAd0ZHu9JgiL7QWav8U9cO:Rgw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520218, "uuid": "6ca27603-336d-468e-b2a9-94a457955240", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520218, "uuid": "9b8c0ab0-0bca-4531-8916-3b370e7bd93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520218, "uuid": "9fa35d9c-d3a8-46fb-8ea8-fa8dc37500aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f018bb9c-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544477, "uuid": "290a2f8c-12f6-4c68-a0c6-dc69808ee641", "comment": "Malware payload (Mirai)", "value": "e763ffb3c3b894d6f58b101ede0310ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544477, "uuid": "afafa112-2742-49b1-b432-840c73e6b061", "comment": "Malware payload (Mirai)", "value": "ce48c954a700c201950c91381304885e765c3e71a027a766bde8daa5d48763fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544477, "uuid": "c5a3b866-1e29-4d10-a2bf-764a54fada90", "comment": "Malware payload (Mirai)", "value": "298c243287fb9f35494f31d1c5f6c4c3af8cbaf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544477, "uuid": "b80123ee-2693-4ca9-be75-97b027017581", "comment": "Malware payload (Mirai)", "value": "aba9522c290203b279172c033f312dc2bda18283219250f7cda4baba85077a23eb31766ae33ca7664b4a5f1debfb1ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544477, "uuid": "10715253-2006-41ef-98fe-7a5496c9a10e", "value": "T1B68329C1FA8BC0F1D91B89304067F63FCB31E8295061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544477, "uuid": "402e705a-965d-4095-93b0-248bd6acb271", "value": "1536:iXDwDhVtcU4xiUWaqH3FgqHeEMWximKjfTsv4gz9F7vC:kDWKzQLH3FPjwmKjfTc4gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544477, "uuid": "c9a7fb8f-6918-4bf2-8add-01f5759a4cd2", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544477, "uuid": "4b69d707-ec2e-4c63-85a8-bb58fd785629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544477, "uuid": "32f819af-55bf-4774-9897-104a0c1ff44d", "value": "luxzz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c4d55b-56b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779548971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548971, "uuid": "137deffc-33d7-421e-a368-b47c1f78091f", "comment": "Malware payload (Mirai)", "value": "3a283f63472c647ae2acb942830bedf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548971, "uuid": "575491fe-a99c-463a-9334-b180fa498b4f", "comment": "Malware payload (Mirai)", "value": "ce5f580b6014bf4c09f5425168e260a8c47633ba00f5fdc23fff87088fe1b3b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548971, "uuid": "ef742eb6-1891-47a4-90d8-dfb92a9b485c", "comment": "Malware payload (Mirai)", "value": "0339e14552ae93d08e6cc962a12c1cabfe0e97df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548971, "uuid": "3da6f0c1-7f4a-4bbb-81bf-80dcf51b409c", "comment": "Malware payload (Mirai)", "value": "e2e993b94beb1cf454544a29f834fb4686791711ed82af7aabd394efcce4a54bc22a13b9c688ebccdacbffc6e321c4fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548971, "uuid": "5335286e-9b34-4595-887e-4debe31736d7", "value": "T15F833880FA4781F5E95708304067F23FDF32E56A8070D66DEF9ADE25DA33A41A316399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548971, "uuid": "c23ecc2d-55f3-4c03-8df1-4a27faddfc16", "value": "1536:Z3ouPlV4jmtUAHHp1rjVMGR6k8JaN+cTjhM+JbzW3MGnJ/cPPjub0GN:J/9V9tUAHHptRR6dJdcTlb+cGnJi7YpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548971, "uuid": "3f6f9c0f-5790-4a71-b28a-b92763ef2400", "value": 83020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548971, "uuid": "c4f22880-3bd5-4e7e-9fae-5beb03d0c35e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548971, "uuid": "16efe8b6-dd1f-4bf2-876c-1ad820706ac5", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b8d60a-56b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779548399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548399, "uuid": "48b5bb45-b405-4d86-9bb1-67e0c0c8bcae", "comment": "Malware payload (Mirai)", "value": "f50d663f6a0d013f749ed84d3c8f270b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548399, "uuid": "a94cd1bf-e8cf-44a3-8944-79ee6b47f373", "comment": "Malware payload (Mirai)", "value": "cebd1030186a4102b695c958ef31aa9a7a27505dd6ffa70a7e9284fab975eebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548399, "uuid": "d3173d81-3257-440a-9d72-016162230727", "comment": "Malware payload (Mirai)", "value": "807964b95d5a912a404cf68338130a72bd232149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779548399, "uuid": "b071095a-8425-4316-be60-a5691bfd0bad", "comment": "Malware payload (Mirai)", "value": "48bf22f49cdfb424e2c4f95a9c0337b2dbbeb602e372d20f4dfc0ad624d503de7cfb31b4931eeecaf81bdf29f8ed3c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548399, "uuid": "b2233eff-9f8f-4177-b2e3-d901cba27fb5", "value": "T1C9835B27758180FCC459D2B8476F713AD532B43E1238B2AE27C8FF2A2D4AE605F2D595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548399, "uuid": "e0ccfd14-1355-4925-9f53-7432a757c100", "value": "1536:yrYcfiyjZLdQ1Fo3YokpKMkTlwJWiPwSRbIrF1tzcJ2HE+8AFg:MYpydZQYorplkpG9PwSROLtS2HE+8A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779548399, "uuid": "41ba20ac-cdab-4578-b72f-355b1bb7e135", "value": 82288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779548399, "uuid": "d28ef00e-85ed-4822-bef8-6031b6ec54e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779548399, "uuid": "4fc766d4-69b5-4652-9905-c8ea05db2fae", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b3dc0-5696-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533795, "uuid": "6d42711a-e1b8-4fc2-819c-a6cd37b0009d", "comment": "Malware payload", "value": "efce3d4077f4a7dac064c145f446aed8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533795, "uuid": "211cf0dd-da98-441a-b145-bd98a553da1d", "comment": "Malware payload", "value": "cf72504c727ad8f84e595db6ec5c240e97cf674f56ec514bdc3452593730052c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533795, "uuid": "bcbc54f9-d3ae-40f0-bb8d-e247a589bfdd", "comment": "Malware payload", "value": "7b7799515906f7d1f944f41fbecbc26631ec37f3", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533795, "uuid": "a8822b56-2634-4601-91f1-0969f03a8743", "comment": "Malware payload", "value": "bff59ccba4a43e36ffd6c650f8d9d01c824741bfaf19884197b855af4d23ecc8a6ef749e3988d3b7dfeb6297425fef7e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533795, "uuid": "1d391984-f3e7-4a29-a7b8-f38832c473d5", "value": "T1CD9423036BB1DBDB45F0526C20DD8A2B19504E8F5528B0EAFBEE544377DE317A0AB532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533795, "uuid": "160dc375-b473-42d5-8da2-d7b5fc8e85a8", "value": "12288:lxN2NThwKPwT595SfFLEP5iWPkoM6bYehn3:Qw7vP5ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533795, "uuid": "eb3ba8c2-d47b-4bcd-8b11-1bf31c4fe9cc", "value": 429258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533795, "uuid": "faaaaaa4-c79d-4f76-afc6-04aff8de5147", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533795, "uuid": "6ea636a3-a45f-4d9f-8892-5cf4acd155de", "value": "cf72504c727ad8f84e595db6ec5c240e97cf674f56ec514bdc3452593730052c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6432b30-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544407, "uuid": "dedd1654-4437-4708-9b1b-5a20163fabb3", "comment": "Malware payload (Mirai)", "value": "4f451bc0b88c0c861436b0e0eeda4f55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544407, "uuid": "431fdf7a-734e-4766-be70-876ad32d88ac", "comment": "Malware payload (Mirai)", "value": "d02330c6dea32043f42ea75285e96fb7e8e04888d0d1ecf01901975964439511", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544407, "uuid": "7f46c920-55b0-4d90-b115-dfdedf76b290", "comment": "Malware payload (Mirai)", "value": "6fff752d6a600d4a11b31079f2ced4754efdb47e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544407, "uuid": "ebc0e450-a28b-45b5-8d39-930884fc8094", "comment": "Malware payload (Mirai)", "value": "482c8192ec02e2d8aa3cdd5a9e82d4239e67dafa2df4ea4a443cdffbaf9f1b082782c2b9a7a7a9955343e0c8d9cea13e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544407, "uuid": "ea0d0be5-5fdc-43d4-80b7-ab3e064dbea5", "value": "T194116D97F54686A38D8D007D6F6DF0124053C47717A2C939768CEF190F53144BAE1A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544407, "uuid": "47bb933d-e607-4823-a5c2-644ef74a488b", "value": "24:t+AhIMhfyc0stjGV98xK8RItBLkrx6ipas0s0XsJinbNiLuh3jbUk:txIEfmOyV9I/RItBAtSsRMsCbOC3jbUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544407, "uuid": "e4922f78-f13a-4f1f-b595-f326fa34c8b0", "value": 868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544407, "uuid": "1fa3dfea-094b-40b4-ae97-1688dd3f789d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544407, "uuid": "851157d9-9888-4fa3-911c-228486669515", "value": "memekw.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd7b9f0-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497172, "uuid": "faff08d0-67c2-4ca0-ae3d-4097c1da92b5", "comment": "Malware payload", "value": "3483bf7a0140069973cbf84e98d20a0b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497172, "uuid": "c06a678b-ac6b-4c0a-b922-176c7be5f3ee", "comment": "Malware payload", "value": "d19fb8a6042e325e08713647f46e5ddf1d56e29a357594f0e313a5493db409ce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497172, "uuid": "e7c5aca0-729b-48db-a960-59e760bec4a1", "comment": "Malware payload", "value": "cfaa2999b9071e74b0127fb59884fa44ea0c9728", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497172, "uuid": "757d10cf-bd82-4078-b79d-d19f5c3f5846", "comment": "Malware payload", "value": "3e7714d616b8235bd01856b5e356b728987844c1fc4df2df31d12d8ede15e1c1dfc28ac8182ca7c6f4ceb938bcbe2354", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497172, "uuid": "0c517273-698e-4688-8ba1-cc2fab6469f1", "value": "T14BE026A684A2D8FB0C7E058070732C00E60F5036FF30812C3F4698935ABB126B42C864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497172, "uuid": "69d61cf7-c3c6-4d49-bcba-211326ebba88", "value": "6:hoE6PqhwQLy4IHS/6ghUObYFs7smI9//PwfQ//D7B/+bZJbKXFs7Yjs:UPsy4sS/6ghr7PoTsJbKKEjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497172, "uuid": "37c5abb8-3b42-4a25-8593-38de33da78ef", "value": 337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497172, "uuid": "b54e6d38-7abd-4d9b-9c26-f474004efd53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497172, "uuid": "fa7c2c08-4c84-42f7-baed-b4a89e7e383c", "value": "bwwg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca64c86e-566b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779515638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515638, "uuid": "9e76bf11-0129-4550-9fdc-ab069f4241e8", "comment": "Malware payload", "value": "b27cd0c137266ed9fada2da23fbc7e6f", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515638, "uuid": "b17863f1-43e5-476e-a2f8-8f86c3a0b47d", "comment": "Malware payload", "value": "d28d9e0c58c37fa23524bb09f2679cdf0621b6a17a5c242c416333a63869940d", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515638, "uuid": "baee7611-65f1-423e-b052-10ab1cfd95ff", "comment": "Malware payload", "value": "5b1d97468e5b16ec229d21b85b9689da10edfd53", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779515638, "uuid": "0a762804-9c2a-404e-b1a9-4bb7c0df333b", "comment": "Malware payload", "value": "a5b909963f37a65f635bbf8d2fcd6143244cd93442a133420e39d5c3ce234bf0d70c635b6bea621e83af09c4cbb183cb", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515638, "uuid": "e177f274-7579-46c8-b217-4baeb47a7a87", "value": "T15A17334477D048E9DCB5503E78D69811ABEAB8E107A0C39F9BED2A410E730E4EF75B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515638, "uuid": "8b07eb65-1163-42e4-9594-4d3b29e525f9", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515638, "uuid": "135dc7e6-3aae-45cc-839f-03783072b2f9", "value": "393216:4GtSdMCeW8BOYFxVHFFEXMCHWUjxjx5WsqWxTt5xHMrlDaSrRPRRabwsq:4KSKCeW8gYFrHFFEXMb8csqAVMh/rRRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779515638, "uuid": "542d401e-0662-43b7-9c29-b064acda3d33", "value": 20087055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779515638, "uuid": "818757bc-eb6d-46ae-b6cc-320fea9c4c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779515638, "uuid": "f27ac4c1-4f9d-4ff8-9ec3-e9a7f984fd2a", "value": "AppSetup_Launcher_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48408ace-5689-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779528304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528304, "uuid": "6aa55e78-fb80-45b3-b739-982f97fdfcb0", "comment": "Malware payload (RemcosRAT)", "value": "8fc6d0edcce7580ed1e9629d0da7ca79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528304, "uuid": "de6d0acd-130e-425b-8c61-b4ed168eabef", "comment": "Malware payload (RemcosRAT)", "value": "d3bbe911d76f1fc2c31e3b7c85da7477bed6eab70f6e829a0347511986677d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528304, "uuid": "0b184b1e-8711-4e5d-a0db-dd229c2ef0e8", "comment": "Malware payload (RemcosRAT)", "value": "f6b00cdae81296b277d4a3aff409696962f030a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528304, "uuid": "7097b826-e35a-4444-8f10-9496c47f9332", "comment": "Malware payload (RemcosRAT)", "value": "3475c1994afcea4d9064dc71b0de0e31062893d382b91ef5cc17da0fc1408cb2ffb3a9d573eec7eff8d3c8132d871507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528304, "uuid": "3d86b232-1953-427f-bbce-d10f9f14e97d", "value": "T1CC93D813FA4AD0B2E46591F145426F32CEBCBC3636492173D38FCA41AD79892D416EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528304, "uuid": "9744eab9-d70a-42bd-8354-55030d29744a", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528304, "uuid": "8b2f9dba-24c5-4231-8e1b-82cc5e0a1d1f", "value": "1536:ohhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Zrd:uhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779528304, "uuid": "7cea41a8-e9bc-463e-8e6c-293946d12b94", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779528304, "uuid": "4770b36b-c08a-4dc7-904f-891dcdca4ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528304, "uuid": "844d6169-dc98-49ab-9737-fea25511c4f7", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e1142d-56fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779578575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779578575, "uuid": "297ff604-48f8-4e66-9cc6-fab77923e0a2", "comment": "Malware payload (Mirai)", "value": "a49d7869a96048a6a4cf6c6ee6ef934c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779578575, "uuid": "91a50d6e-6cc5-4544-aaa4-503ba7471d78", "comment": "Malware payload (Mirai)", "value": "d475f72f5cdb3d9485e7ef9f8566efd52374be2e342cd17d9d46e714afc2e32e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779578575, "uuid": "b421de9a-fb48-4c71-92c4-b4c7f2a70001", "comment": "Malware payload (Mirai)", "value": "963c1731d5f016ad5381082a2eb12b20320d327c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779578575, "uuid": "43b28912-2661-4660-8968-85a17b738106", "comment": "Malware payload (Mirai)", "value": "9f9c3fb19cc8786ec89c96a0f0072a4c752f73680a44ad4bee071163f6c42752878a293b22760318c78d99b655675cfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779578575, "uuid": "eb83fe47-ad65-4f20-b480-c94ef5f33505", "value": "T1D214E709AFA10FFBDCABDD3706E91B0129CCA41722A43B357674D528F54A60F5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779578575, "uuid": "996481b9-f09f-45d9-b378-1d6a7bb107a3", "value": "3072:PV8yR58w9qDy5X9pZIyyD8cW5kLK5kW1g5E+x1T3Grx2:PV8yRBMOpZIycW5kWXS5BrGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779578575, "uuid": "9d89c5e0-3e24-412f-9529-65d91a9fa620", "value": 206500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779578575, "uuid": "80733269-cee7-4146-8109-e26e83bba758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779578575, "uuid": "5a0f0708-6b5a-478a-8d33-5558c0982fff", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0582188-5699-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779535405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535405, "uuid": "e939052b-2819-481d-8b01-84fc10e01ca4", "comment": "Malware payload (Mirai)", "value": "e6b858593f760c76af2181deee7c07c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535405, "uuid": "ccae8ed9-da1a-4667-a9e2-867ea3d8d02e", "comment": "Malware payload (Mirai)", "value": "d48778d84bbbcf966a3f265aee449f5c011211a119de831bd030c6b990662f9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535405, "uuid": "e06c9c08-5f44-4af8-86f3-23d98b19446f", "comment": "Malware payload (Mirai)", "value": "e0778ebda6dfd8e08e80235c4ef095f7cc4ec5a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779535405, "uuid": "46789dd2-1ae6-47d9-a83c-81a6c9ef2240", "comment": "Malware payload (Mirai)", "value": "73ce5955a3e0076a393cd8693bd55e6b7a2f6ab1a6d5b17943c2c309818e4dd0ea3ed094ec21f9e8c2d859179bf48d28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535405, "uuid": "3aa4424a-47fd-441f-92ce-7e126652010c", "value": "T1FF03E012746C2E2DDD88E2BE439E7DBFB9660E622CD6E5C736D8DAAF8460134C170C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535405, "uuid": "ca1bca85-ca5c-40cc-9874-be7ca4276594", "value": "768:42kfZ/bHf9x73X0LRk5OxvCaLM1eAQxs8waQF2hQO7aB:4nZbHXU2ox6asOfQFPO70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779535405, "uuid": "f9fab184-c15f-4f41-9cb7-acf6632b835a", "value": 40444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779535405, "uuid": "4c49a792-0d1d-4981-938f-81a1c8cb507a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779535405, "uuid": "ef77564e-337b-4957-93df-d88c6840b754", "value": "luxzz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0feb3f-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520209, "uuid": "38e367b9-9048-4339-84c4-4088ba57617d", "comment": "Malware payload (Phorpiex)", "value": "181666079812447702801525f9e6f5d4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520209, "uuid": "d6d3cc5a-490c-4d07-9a05-c9c18c7b1da8", "comment": "Malware payload (Phorpiex)", "value": "d4917c0d07608ce5ba112afebb8ba7ad4dfb920fe3b09c1a5ddf3b7ccd3c43bf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520209, "uuid": "277bd906-176b-42e2-9272-3162189c4c51", "comment": "Malware payload (Phorpiex)", "value": "702bf1a4e6b48a07b22415184056e53a2d23e34f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520209, "uuid": "13aa88c1-285f-4ba3-aea2-50651412cd38", "comment": "Malware payload (Phorpiex)", "value": "36a8aabab6ac52ba82ddb4a8ccc0b7f29cba6e3f6457d04b1507fe17c1ae4e2f9d13d97a4c37b3130280aad3918b9329", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520209, "uuid": "e72e4a0a-376b-4d29-9699-4a0b7af5a019", "value": "T111824B0FF9914216D1E110B05675863BDAB99C72338854EFFBD48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520209, "uuid": "8914037c-659c-4e52-94c6-2ba17f4d23c1", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520209, "uuid": "278c7045-c9b5-49e1-a536-c3a0b1b061ed", "value": "384:4XIJlVYer7bskwEd0ZHu9JgiL7QWav8U9co:Dg80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520209, "uuid": "be492adf-2173-40a9-abb4-f5f82c0cc143", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520209, "uuid": "acb0a324-d07b-4aad-b885-620319c5f2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520209, "uuid": "b6d1101b-8be2-4e41-a82a-310379141b96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1745e5-567d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779523425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523425, "uuid": "70b93f81-8e88-4c92-baea-7942b75277db", "comment": "Malware payload (Mirai)", "value": "2e6b14b4db69629a204e64b5c106f272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523425, "uuid": "bd12b31d-9dfe-4b66-bbd6-fd6637bf6b86", "comment": "Malware payload (Mirai)", "value": "d589f25165b5a478d809bf6d8f3017a128dd0ad72ccf6cb5e1d4fd9e95a99b7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523425, "uuid": "fd5517cf-460f-43f7-93dd-e0c387bd7e4a", "comment": "Malware payload (Mirai)", "value": "67c6e7d6e188c034c33ca94b2106393172ec2b65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779523425, "uuid": "cc0b64fa-b5c2-44f1-8415-459bf20a0310", "comment": "Malware payload (Mirai)", "value": "3b2e7525d95c340504fa3d8d31ab2b8a7812d1f225c485c05ea02fd9bd0001eda60fdcf90688833160ab84c1e41c8a84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523425, "uuid": "eb0ef45f-8e1a-487d-b2a0-1b275566f0ac", "value": "T1F4E34D9AF802DE7EFC0BE57E44670D15FA30A3613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523425, "uuid": "f02e7977-a982-4a89-92eb-58b19935ea20", "value": "3072:luWypdcGShA/EmPA39TsZJ243nxl9XzrTmdHp:gCGShAMnThAxl9TmdHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779523425, "uuid": "0a370a64-9ef9-4cab-9cfb-18303b462a0c", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779523425, "uuid": "306f35cb-10ef-49ea-90b1-b336e7bbe28f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779523425, "uuid": "556651ad-a473-4d4f-9650-8e1309fffc45", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763d458a-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520221, "uuid": "f1c87c4c-0644-4870-a19d-4d8048f1f6a9", "comment": "Malware payload (Phorpiex)", "value": "92744fde3c6107a4e111c8bda4abf709", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520221, "uuid": "9030014f-780e-43fa-bac3-5c69ee3d7ab8", "comment": "Malware payload (Phorpiex)", "value": "d6408ba458b9f16f94db5056b95e5d3f7bf22f34764ec07aefe52ce387c86d63", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520221, "uuid": "81b010f4-b27b-4a0e-8f24-83b352ca2bf1", "comment": "Malware payload (Phorpiex)", "value": "eb4f62689f9f9e4cd4f5df9f59974384b95b29c7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520221, "uuid": "7644c156-af79-4260-9f68-e5f92469cd85", "comment": "Malware payload (Phorpiex)", "value": "60a56fd5e7f6f413e67a085ccb6b4db59e3d5da981476746576d920acc2d9de84d3ab990ad5ce35be6d8b3a08893413e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520221, "uuid": "fcc6cfd1-1a00-49e0-82d5-a15cdfcb816e", "value": "T1BC824B0FF9914216D1E100B05675863BDAB99C72338454EFFBD48A9D0BA86E6FC3221F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520221, "uuid": "390a00e6-4b12-4186-af2e-5f61ec5728a1", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520221, "uuid": "a4657d9b-a4e0-406c-a568-cfad4ea10722", "value": "384:xIIJlVYer7bskwEd0ZHu9JgiL7QWav8U9c4:Vg80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520221, "uuid": "3d93fd02-6570-48db-82cd-9f8377887573", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520221, "uuid": "39880f39-5e3e-4bd2-b0af-d5d0c16ecb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520221, "uuid": "3d2d517d-63f3-4228-ade1-09f4377ce276", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcf9d02-56cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779557254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779557254, "uuid": "cfaea4c7-5e28-4f78-b8a5-0d3dfb9c21aa", "comment": "Malware payload", "value": "0d35281cabe7063d59c0f9901098bfad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779557254, "uuid": "09384fca-9093-4734-86dc-ea77b63ec031", "comment": "Malware payload", "value": "d759a0a19b004b243f522499ebcce7162df704babec04fafb3aa332967521852", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779557254, "uuid": "61a09584-b29d-46b0-9fa1-43d12d7f298e", "comment": "Malware payload", "value": "f953b70bef04f81087204863d3cdb703e1ceff2f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779557254, "uuid": "d48d5b1f-82b3-4520-96ff-e94fad9a73db", "comment": "Malware payload", "value": "aba5151a47e5a7d060ccdeedd08609780c90ba550eb6ae0e1bc31b9966b6115af1900e0f3a09e7a76eaff4642074ff2a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779557254, "uuid": "cf21d05d-2b4b-423a-be5b-39c357ee7a4a", "value": "T14838330D695A41D6F3BA16399A74B254C373F09C0F3219D37EAC8449BF628988D7839F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779557254, "uuid": "28bfbb00-ac9d-4c3c-972d-464477ebe057", "value": "1572864:BviEeVrK7n9i3IPe+u/bbcNH59BiuZ2S71BKjVDBT1N/Waic3YygFRndMKT:Bva5g8Inu45LiuZXrIVD/RWsLQ2KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779557254, "uuid": "bcb99901-37a2-4ff9-9f54-45a16030938d", "value": 102985240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779557254, "uuid": "15ee73d5-f28c-4999-9813-ed260d76d65b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779557254, "uuid": "0e4c09ba-b36c-400d-9e7f-f4af435c7f68", "value": "intel-ssd-toolbox-solidigm-storage-tool-github-io-3.11.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b4c023-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551869, "uuid": "e6148ba1-4661-4f74-9919-4dac76a89472", "comment": "Malware payload (Mirai)", "value": "c556446ac71058f29c09b3d124c2af82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551869, "uuid": "64f8f827-0f97-4c08-a66a-bc3b5b71855b", "comment": "Malware payload (Mirai)", "value": "d7ce71db654dfea794d5d8f4f08620cc4e7245d86985290f9baceebe2dce983b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551869, "uuid": "f5b22532-b8b3-4c03-b937-ff4075f176c7", "comment": "Malware payload (Mirai)", "value": "2c7da421acf98f67d97f07c1f3264d4113f23e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551869, "uuid": "4cda2324-f645-43d4-b836-f245c8a796b8", "comment": "Malware payload (Mirai)", "value": "49d086c0d5d774e589f76fd6c6d0a39525d56b4def597957b6912a237ea3cf8bb38a1cc5e88fe6feb189d1874bc4077f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551869, "uuid": "87d116a3-7b47-4071-94e2-6a408c5353e3", "value": "T13C363917EC9145E9C0EED631CA669252BA717C485B3027D32F60F7392F72BD0AAB9704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551869, "uuid": "234b7f31-77fa-4f1d-a469-35bb51f35664", "value": "49152:ibx1XdgoyTVQuhnfYmMhP9u4M6gvCShiZQUDoa5EPzzU/eq51T9xQH+f:AEauhfY9n6vCSotowEPUTD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551869, "uuid": "37d9edb0-7ebc-4c44-8232-7088d8576730", "value": 5030040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551869, "uuid": "d5ef3f7d-1d4e-44a3-a590-42d007fa451c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551869, "uuid": "2fa77f25-7fee-473c-a4a9-b70cf84ba50f", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b6473b-56ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779543953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543953, "uuid": "57fac382-cbbf-4336-80ff-182dff3ad1b8", "comment": "Malware payload (Mirai)", "value": "9dd3d26e507dc0d9aa9b9b4aaa282736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543953, "uuid": "36a0552f-235d-4f88-add4-6e1cf289f87f", "comment": "Malware payload (Mirai)", "value": "d96ad13231f7dba68647498631c9131f8e261da9dffe73b1efbd729fdeb9a756", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543953, "uuid": "9ce12cf2-5a49-473b-b4b0-abf0e111fb63", "comment": "Malware payload (Mirai)", "value": "102e54bce0dce546ed56aca245bd8dae43d7a471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543953, "uuid": "e08bb8bb-1c64-4973-96f0-d70ba2dd75d7", "comment": "Malware payload (Mirai)", "value": "6451ba77f4927222880c971ee45aa035099ebfc9454c12185ee7f6739dc3266dbceefa3ea91636727b17fb57babf1d0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543953, "uuid": "0cab89e7-1000-47ba-aa93-75b032719920", "value": "T163836B27758184FCC459E278477F723AD132B47E1238B2AA27C8EF1B6C89E601F2D595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543953, "uuid": "f2f48d76-7000-4fd4-8c40-09f4bbacc120", "value": "1536:OYz9Us7OIQ//3+QFRB4Hd11TEJkqWpopZwYb4ud8qtEJ1fz+wCQIL:95UeO9//OQFR+9TTKkZeZwYld8qM1fzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543953, "uuid": "247e495b-400f-4094-b589-d1d8788b5a03", "value": 82224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543953, "uuid": "b76ec90b-77ed-456e-9e2d-453fffd5acc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543953, "uuid": "91c91c83-2ad0-4ec5-8c38-ef8c25b5dc2b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f63827-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497053, "uuid": "0b7d51a8-cc5a-459d-90c6-078139e40a7b", "comment": "Malware payload", "value": "1278266fee0a9c44103745f0f0156db1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497053, "uuid": "5762f388-cc1c-42ca-8e5c-7b808d7958a7", "comment": "Malware payload", "value": "da2cabbdc7731a0606a266fc517d11487cf1390b523968a388fbdb8370810106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497053, "uuid": "ab4a9e53-1ed6-4c53-815b-f687c304afc4", "comment": "Malware payload", "value": "92bcdc3a851456a2637528bcaeb3f01e04bd94cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497053, "uuid": "e4d54485-d2cd-4e86-ae6b-0bfd00ed18be", "comment": "Malware payload", "value": "36dd710df32ef7c27f32970dc96e6f042ead0f45b9c7f04bbb08cfcbdc7d16e1758624c76ba0de8b65e5c463b9b059a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497053, "uuid": "8aa64d25-e7cc-41bf-9223-78e98c1efe41", "value": "T1A125E0AABC419A52C4D025BBFA6D8188334343BCC3DA7505ED01CB35B6EF98E0E39B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497053, "uuid": "e7296b9a-b191-4bea-b297-835d9150cc37", "value": "24576:HbhpTWnzOKJaYKGhzEy+GcML80KELvj1jtx0gK4NE:to55vxt/NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497053, "uuid": "d00b509f-8e82-4732-ba77-8a69dc9b533b", "value": 1023210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497053, "uuid": "9388e54a-16cc-4ef2-9180-52f63b31d142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497053, "uuid": "ad2d5332-dfd8-4e38-b097-3e6b618b8831", "value": "tpydwmr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff21464-56c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779556047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556047, "uuid": "0dc120bf-ca37-4ecd-8ea9-f44800368166", "comment": "Malware payload", "value": "895dc3eeff39448697e2bf463ca99824", "object_relation": "md5", "Tag": [ { "name": "Jenxcus", "colour": "#501935", "exportable": true, "hide_tag": false }, { "name": "njq8", "colour": "#641E80", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556047, "uuid": "b133fce8-cb11-49f1-8c44-80d92b1ca1ca", "comment": "Malware payload", "value": "dbc0ec30e3dc431ff9c7559479901ee6fd0a7298bf16148e10004efaf12c1b68", "object_relation": "sha256", "Tag": [ { "name": "Jenxcus", "colour": "#501935", "exportable": true, "hide_tag": false }, { "name": "njq8", "colour": "#641E80", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556047, "uuid": "088eb382-1e02-4fc2-aef8-aad1e04f30cf", "comment": "Malware payload", "value": "14285126de3d173bf06c9daa73b2e03ad9d12821", "object_relation": "sha1", "Tag": [ { "name": "Jenxcus", "colour": "#501935", "exportable": true, "hide_tag": false }, { "name": "njq8", "colour": "#641E80", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779556047, "uuid": "17ee5a45-20e2-48ed-a1e6-2976dbf8c9e7", "comment": "Malware payload", "value": "4e696d505e406a784eab993c378e6375f58b62d7a3965c71c61292a643ae18742e717d7208f5f80a5fca8225678b92ee", "object_relation": "sha3-384", "Tag": [ { "name": "Jenxcus", "colour": "#501935", "exportable": true, "hide_tag": false }, { "name": "njq8", "colour": "#641E80", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556047, "uuid": "a35c49b8-f89e-44bb-bb14-5dbc6e7f5b53", "value": "T10691A75BBA4585B5D26122013D17E44FCFD242D920256D8A3CACE4CB2F2D87C85AADBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556047, "uuid": "36a85187-bc31-4391-a545-75f3663f9c7c", "value": "96:pACRWUNxntS9ShAdUeH00j/uKpBkMZuwkcvUHA6/o6leFWegh83JP2IkUKBf4Z:zMUb8MOdLfkEYcvHAekegh7IkPBQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779556047, "uuid": "d5e0ad5e-fecd-4c2b-9459-7d7c59105dc6", "value": 4517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779556047, "uuid": "c9f59d79-14ae-49d6-9918-faac989e95eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779556047, "uuid": "92d70b72-938a-43a4-8833-1fb3a43053ae", "value": "Servieca.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682a9918-56df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779565295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565295, "uuid": "51763849-9012-4fdc-841a-451db383caa9", "comment": "Malware payload (Mirai)", "value": "6b0c365f3e074e67882ec907d37b88ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565295, "uuid": "b26ef9ff-ea12-4a50-8d78-3f7d6160f2a1", "comment": "Malware payload (Mirai)", "value": "dd2ff924a6dfa9cd98533fc5ec15d86066cf5a2e8478b634919b079abd96e258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565295, "uuid": "6d482457-9b6d-4b26-b4de-6a3021452be3", "comment": "Malware payload (Mirai)", "value": "fa65f03c467c381cb37da61541f557f1e0f6aa96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779565295, "uuid": "1e16d51b-4c40-48d4-8629-3e18d141066e", "comment": "Malware payload (Mirai)", "value": "17a222ce9782010eaede131bc199bf2322dddb290f57c3cb443259cdcbcc7910dd8c409918b99bea12489d469e1353d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565295, "uuid": "a525e2c2-c448-4025-aade-b9e2d23ea9f6", "value": "T1C8833A52BC816612CAC513B7FB1E018D372663F9D2EE32039E155F6173CA96F0E67A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565295, "uuid": "1c0dd013-d7b5-4fb9-951f-6fb1feeb0d84", "value": "1536:Zia8FCsySTnM6+bUYDjSrhEKH1aKBWHHc8xoDMIERFfxkuIBcm:ZiBFCsJnM3U8qa9HcOoD+Rzk7B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779565295, "uuid": "dbef1c4a-cd2a-49c6-a009-051c499edf20", "value": 87360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779565295, "uuid": "19302e8e-38ef-4a5f-8ffc-96690911d493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779565295, "uuid": "58b6b070-fa0d-45a6-bca2-0292dcbfcab1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738e6570-5676-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779520217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520217, "uuid": "aeb0567e-396f-4f09-8d8d-6e75c598e734", "comment": "Malware payload (Phorpiex)", "value": "39f9c9b08ac4c19dc392a07af8df6aac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520217, "uuid": "e3999c35-23c6-4074-8f8f-08d12ca5887a", "comment": "Malware payload (Phorpiex)", "value": "dfd123fca126907c0f99fc3f92636e1e0193970073145df46e82bf57d6cf6385", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520217, "uuid": "472dafdb-6c2a-4136-a604-a9b1d7cfc4fc", "comment": "Malware payload (Phorpiex)", "value": "8049f408c7dc01986585f8498e8b6c0c12cb52fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779520217, "uuid": "6f5c5155-d3ef-4aec-8d50-4812ff084969", "comment": "Malware payload (Phorpiex)", "value": "d6b8925db86c10b586589f1c173432b0c6cb3e47e0cb958d6bb3906a2367dff2c01e7df6df9bae1ae27250ca28b438b5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520217, "uuid": "6c399f3c-6834-470a-ab61-9e7bd07dc026", "value": "T1F9824B0FF9914216D1E100B05675863BDAB99C72338854EFFBD48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520217, "uuid": "c414650f-17be-49e8-889a-c8799a884aea", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520217, "uuid": "75955a7b-2484-4a2d-900c-d1e41013212d", "value": "384:5cIJlVYer7bskwAd0ZHu9JgiL7QWav8U9cV:Bgw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779520217, "uuid": "a33fe855-d9fe-4c17-a5f5-1ffc78aede87", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779520217, "uuid": "7e747b50-0559-43c7-8a17-129654aae247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779520217, "uuid": "b614b10d-f006-4642-914f-1f0d70a00478", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e577def7-5691-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779532004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532004, "uuid": "357d6864-bf99-468f-8bd6-e9947ac91a81", "comment": "Malware payload", "value": "8839d03e65820a6f744437f1aaaa8685", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532004, "uuid": "3e49c8aa-4567-4a2f-af77-a6ab2361191d", "comment": "Malware payload", "value": "e12be75313871e3bf1c947637807cd85d0eb208ed078dd5127d6a9266fcb9f28", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532004, "uuid": "698b23ff-d41f-40e9-9975-adab8222159a", "comment": "Malware payload", "value": "5622f0c857c62b3a63281d5e1c6c80e77fa86432", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779532004, "uuid": "50f71e64-6f1e-4720-8788-93573d46ce69", "comment": "Malware payload", "value": "794d9200e562ab673879bde1467e4bbe3a96492b3d7b7aec6735b5a342122f978eda890dc55b46e0ac37fba95d39ae9a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532004, "uuid": "3c7f512f-5a27-4e4e-944e-0db142d4cd06", "value": "T1DE217279092ADFC4D1872F7FE94AA8D2F2B1EEFB20E12A930C1D938859984D1C34311D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532004, "uuid": "1fcb5821-ce41-4951-9f8b-d896634f0602", "value": "24:91s1cRu2W32OCzGL27OCtbshEx2k4yfT3Zuf3gUD8mHZLnHwYXMOmG:90NCzjXJAEx2kXkoE/ZshG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779532004, "uuid": "69c17d92-29f0-4755-a65f-810d3a55ba02", "value": 1317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779532004, "uuid": "84af2b8d-cbf9-4916-8140-9e4e96066cb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779532004, "uuid": "6442ac42-19f2-48c7-98c7-3a9f57cf494b", "value": "\ud55c\uad6d\uc758 \uc0ac\uc6a9\ud6c4\ud575\uc5f0\ub8cc \uc800\uc7a5 \uc704\uae30\uc640 2030\ub144\uc758 \uacbd\uace0.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae46481-56dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779564574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564574, "uuid": "2a27a1ac-dc7b-415c-b85c-05482c656901", "comment": "Malware payload (Mirai)", "value": "572fe24d2e6d1483e43590657c122dac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564574, "uuid": "88cdc212-a129-4587-8c97-eefb70bdb97d", "comment": "Malware payload (Mirai)", "value": "e1b71b9e1b80115b05f44ef9ea4f872344b5ef0afd1ae1baea1f68b7b5539396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564574, "uuid": "552bf506-f3d8-4b5a-adaa-d13cd8bd3939", "comment": "Malware payload (Mirai)", "value": "e4596c42504b3c70fe95a2b53573af496e40a5e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564574, "uuid": "580cda6f-e590-44ed-9418-38739ce04f74", "comment": "Malware payload (Mirai)", "value": "2cf555098043e803d9bd271d891ed06ce1af20c21c5118095a1d6eb2ec347b9b1a462deed8d1a9517f359c3233782759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564574, "uuid": "05ce8758-7ae7-493f-8032-1ca79355bf8f", "value": "T142B3C60ABB610EF7ECEBDC378AE91705258C642A22A93F357534D828F14B58B19D3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564574, "uuid": "6448ece0-d7e9-4634-9ae1-eeebaccec77e", "value": "1536:v6U4qnQJyJhW/4/ZpIdU/GdclpCsJpoSJxmyw/TLM+0ZcuJ8xaMC8j:vX4qnQJykNU/GCar/TLH0JgBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779564574, "uuid": "618e3cd6-feee-4489-ac4c-3f8886ed8446", "value": 114300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779564574, "uuid": "16258b14-9a1d-46ca-9406-86d3ff2e8d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564574, "uuid": "6e81e676-e4a7-4f20-857f-515f8aba355d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49e6e5d-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544485, "uuid": "e8f2f21a-feed-4549-9f3b-297c67f4ed5e", "comment": "Malware payload (Mirai)", "value": "c7425986d4f041589e1bea4a1eec19ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544485, "uuid": "837da84b-798e-4d6f-99aa-998266866ea6", "comment": "Malware payload (Mirai)", "value": "e1fee5835ca9417ee4187916dd73346ad8d35e346cb33a4e6465b1f43fb8445c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544485, "uuid": "f88790f7-f644-4d7f-b0f3-a7953176823e", "comment": "Malware payload (Mirai)", "value": "1f11814cd8158e4c409d48d7425abab8fc114bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544485, "uuid": "894a861d-bd89-47b2-bdcf-4ce3511482d7", "comment": "Malware payload (Mirai)", "value": "babf749dd36afb9ec80d531573d4cceba5a341e4bf133989908236c50368997f30177367a705c8d0c85d06265efbf3db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544485, "uuid": "9907e64c-3c84-4593-8899-a828103f04a6", "value": "T1F9B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544485, "uuid": "ec38fde1-f6aa-4549-843f-df0e50fc2140", "value": "3072:Ddub7djS5HECEfBjmThRhFczcmVRh865xf:Ddo7djS5ECtTozcmVRbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544485, "uuid": "bdfcbcd0-0c33-458b-b925-af77fd68b443", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544485, "uuid": "9563a2d6-4b27-4bfc-a9fa-95d808069b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544485, "uuid": "6b544af1-7aff-4f22-92aa-da610f61142b", "value": "luxzz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd669c4-56c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779554489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554489, "uuid": "70bec553-5ab5-45e1-bdcd-8dbf929926ad", "comment": "Malware payload", "value": "337d7d422b721273df5dca2e8516b106", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554489, "uuid": "163c21a1-1582-4cca-9515-322af8f3a302", "comment": "Malware payload", "value": "e23ecd969668eb5376d7678e20535854aa7bad14cd84e2b6506cc9d3d1b8c291", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554489, "uuid": "803e574b-10a5-46f6-9df3-acf919b85a34", "comment": "Malware payload", "value": "daf59c0f7a027586d67b5399cfe7fbe91f1f24fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779554489, "uuid": "0e1620fb-0123-4a82-812e-7ad55a06c502", "comment": "Malware payload", "value": "5378ea8ec6704c28f5b72dd91423410741fe0ef5a00e6611dad30e6fd3352e0bc8c6859f77e79b0f98a5f129ffb6c060", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554489, "uuid": "850bb738-25f4-47b0-a01a-a9daa293749a", "value": "T1DD56123FB28B653EE16A5A367AB2A210583B7A5064134C56D7F4C88CCF261701E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554489, "uuid": "bddc61d4-7715-4440-b439-41d9a39e2812", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554489, "uuid": "f6eac687-f1ba-4cf2-a991-3c197a7a79e0", "value": "98304:Y5OQuUrS84INlzIsMvnvLW3AMmGrZySWzYk9pbblk9Nr/TTg64opZSIyfQ:8rjlssMa3AtYulkfeop4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779554489, "uuid": "68698307-4924-423a-9b9a-d442482cdf83", "value": 6263546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779554489, "uuid": "fe78c888-7890-445b-9f30-34012313a06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779554489, "uuid": "c549e8ee-3c22-452e-ade0-15b2dcd6a5d9", "value": "RuDNS_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b9ec0d-56a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1779540168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540168, "uuid": "b272fc73-d2e7-4633-85d4-29b943ab5963", "comment": "Malware payload (Stealc)", "value": "f45388c0f98f3c253f387f42be951841", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540168, "uuid": "78d6710b-9e24-4c9e-bf2a-28245a371038", "comment": "Malware payload (Stealc)", "value": "e379aadf3cc399db7c0532986c35aab69533d66e39606ed3e92c069aecd2ace5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540168, "uuid": "af38903e-fda7-4e6e-be02-59f6e61ee742", "comment": "Malware payload (Stealc)", "value": "66a933430fc5955841008f1f038d5515584d6eda", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540168, "uuid": "2243ca08-678f-4c69-8f0c-6040deb0cb88", "comment": "Malware payload (Stealc)", "value": "d9bdd54879d9316a3616ccb5e5ee77bff49eb967462d2b063159ba1f68ed8cf9e144da5fd37ab4a6216e29eff0f5795e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540168, "uuid": "89c9242f-3b71-4aa8-af4e-846f3d7a8a9d", "value": "T19085290BBC9549FAC4AA92318D7661927B71BC490F3163D72E90B37C2F726E0ADB4744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540168, "uuid": "92779c92-385c-4744-bea6-bdd18bd0d6a3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540168, "uuid": "20de1996-c70a-4402-ac9e-50d4ebec93ec", "value": "24576:++dBbmhhhsZ7S6z+N6bpUzlBeleX7KDg7tMdc9S:++jahhCSTN6wXrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540168, "uuid": "1dc8492c-0160-46fc-8cf3-fb998eeec5d6", "value": 1727488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540168, "uuid": "8900daf4-3df3-42ce-9304-4b9760162812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540168, "uuid": "f9511345-1f27-4117-9d5c-0cc0a4d8c5c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cea15f-56b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779545348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545348, "uuid": "f3d9f473-a7d0-475d-acbb-1e2f10d79413", "comment": "Malware payload", "value": "99fd4cb74279b10eab1610babf82091a", "object_relation": "md5", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545348, "uuid": "80b128fb-c0be-402e-975f-aa8ebd570fa0", "comment": "Malware payload", "value": "e58ddbc603a854788bd0c199e232d64c28aea44782a8fd51d17cd7e1f5cb7a04", "object_relation": "sha256", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545348, "uuid": "7064726b-6602-45f5-91b1-bd627a4b69b4", "comment": "Malware payload", "value": "e9e10d30f86abe299e0f389d3d84ebfd3859c58b", "object_relation": "sha1", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779545348, "uuid": "51b7f1e6-597c-4dac-970e-69423ed6f55e", "comment": "Malware payload", "value": "d8f5ba92cdb1447263629c3ecbdccefea931b09492f1bc056dfbab2ab543328df8b41c8db7c61a74260102bdf0b1d9d6", "object_relation": "sha3-384", "Tag": [ { "name": "22x05x2026", "colour": "#13638F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545348, "uuid": "e771ff44-b41c-4a93-9679-564681c9565b", "value": "T1C7447C05B7A80CFDED7B853DC9524906DB727C560760EACF07A04A965F236E09E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545348, "uuid": "978b82da-cf1a-4270-8a4f-b9f73c22ad6a", "value": "a19678b109cb919b23e4e58e694a315a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545348, "uuid": "441e9734-e295-46ce-bd39-c1ebd7837f4f", "value": "3072:uU+vyj8GlM3hjRsROFoc6QFbl4Zxznjsx1XNyyRTvzKY7y1HGL5cTfixAZh:uU2yj8yMRNsRrt2J4Zcl5vbkmLa0AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779545348, "uuid": "bde2649b-9130-44a7-b38d-606423a4b284", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779545348, "uuid": "a1b2c93b-b98c-43e4-8605-48b66f662a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779545348, "uuid": "6102b69e-f0aa-440b-a2e3-c8001d81eef5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711222be-56a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779540828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540828, "uuid": "85aad9c2-7a00-4d69-8db3-fac2ba591a37", "comment": "Malware payload (Mirai)", "value": "895fced637d0d5698fc8f9d2159c397c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540828, "uuid": "c970de4a-3cfc-4b94-8abd-cb605437f782", "comment": "Malware payload (Mirai)", "value": "e7e1cd1dd37c99c5b1f5b0fd5942746d78290c1ae2c9c3a03cb0f8e91fd499f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540828, "uuid": "19860e86-a230-495c-bd38-3300c72abb24", "comment": "Malware payload (Mirai)", "value": "491469dd19ad19eb1af53d9618a61a079618e9f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779540828, "uuid": "54b40776-3d39-428e-8293-144ffde0b4ca", "comment": "Malware payload (Mirai)", "value": "43e5ecf2bf23ad50219863e6aa4842359f705b21540e8ea89d0e778805d68f88663419ca255eaf6e6e1ebdb136e8bd9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540828, "uuid": "b596bae0-6ecd-4b0e-9e8f-8cd63ffc914a", "value": "T148B3C65E6E228FBDF7A9833897B78E31A25833D627D1C685D1ACD2001E6024D641FFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540828, "uuid": "f2ad39f7-61b2-40c1-a69e-70e5a3895778", "value": "1536:K4TBR9rEWi92GNs5fmVt6L4UhwSoNwEzDvVl+Qbc42XTeYWVj5:bTKWio15fmFXSoNwEz+QbV2XCVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779540828, "uuid": "f8e98465-903c-4e2f-9114-a302da1d04dc", "value": 109028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779540828, "uuid": "1005f17d-97ed-414a-a180-eac3b33e8020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779540828, "uuid": "28cc990d-7e58-46b1-8b9e-93b1509a943e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e1c33e-56e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779567787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567787, "uuid": "153b6b27-76b8-4530-a931-246f2b893ac1", "comment": "Malware payload", "value": "d17b80f983fb1f0a49ed939c34526971", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567787, "uuid": "f88944b6-18e1-4db4-9b95-3aea22d28c7a", "comment": "Malware payload", "value": "e8124a63346fabf2fffc19d247646de48e8c2e829edf7ef1297f53b40c3268a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567787, "uuid": "b879b440-c43c-4ef3-b432-168a6239275b", "comment": "Malware payload", "value": "a8e41e2bffb58d52aedbad002e2beb283af9af81", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567787, "uuid": "cf94bca3-e807-450d-afb8-32b2d3f207a6", "comment": "Malware payload", "value": "1785c5e8d25aabdf8cbff3491a20cb9dd3bdfa3fa734c2d65c4a1cea78ad71a4d08763c857bb1479b824fd9741383d12", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567787, "uuid": "e331f69e-512a-4bbc-ab09-da5f1eccb49f", "value": "T13073F7B9F1A171325B23F970412F500FBA3B646BE84C0DA8F254D8F06EF69894467F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567787, "uuid": "266590eb-b6db-44a5-802b-ec057f5d18c5", "value": "1536:TKoJP+Sq8Gc1o8iFFVuvXg+7Oqt4qudtQ+CjKZ:fxmFFsg+7Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779567787, "uuid": "0831c5e9-2006-480e-9383-ae18fecab5b8", "value": 79968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779567787, "uuid": "3d97295c-f547-4c16-bfe0-7acb4d55fed5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567787, "uuid": "de6a651d-4e13-4be5-b4af-a33411d3b7d9", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e30854b-5646-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779499672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499672, "uuid": "c93d58ae-ecc1-4291-bbe4-e90edcf7ad6b", "comment": "Malware payload", "value": "ae5debbee1b5309b68722a855a9f62be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499672, "uuid": "9e2f9286-6143-495a-9069-bcfb0d0e49a4", "comment": "Malware payload", "value": "e82d0ea97861fe4efc9721ae95146aa14b2393a7b66110a4299e20b229d565d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499672, "uuid": "8be60985-5d79-4794-ade4-cf84af348bf9", "comment": "Malware payload", "value": "3c3e64c6561bbf83097a659a226c7b0909cf7593", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779499672, "uuid": "377c6b4b-330f-447f-83c9-c3a3126ae558", "comment": "Malware payload", "value": "b733e032c87412da2214f9940217599f090d248034dfd54878307bb5d5218b3075ef31944500e28e44f9dce42b5d0be8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779499672, "uuid": "94dba0ec-ce74-4698-9c43-4226ad5bd090", "value": "T1A5E0CD964573C0F64C6A4C20E0B33C10E21F643AEF3081346E0395736A8B506B8698A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779499672, "uuid": "d7375ad0-0bf5-4c07-ab4f-c1c620b23d76", "value": "6:h2K6PqhwQLy4IHphUOzNXsmIqwX6JD7m+bg6KNXYaF:4Psy4sphD1wXiDqiKiaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779499672, "uuid": "faa3a4a0-75fa-40a0-bfc5-65bbb7d5422c", "value": 311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779499672, "uuid": "1a7b53d1-bace-4496-99f3-9c8d9ee4207e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779499672, "uuid": "680482e8-0fad-4341-a9fc-ecac7f33d244", "value": "wwg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a31b23-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1779537693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537693, "uuid": "2f56da5b-80ba-4e18-b087-282672cdc9cb", "comment": "Malware payload (Amadey)", "value": "6b98ef2446a90653319c167515d85f13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537693, "uuid": "174c8d5f-af90-4b20-bef2-7a957a2bd526", "comment": "Malware payload (Amadey)", "value": "e8b4f2da647430a1c5d6b90fa135e0c61a53888955bba40fba9a8e0fdf03de75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537693, "uuid": "adfb306d-0043-4dc6-b3ab-0ce4ef25a75f", "comment": "Malware payload (Amadey)", "value": "44088543ac0c5f2f60d90fb1a092e56fbb6a887b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537693, "uuid": "915d9037-b408-4a45-bdf6-6a404936950b", "comment": "Malware payload (Amadey)", "value": "baeef88e62301f652eaa351367c1ea29e8f594a2dd5a458e5790947b138e4ade40cebcab38a58477c0cd3df94edc304e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537693, "uuid": "0f5e13b0-0aae-4ff9-8239-36366a649a06", "value": "T1CA94238D7FEBDC5AD9E0863DF63256BE74024120F7907566EC0B4E240B732DB87A9612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537693, "uuid": "9697a444-fe6d-43b5-957e-787910c1227b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537693, "uuid": "06f6bd73-b05b-4f6d-bfcb-9686faebddb7", "value": "6144:hJf3I5HrygJGDQEaluSrieRY0s4ou/S6nDO5jbjojnwz0J5yf7qRS:Lw5uUEUuSrfm4otoO5jbjoje0J5k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537693, "uuid": "2d16a260-5c48-4922-b8fa-4aa5ccbd9595", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537693, "uuid": "5b532648-f282-434b-b58e-f5629e67502e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537693, "uuid": "008602f2-4a74-41c2-8233-4b6cf9971dac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c844deaa-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544410, "uuid": "2d579f22-4778-48a4-8f39-51b5323d14c2", "comment": "Malware payload (Mirai)", "value": "e85eb1c3b691f92f7cd33ae106f4351a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544410, "uuid": "8d8eda95-0e23-4525-82e0-97ff8175a6fa", "comment": "Malware payload (Mirai)", "value": "e90bf77107275cf9e998b408da2634b6f3267aa4d04be7e48c4be9bf4b276ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544410, "uuid": "c4d5a672-57c6-4575-95ea-25cdd7aa4067", "comment": "Malware payload (Mirai)", "value": "c3af6ddeda7fcd82e9737ea14620561c8d8d7b38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544410, "uuid": "d2ee2821-0d16-40cb-b92e-9acf4bf8a371", "comment": "Malware payload (Mirai)", "value": "ccf87073fb25ea874bb79de85b23ab5c234d6048ddf089436109fa3c8281390908f954fdd1bfbc44f7531bb20316e546", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544410, "uuid": "5c1f7ae1-b395-4ada-b870-5d1eb98eb6f6", "value": "T14A73126A3274E999FB270E74E02F1D016ADE04D0612F4593F913060EC5BE5986DBBCE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544410, "uuid": "55798f28-a8dd-4d83-a795-3c5e7a49eb09", "value": "1536:7t/57cJDRHxMrp8aY9l8G+m6mwOEE9e5SZ9YYtr02Sh:pxkRRMrp8aY9M9mFEEeYm2Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544410, "uuid": "e33f0393-c1e2-4aff-8625-19642edfb098", "value": 77588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544410, "uuid": "5418caac-ddf0-4001-a60c-08ebcc379fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544410, "uuid": "66aa5529-4a22-4f5b-b0bf-f61a511044c4", "value": "luxzz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b0fc5-569f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779537819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537819, "uuid": "dc340d4a-ba20-4ce8-be9a-6dba8f8f5eef", "comment": "Malware payload (AsyncRAT)", "value": "7900fa03108a0ba60d4f07618b42f24f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537819, "uuid": "91620349-1c70-4f80-b8be-a2891ea074ee", "comment": "Malware payload (AsyncRAT)", "value": "ea54271db6fbfe6616049dc6855a18bf4a957ea9156502e65766782159f92ead", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537819, "uuid": "d2aaf4f6-0607-49b2-904d-8f6a62bf98da", "comment": "Malware payload (AsyncRAT)", "value": "2f3a8b55c818a4d8962cce0451d18fc3f766af97", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779537819, "uuid": "b11ea2cd-dc2d-4c80-b5a7-57f45427db39", "comment": "Malware payload (AsyncRAT)", "value": "c26f790b9523a426ced5d25234f4a83e6a0b8dee35b0b9ce5f6f151c95ef7b6f3f2cbbd95ce563acb32d67b6673740cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537819, "uuid": "f4056a3e-8a80-4a52-b150-b175942cca19", "value": "T1AA233D003BDC8136E1BE4F789DF62242867AE6633607D55A3CC841DA4B237C7DA51AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537819, "uuid": "f88b3f46-948c-488a-9037-325992a9c5c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537819, "uuid": "d483de63-902b-4d4c-a8ea-e5ef1d0f86ac", "value": "1536:SJw58pvQmfrlm6IbESsJIlxjzDvW6O0KmVcl:StxfrlKbEbJwDOIK8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779537819, "uuid": "75732320-a7d3-4124-aff3-ac66af9c7c68", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779537819, "uuid": "611595b0-c3da-47a4-9eb5-6d56defd4613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779537819, "uuid": "7720ab97-977e-45b4-be1c-f9197c963d80", "value": "NhoEm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7deb4af5-56e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779567908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567908, "uuid": "31ed8357-226e-4945-a163-52334514fc28", "comment": "Malware payload", "value": "a823f4571fa3912c24f948db1f8bcad2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567908, "uuid": "59e0ec20-a369-4099-a46f-48da17c3e4f1", "comment": "Malware payload", "value": "ea5bcca26eeb770be418805e94b30ad1237ebb1f9ce48bab158bf0dfb3b8f81a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567908, "uuid": "493f70ae-ea9c-41fd-ab51-60bec01fa054", "comment": "Malware payload", "value": "bbb36dd5b9de5df55b3523c26ee9703a02144601", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779567908, "uuid": "71d17b0f-b02a-4b24-833e-91d6cafccda0", "comment": "Malware payload", "value": "f3cca636ea435a193cee661e35253890d0040fb6d1b31618cdf3a27754c95a7c40f9bb63f1d46a210247aeb5d82c5ea4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567908, "uuid": "59d8bb76-60cc-4e3d-934f-4de532a1dd6c", "value": "T1A7E6235696D9A3E8C4C34A44A58B02CF34D1765E86EF4C2D36CF6C027621DAB818EF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567908, "uuid": "1ed71a45-156e-4353-acc4-377c9db088ec", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567908, "uuid": "2846ebb9-d255-44d2-afa8-c40d42026851", "value": "196608:J3oXNfUKF3jo9/2IpiHgo+rqW+g6Il+vjGZF6nBNPE9TwFJ944jDz5tP98Ehk3mv:xohFz42KiHgoIX+4l+vK76BuK3Z98Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779567908, "uuid": "65a33555-08a1-421e-b09c-25a5f48ec18c", "value": 14012416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779567908, "uuid": "ad76d950-f494-4d7d-9355-f52fa024ce3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779567908, "uuid": "c2fb2a7b-863a-4137-99c3-33c304f96f21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd79e16f-56bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779551801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551801, "uuid": "42914816-57bc-419c-b81b-14ff13f02144", "comment": "Malware payload", "value": "e0e77f9c8ba4153f5546ab5ba61e22cd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551801, "uuid": "e309d29a-3c97-43c5-a872-987bfb5f44a6", "comment": "Malware payload", "value": "eb2e7607bd1b290444a5a1aa6362b97669f70b0a2452f311698d6c5baa0014d2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551801, "uuid": "2191c56f-3871-4c02-a259-d5a02335c51c", "comment": "Malware payload", "value": "611f3fe427f83fd77612bd17b3aed28b29290af1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551801, "uuid": "a0db7492-db61-4d66-ac06-06b7cee6a6f6", "comment": "Malware payload", "value": "9a87dfecc158c8bcc03f6847270d8b9928ee0985059fadd031cb3869711792ad5482060070215aeed337ebf9005911d5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "TCLBanker", "colour": "#D89475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551801, "uuid": "9e49a1fa-04fe-4678-be5e-79cad48ba398", "value": "T11B373312A7CBC525C65D017BE968FE1F093ABD67433081E376F5397A58F48C1A2BDA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551801, "uuid": "027bc685-4a7d-410d-990e-4ab83164ad4e", "value": "393216:G2o1wYwN/eixCpRLIxFx6fKp2WkSHFrpf96+WhN07Tfd6dJ7dg1qRlBKX57KWG7m:GtwYwZxuVwTxpf9YN07TV6dtdg1KoX56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551801, "uuid": "637105c2-a204-4775-a65a-6071cd8bd402", "value": 24457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551801, "uuid": "02e81ee9-6162-4c22-915f-10bbfe117b02", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551801, "uuid": "21c39e36-641a-472d-8de0-ab5d068e6b96", "value": "id_lcdzp_21042026-181516.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce77f1d7-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544421, "uuid": "2abd0eaa-14a1-413b-bcdd-90ceab9c7c4a", "comment": "Malware payload (Mirai)", "value": "e2132b4f5f85cc2b830219e13a82c85b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544421, "uuid": "332c6f53-38b6-4c83-abdc-927bd78a1719", "comment": "Malware payload (Mirai)", "value": "edc05ae1f7041b97885f6ef49c9aca60e93047dd49729d8896d64093da7f09b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544421, "uuid": "8ac8ac82-3fd5-4d3a-9fb3-b9e9218b23e9", "comment": "Malware payload (Mirai)", "value": "e8b7c556800e1820ae4b8bcfd658f7bba767e434", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544421, "uuid": "3f30d84c-4dd7-47d3-941f-e5b370be6b1e", "comment": "Malware payload (Mirai)", "value": "1e4d564a36e29ae9fdd31642d2e8ca79c027b807f9429f9cb441a8c66e54288da1fec9b101bea40c22d25168742007a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544421, "uuid": "a5c8b14b-3bd3-4ed3-880e-b3ac8ff63242", "value": "T1DA9318C6B401DC7DF80FDABB4463290EB630E36156835B26675BBE53AD721E05923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544421, "uuid": "4c2c2900-3c8b-4942-b6f3-08ab7f27ab8f", "value": "1536:psdLEbXJld35is6pRA7O6X7FJXee9FW2edNP/8b47e1ov5TaCkg0zjX9JK1Cm1ka:pDiPpAO6X7Nw2ed1nqeTadgqGCm1HqYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544421, "uuid": "ddee3a1f-fbdb-4226-9476-e40b0191c404", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544421, "uuid": "fc9928fa-1afe-4e04-adc8-02f24ebf2252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544421, "uuid": "9084a69f-620f-43ae-9fe7-10b620452b9f", "value": "luxzz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a43981-566f-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779517286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517286, "uuid": "f503bbfd-555b-49e8-851d-e86776c3ca15", "comment": "Malware payload (Phorpiex)", "value": "03791ffa5595ac9ebd90adeb19022688", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517286, "uuid": "679f12f8-b484-45de-9352-21d267bff9da", "comment": "Malware payload (Phorpiex)", "value": "ee395ed00a1a0f671da1bab65b95513e812b7132878e4894adeeeded76c99f88", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517286, "uuid": "e6fe519c-c0e3-4159-aea9-1bd02f3c54bc", "comment": "Malware payload (Phorpiex)", "value": "03ac7c0b47f180b094b3e16bb3fbd2371a77c54a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517286, "uuid": "03a78c66-4836-417b-81f9-e8142af1190b", "comment": "Malware payload (Phorpiex)", "value": "18d9bd7642c2f10bf0f37379ad4c7394b707ea522cdb5a3166ae8f1517f9bc735e43ea0d50f255ae19aed68c57b02a9a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517286, "uuid": "e7ba3d5a-ae0d-4ab8-8e64-56ba35a5a014", "value": "T1CB824B0FF9814216D1E110B05675863BDAB99C72338454EFF7D48A990BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517286, "uuid": "0c96851d-4cf7-4ce6-8ce6-91af32847b57", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517286, "uuid": "d966bcad-eb70-4b4e-8380-b1ff7f1e6f1b", "value": "384:WbIJlVYer7bskwEd0ZHu9JgiL7QWav8U9cM:tg80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779517286, "uuid": "7d6edc52-93a9-41a2-a226-5ca3c37f9cce", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779517286, "uuid": "e8df9be2-06ce-4f18-be0e-f18f8bcf2a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517286, "uuid": "64feb446-fa34-442e-b4b1-c51601be49df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0bf7fe-56c4-11f1-a769-42010a9c0008", "comment": "Malware payload (PurpleFox)", "timestamp": 1779553710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553710, "uuid": "1b06b57f-9c5e-488b-9bbf-5be09cb06d40", "comment": "Malware payload (PurpleFox)", "value": "1670149779fbfd70256eb78c9451561b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553710, "uuid": "fd4ceac3-1d25-4e38-bf53-e6940dd839fb", "comment": "Malware payload (PurpleFox)", "value": "ee39f1387ecff828c7f30afd01eae3bca27727f804a4167e91a9c841d1790cb2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553710, "uuid": "83a42713-6186-4512-a774-d0f3d690936e", "comment": "Malware payload (PurpleFox)", "value": "f2e38d7c544941188b79011236e01bfb12746021", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553710, "uuid": "e6f091a3-9a33-47f5-9555-8d1a4681958b", "comment": "Malware payload (PurpleFox)", "value": "664a83708dcc0733d64d56b04d1dd4c3c9a1b7dbecbd64e66ea816e23e6a32c0980c7a86674307bf6014ec74ea94f056", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553710, "uuid": "cfa8b68d-f67f-4ff6-9a84-c30a211a1cff", "value": "T195F5330D750D437EC92BA0B3825EF6565B01AF9908029E1D723EF268737EAF611D2DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553710, "uuid": "75cb9237-5b53-4149-9e90-d863d4285fb2", "value": "49152:JEL2PO/pZHYY2br1LjHvYT+EIjI+eaqG1CSauzZUtfSI6/wQlP:02PO/pZb2brpYKF0+eaaqStErl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779553710, "uuid": "331bc6e2-5ef2-470b-9e15-c3da213d4120", "value": 3362816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779553710, "uuid": "e36fdccf-d692-468f-a075-738c5afb15f0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553710, "uuid": "bf0d0796-5b29-434d-8fff-7634acacda03", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u8bed\u8a00\u5305l.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32e2b8b-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544482, "uuid": "fba8dee0-309f-4598-8b50-66b2e1d0c71a", "comment": "Malware payload (Mirai)", "value": "1cddbb29df7912347f9209d0ef85a4c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544482, "uuid": "6376292b-c9e7-4807-b1b9-a2255fef92b3", "comment": "Malware payload (Mirai)", "value": "ee8b5582654477c385e600992313177c6d6d7a4f0c61ddb65dd90989fbc7b5fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544482, "uuid": "878fd258-5525-411e-9200-960c6663b88d", "comment": "Malware payload (Mirai)", "value": "3b20ab7d018448eb250a50f153ff34cd87ad9b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544482, "uuid": "fdc1e078-3e45-46ab-ae1d-d845ddd937a2", "comment": "Malware payload (Mirai)", "value": "53ee31dee728a461e25c16191977d99a134ab895d59cfc2ee37dda2f235a056b7849bffa1f2a5a9951b8bb6888cdb769", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544482, "uuid": "1dbf8374-e73a-406c-9e5f-974d0c8859e9", "value": "T14AA32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF2173865EB0E7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544482, "uuid": "56ea0bb1-d595-4072-bde8-5ced37511719", "value": "1536:wAnTSlO27kf5J7ZLBpqpp8GBgcQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWu6:ilRbpp8nuik7uaRgp2x/F8ThULu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544482, "uuid": "d3045ffc-e681-47a2-bb14-27892f967bd6", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544482, "uuid": "8ca8f74e-a364-41aa-abc5-cb87c835041b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544482, "uuid": "3e713a20-cc1c-4349-88bc-c8fd66625cee", "value": "luxzz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c339d5-566f-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779517289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517289, "uuid": "691ed40d-30b9-4d74-b7c7-ae799c56b568", "comment": "Malware payload (Phorpiex)", "value": "18b238ddf56cc4aeca9b59e7b9012bc9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517289, "uuid": "246878b0-d3fa-4f6f-9d05-6cbb7f09fcb0", "comment": "Malware payload (Phorpiex)", "value": "ee9b8dd893db93d08c53b700f6b2b7fdeb06801522ff9aa71400b8fb92c68dd9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517289, "uuid": "ada24ec3-bd0f-4b08-a469-6064ab1c49b2", "comment": "Malware payload (Phorpiex)", "value": "315c68e26ab7196e51318379f293085d4b6461af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779517289, "uuid": "b0ed381a-75c3-4e50-86c5-5737f10b407d", "comment": "Malware payload (Phorpiex)", "value": "415de650b7abd9fe84eb94157e2ed413028b1e2f41197a0b59a2afc5f34884966648a8ea24282fde752b9d006e11b943", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517289, "uuid": "3f80bc98-d278-4395-be47-79c9f8123ef8", "value": "T16A824B0FF981421AD1E110B05675863BDAB99C72338454EFF7D48A990BAC6E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517289, "uuid": "feb33550-703b-4c8c-8246-eab3fa8a98f5", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517289, "uuid": "2a54638e-3a46-45cf-be83-b362c3778308", "value": "384:glIJlVYer7bskwEd0ZHu9JgiL7QWav8U9cx:xg80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779517289, "uuid": "97ce2118-2cae-485c-bbeb-550c66264e50", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779517289, "uuid": "029adab5-2eb4-40c6-8428-158ab0f8668b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779517289, "uuid": "cd988337-0413-42f3-ab1f-a80acf0f6e54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8a08a9-5700-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779579584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579584, "uuid": "6c108e58-713c-458c-8814-45da1a96320f", "comment": "Malware payload (Mirai)", "value": "a8c4390c5737ad176857be0dbc2da53f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579584, "uuid": "eec56d1a-2f83-4865-8815-4b00e3b00267", "comment": "Malware payload (Mirai)", "value": "eee66287d3548f8f8186e31dd53d6e7844e0cae01378b6ae919291d75ff48f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579584, "uuid": "562a64f9-9c3e-4a2d-8a7d-c933a4dd95c7", "comment": "Malware payload (Mirai)", "value": "5c9d54f1564669e1516578cdca2e863bcecc73d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779579584, "uuid": "d0d8f98a-8602-4fb6-9b0d-afdff7bb4d0e", "comment": "Malware payload (Mirai)", "value": "e5267fd77a78f09bfa9a7947f8038821ab0c5fd738e7eb320347708c91a0805faf5f2e5249a194458367907ba9973629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579584, "uuid": "7fc45383-735f-4f1f-805a-16d159f0c367", "value": "T1BCB33B376251C97AC08356F426EBC5729D13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579584, "uuid": "7a823be4-9742-40ab-b301-61b854da4060", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAK+TRCm7FnVqfJXFWbNb:T9a2aLqkrMFsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779579584, "uuid": "2ada076c-3767-4c88-adbd-b310e2a59be6", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779579584, "uuid": "0c71c11d-7e8d-406d-b15f-08416d016be1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779579584, "uuid": "fbd47fc4-4d45-4ea8-80c0-e8fe9b234be9", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9cdee2-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497044, "uuid": "eb89b657-1027-44d5-bc2b-1eabec53913f", "comment": "Malware payload", "value": "8f90328fd6c49d72efe2197d87118b2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497044, "uuid": "a125fd0c-5d55-43d6-b0cb-b25d1a176c8c", "comment": "Malware payload", "value": "ef854e9a3d452596ee48cfd60d595cf1e4223e5744032d77a2ca1ae72bdbbbcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497044, "uuid": "785f5190-3498-4617-b6cf-8bc8393d7e3a", "comment": "Malware payload", "value": "ce96228cdd0fe4f56b5343e5489fab5ec04e3ab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497044, "uuid": "35e940c9-2994-47f0-bfd8-23165a868f1c", "comment": "Malware payload", "value": "03b0c1f325c1a9fc72c090b07e4465c59891aeaf1ca498bce249bf95f0364f6c433a46107e68cb64716015b569202b9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497044, "uuid": "af697187-908b-4eb6-ad43-b8e492f0d2e7", "value": "T10935011AFA1181B5D5B3A4B1170FD7B6C83062305123899BFF5E1D68A63A7C09F2D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497044, "uuid": "3d6815e8-6325-4bdb-917d-84eee88c78e2", "value": "24576:CleCnrFRcFQJPTECJQiL+SanlpJ/ILRZvfhUmiism75/07K58JGXUduNjUc:CleCrFRcFpCR6LNwLfK5iDl07BGkKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497044, "uuid": "0cd14250-691a-446a-8c40-fbb2c6e5955d", "value": 1140081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497044, "uuid": "4c817276-f3ee-40c6-9379-9fdb3b3972b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497044, "uuid": "a82b68d9-7de2-4144-ba9f-2d3ea19345c6", "value": "jdruzjv.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b4b90f-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551867, "uuid": "d201cfaf-571a-4dd6-9795-e2a465746fb0", "comment": "Malware payload (Mirai)", "value": "a133d265bf4c3bd2263057719c375212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551867, "uuid": "2d0bf5ca-25b0-47de-b6f8-8e8dd9baccf4", "comment": "Malware payload (Mirai)", "value": "f064ae6bb70f37ee46a2e756f2f9b8e2ab7ff6fcfc398b2304ade3895e6f6b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551867, "uuid": "1e2fc83a-c267-4960-bcac-a07b9e81c795", "comment": "Malware payload (Mirai)", "value": "f948e6b451225973f41b2fd5ec89f955bce27843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551867, "uuid": "4cabe64f-4b0f-4852-ba1d-70c8d62c04a1", "comment": "Malware payload (Mirai)", "value": "be81272185eb9b3c0ff84608736628689b1cb4afde6d38e0d0dc45d24cbcf2c4a8826ba936b3eba0919a8c309c2ac0ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551867, "uuid": "657fd4bc-ec41-4b5f-b4c3-2c3e94b8d656", "value": "T19746FA15AC843BE7C02C9B7494EACE5623745D144AF24A362694FFACBC762387F4789C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551867, "uuid": "c0f7d430-2af1-40cb-be5b-28a56117b40d", "value": "24576:MZd8DI+mz9x9sx5Rxprkglm1R1Q0UDAnG6Xi2NWdK7lHsI2SbbSKD0HpiKiEfdiN:TxxYUUbKYJL6nGaj2buvKDLrIjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551867, "uuid": "ce337611-8736-43a5-85bf-83689fcf92c5", "value": 5570743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551867, "uuid": "20165f21-74be-4b2b-b5fd-13a0b2ca62fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551867, "uuid": "bfd57b09-56a4-42dc-bd8f-7f28b26499e3", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97051d8c-56c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779553777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553777, "uuid": "7091215a-f59e-401c-97c7-d4cff07ae779", "comment": "Malware payload", "value": "da83a95776f8aeedc13e1324b135c549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553777, "uuid": "ea8288fc-c1ea-41f9-82a5-77d69a07fb23", "comment": "Malware payload", "value": "f0cd011c32b524599810e6f3d8f93b77dd8d0f36d2fd85cb0e2bad7f5487b0a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553777, "uuid": "f8c09496-55c1-4e2e-8871-8a4be7637811", "comment": "Malware payload", "value": "75bb1f6b2a8bc0d53781c4573f4a8e54d1fd1ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779553777, "uuid": "c960cea8-c2d9-4681-8ca6-8bd2022f5d49", "comment": "Malware payload", "value": "b4e90bf468bbc10bae0e984078541c13140aff4bdcc111fe363324e15e64ceb187c155feb905442378353d95d8e860d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553777, "uuid": "8089e2e7-d19f-40cc-8d2c-9d687b8dd95f", "value": "T17E957C06B66541FCC09BD278C61A5657E7B17C86172097CF1290BAA62F73BE21F7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553777, "uuid": "0480ec49-6cb8-4eac-be1a-e681e74f7c43", "value": "49ea913537e8846d169d32fce7302ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553777, "uuid": "4e7b463b-c613-4c29-8824-c7fd46164227", "value": "49152:E/7E4O8OBQOH7D1dCKAJg6PwcVPPbL7MyT3:EAJ9Sgcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779553777, "uuid": "8791bec3-e24f-467c-a7a5-0d40858b271f", "value": 1951840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779553777, "uuid": "e0dc548d-1e13-448c-b267-eff4535c2fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779553777, "uuid": "e3de7ce3-0839-4777-980a-0e30a68c4fe4", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u53051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc93628-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497037, "uuid": "dde82a7f-de6f-47d5-9f86-d5b4d6462ae6", "comment": "Malware payload", "value": "becb188b716783b88a221ad30ff97795", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497037, "uuid": "6a645af9-5ec5-42f2-aa88-036d2d771193", "comment": "Malware payload", "value": "f0f33fed457fb3547e9a2f2a913a611299c5efa7efbba696d9bd00a01bcb1084", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497037, "uuid": "c475b842-be61-4d30-9dee-ab44c061b3a2", "comment": "Malware payload", "value": "d6c881918b11fe237972643efc0707f10adacb44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497037, "uuid": "9df6364e-cedf-4268-acd5-0a40aa839897", "comment": "Malware payload", "value": "3fe53c3481bb7b28fcfdb45b326ac89722d7a25ede4b9d022c8e18c358e557a9d522ed303633d67ab4c8bd4e91054233", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497037, "uuid": "7b9d946b-ad59-4efd-8a84-e5c20624bde3", "value": "T12021B0DE00A17C4381649D1930E1C9489005CADF75EE1F68FEC87C36DDD599C73A6B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497037, "uuid": "1517de88-811b-4136-bdd1-d4c897cca971", "value": "24:qcW4h9b9W9SR+8NI5IX+ryCKHNS5Go3sdefU+deIfdSIHYDKrBsTsXpYYeBKOp84:q4h9b9W9SQGCWgLs8U+ffAJDKraTsXp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497037, "uuid": "b15b6b8a-7a74-4169-8c0d-abc908d1404a", "value": 1181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497037, "uuid": "16f621a0-64b9-4750-a143-7dac023d8288", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497037, "uuid": "2e43231c-f360-439f-b2b0-cf65d4633c7d", "value": "android.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1114361a-5697-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779534225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534225, "uuid": "4a89e1a2-c4f8-4af2-97bb-1aaa577e59ff", "comment": "Malware payload (CoinMiner)", "value": "6a5bfb0c086c2078934bfedfe4d851a5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534225, "uuid": "ea5dccd8-a800-418a-ba99-19a062038f04", "comment": "Malware payload (CoinMiner)", "value": "f1926aacf414eb1a67e02c7358056b7019f80a814c0950460a6a1203d6f679dd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534225, "uuid": "8594c5fa-50d9-4244-b15d-7204eb58ff5b", "comment": "Malware payload (CoinMiner)", "value": "a4547e2dd133dc901f965eff77814bff3aad30c8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534225, "uuid": "99884bc3-8370-4dd0-a016-0eb0b4132955", "comment": "Malware payload (CoinMiner)", "value": "395a9cdc4a583bbc7148dbe2d041c06e2efe1ba152f40c54600577e5a7d0fc5f952fac9f63ad3eb9ddbf8b6e647dfe76", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534225, "uuid": "3807821c-6b89-49b5-bce1-1a7e7b401ae1", "value": "T126B5334B43E50E90F79648322C95AB80FA7C780D5FF9929B98815B2B1D78FF0D5721E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534225, "uuid": "44da9cf8-6fbd-458e-84f0-c051900a971e", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534225, "uuid": "f88966ea-a594-433d-bba3-31f03fe3af83", "value": "49152:WWnPzJ1809FANm5MAgZjFJjnbNZ64G7CBvbDwATaC+aANTzsyU1:WWPzL8GW7hF5nvHGcvwjC2NTzsZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779534225, "uuid": "79ab0ad3-0d06-4427-bf89-0d8867236b16", "value": 2438144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779534225, "uuid": "9c185de2-66a7-4d16-8887-739d46e55cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534225, "uuid": "c35beb55-9b96-4988-a49c-9ef49ca84ea8", "value": "ImageLogger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debbd8cc-56c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779555615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555615, "uuid": "a4f1ee56-f6d8-4600-a860-205b83e2802f", "comment": "Malware payload", "value": "62c22ccd1d5d9f61cee10ca5689a6386", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555615, "uuid": "d7d2204e-356c-4265-94bd-02525d3345b8", "comment": "Malware payload", "value": "f23fac5e4d06de3105d82ba31ae2cd3f65401fd89d14670950adc66283e702be", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555615, "uuid": "cfc7e49a-cb3c-4ba3-b91f-84d4fea1bee8", "comment": "Malware payload", "value": "dbb72f84d2b4ab92717f8c07864621517b58709d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779555615, "uuid": "1fe29249-df3c-4c1b-81d1-f63d76f6484a", "comment": "Malware payload", "value": "b8401f4ffea92851e70b3fd95f633af0a928cf427533197553c9d402d17e68ea7f2dbbe9e7745e6c09d7119230c949dc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555615, "uuid": "e42edd5a-d47f-4993-9344-f3103b3da872", "value": "T1B2A6123BA94B5029E26D27363677DFE0A73B6E50651E880F61E0B46DCB350F0193E6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555615, "uuid": "9458378d-2cf1-4280-836b-e252ed395665", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555615, "uuid": "2e2d1df4-1d93-4999-8dfc-b6581fce489c", "value": "196608:OvkrIYx/gezcV61gzXHyDAW8I+UUpLEBt2HhmGW1wcO+ZdbL3X:OcrIO/gezcVRCkHIyHcO+H3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779555615, "uuid": "9cd37a56-732b-458b-aec3-b0bf1e365138", "value": 9974278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779555615, "uuid": "c9dbda35-062d-44dc-ac8e-50fd939b346e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779555615, "uuid": "14f0a6f9-1ad3-430c-9b5a-0ebc65f6e5a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287f4b73-5698-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779534693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534693, "uuid": "1fe7c29b-a34a-4939-899d-d0870bf18d59", "comment": "Malware payload (SilentNet)", "value": "7c2530d80e64bf378faa51ea5cd24f50", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534693, "uuid": "0b5a83b4-711c-4a3f-a3b4-9d0af8a58c4b", "comment": "Malware payload (SilentNet)", "value": "f373b210a37554348d841a15d82cb703936ff675c8395ccc3c62dafbca70694a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534693, "uuid": "1242d1b3-ca2d-4467-a934-249b520ac98c", "comment": "Malware payload (SilentNet)", "value": "0dd44743942d6344477c68065e4ab3e9102d3351", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779534693, "uuid": "0e7979cc-52fb-4993-ad23-b7f9f43df637", "comment": "Malware payload (SilentNet)", "value": "0df780cceac872814ee61db475980a784ce5eb273121e592f5c85651dac84434c520bbec1a2aa306c8af8099fda70e27", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534693, "uuid": "fd8fcb74-49a8-4e33-9f0f-a5a3024b9eb5", "value": "T1B36633C10F8E5130C6362B7ADD78D6469A32C6E8D743692F6D8C266308F5EC0E797A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534693, "uuid": "ef6c01ea-bf60-4ff4-b25d-ec820c074e68", "value": "98304:jue5awdiV6YZ0prbo2qKxWEnsKoyXJ35shdE2F2L1xnPDwCLfcj8AoCHsgk/kzDP:E0w6YKpzgW3ukL1tbfNAoCMDUDK7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779534693, "uuid": "0ee988d1-1268-454b-84b4-6b280827e7a4", "value": 6963214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779534693, "uuid": "648dbff9-30c7-40f7-99f7-fc27163bd30f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779534693, "uuid": "e3b00c30-c67d-42db-83ac-20b67036c3b3", "value": "macro-Utils-3.0.0+mc26.1-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ac2184-56af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544594, "uuid": "a328166a-8073-488d-ac94-1323e67c5f5b", "comment": "Malware payload (Mirai)", "value": "eb90d98e3ada02303ec784366b364c08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544594, "uuid": "1ca31395-60f0-48b7-8357-3473a084e8ea", "comment": "Malware payload (Mirai)", "value": "f4486eaed6c720a0084a1031279c6dbd372d4acad5b141dee8e9e7e706f0f859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544594, "uuid": "2d14f1b1-486c-4360-9403-b3a42d79af51", "comment": "Malware payload (Mirai)", "value": "b05977424549e17cc98a8e13e0c7e6eacbfc3170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544594, "uuid": "4d174e72-4ef9-4e48-8263-a7344176c507", "comment": "Malware payload (Mirai)", "value": "ad9fbd451d68054b07b1190363826679b538b4eafc5e433c0fcd9ade5ad9f1186d5e1d0529aa7e3a579401f945705fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544594, "uuid": "b26dcb1b-5dd4-4906-b667-484d8857283f", "value": "T1E8431780FCD2996EC6D4137AA73E358E33A1B3E4D1CA3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544594, "uuid": "56900e66-9a99-4f50-a556-57ca8bae80f5", "value": "768:ncyi0+MnuAHIf/StW3GvQoyjEFMoRBN5cDqS8kTIM4cL/KIoNsit5ZMfgTBN1TW+:n3nzHI36AGYDEFMWchcMLL/KBt5Z79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544594, "uuid": "5ce43233-d8bb-4898-a30c-fcd725c5bd26", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544594, "uuid": "54e56574-fb76-4d44-9a7a-e3e298e49d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544594, "uuid": "3175d0de-b06b-4f03-aeb7-beb2b53a008f", "value": "luxzz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd2dafd-56c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779551859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551859, "uuid": "3082c023-8c55-4bd5-bee6-e750b935a9dc", "comment": "Malware payload (Mirai)", "value": "2f989adc009e8432819d92594abac88d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551859, "uuid": "5b814f97-b6df-40fd-828c-4da4dd9eb41f", "comment": "Malware payload (Mirai)", "value": "f493d88214672fede3c70dc31bd2b3b9da93b13934715c4a84474e10cd6d6d9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551859, "uuid": "ddf796de-b026-42e5-a75a-a4b2561dc818", "comment": "Malware payload (Mirai)", "value": "5d08357ce2f7323fad876d5121a932fe99bfa928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779551859, "uuid": "0fb47125-565f-45f2-a5c1-7624284ca483", "comment": "Malware payload (Mirai)", "value": "d51128ad19cb2e72ff7e3edbaced63b1f23091b53d5d25bb956c6b6f89beaa2966578c01dfb99454ad9033549856b930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551859, "uuid": "97d139f9-84f1-4985-be25-efc4a01da208", "value": "T1F7361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551859, "uuid": "42be2490-3399-46da-a67c-bdb13fe01ea8", "value": "49152:rF2ItAqee7182S4P1EiiFV8YommyEW6WcqBIxaWWNTfAhvi:x2ItzeqYXL3AJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779551859, "uuid": "841d75aa-fd0f-4030-bc23-d7321644257e", "value": 4886680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779551859, "uuid": "e1f845db-3d87-41af-a3d4-ccdb77bb7ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779551859, "uuid": "d34f4e53-8294-4215-870f-2391d49418d0", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f202593d-56ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779544480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544480, "uuid": "96f2a5bd-4951-42ca-aca0-c8becd53cf58", "comment": "Malware payload (Mirai)", "value": "2143fee7b389fe7d525a25500aba340d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544480, "uuid": "2ae708c2-a5ce-46e1-947c-ceb9056bca05", "comment": "Malware payload (Mirai)", "value": "f4d437ef7cb035430d9c163add2dd4c42890a12d226b3c929524e2d8942f358d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544480, "uuid": "eb96a805-d9d2-43bd-a834-910f1b4ff504", "comment": "Malware payload (Mirai)", "value": "b8e30aed5f8d60701a1ff6ecc143e477c569857d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779544480, "uuid": "cbf31cb2-f14e-4a9e-a0d1-fa736929371d", "comment": "Malware payload (Mirai)", "value": "39cc58e5dae5ef5981575f5c46c78f5b0a826c2da610ba42a9b4657bacc791e1cc70918d04f9ab128a707d0c77a706df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544480, "uuid": "fd5093f7-6b4e-4afe-a8e7-c241d65d17d4", "value": "T18E837DC5EAC3C8F5ED2209311272BB275AB2D13E2268EA83C3A5D975EC135C0F556B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544480, "uuid": "6d5ec07f-bd44-4884-b04b-bd60c513f1ea", "value": "1536:1WOLMM5Md2fo8G7eHO23tAjw19KHVdxYQ5tBP:rLxMdia7oOEti+9IYQLBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779544480, "uuid": "21e40954-f8de-493a-b92e-9d4b5a73fce7", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779544480, "uuid": "1126fa50-f89a-4c84-b669-57b119a06710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779544480, "uuid": "27cc6e8f-d452-41b7-aabe-dc61bfd53527", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1eb10b-56ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779543721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543721, "uuid": "c47e3071-ea54-4d0a-8a35-0994b1db56c9", "comment": "Malware payload", "value": "5d33be3d56370950293ca9826efa3ec7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543721, "uuid": "f286dd2d-7ed3-4929-840a-37a8bf3cc8aa", "comment": "Malware payload", "value": "f5ebd8f8e5217df1c726beb523c00d49992d6d205589509cbe2c581b6aab29b6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543721, "uuid": "e778d31e-5432-4258-a231-4c5f890b5534", "comment": "Malware payload", "value": "53af44484800b7d7c16ef65f4520d58da8449d62", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543721, "uuid": "3dfa7887-781a-4c3e-83b0-d71e5259ffdd", "comment": "Malware payload", "value": "244a180e5ce6bce3ed8bca666a73703645433eee5b1bdc0536f2462509ca1e83d366aa16be7fe1c3d825dbc3b5607fd7", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543721, "uuid": "2b070579-60d7-4fec-ae29-e8703aea12e1", "value": "T166064B05F25A10AED487C5B486464A23DE3474DB1B36AAEF42C0D2363FBA7F45B39B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543721, "uuid": "6010ff76-0724-4edc-8760-3b527bd74d4f", "value": "5dc656cca9effbda0d429dcfe08805a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543721, "uuid": "c8861528-13fc-4591-8730-3fe58002e8fd", "value": "49152:Z/zJ3JLdWXMIyD7OM7Sq6j+hHuMsiSdvf1g/zRlWhgMBR4JOnb5h:7yr1DgpIdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543721, "uuid": "4109d549-48b9-48dd-b26b-8a1ae243e924", "value": 3857920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543721, "uuid": "266bf785-4627-4380-8422-80e00e659535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543721, "uuid": "13b5b343-4fb0-4539-896a-23815261bb4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f95ada-56de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779564937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564937, "uuid": "7665d8de-b874-476f-8cb6-417007747692", "comment": "Malware payload", "value": "19eee6a8ce46b1deae3c04fe6797a6b9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564937, "uuid": "177e7a81-4d37-4674-8b82-33565557595e", "comment": "Malware payload", "value": "f76e43cd836b451886a671885b7a1071f5aadc372a85def84c6c0583039ccef5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564937, "uuid": "78bd05a4-1060-48f2-9619-918b2d9cfb7b", "comment": "Malware payload", "value": "64468d87e33c186b71f617d0baa2bb6ba9579751", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779564937, "uuid": "ea1567cc-b6ec-46f4-abfc-5f41c8a63cb2", "comment": "Malware payload", "value": "1a198380278ec1e6ad0ff1a9e02b64e1bbe79a1b98aa790c80936abc34446fd3e12a9d471e99c422b5b01acd2344386a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564937, "uuid": "e0cb71b2-2434-4140-a6c6-7c96edff8bf4", "value": "T1CC137D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564937, "uuid": "0168ee77-cf8e-48a4-bc92-666f9e192323", "value": "768:Rr9NyXsZztCE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:pHusZQco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779564937, "uuid": "57590623-943c-4e68-9d86-35ccc50c1017", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779564937, "uuid": "9ea8b374-0d0a-4a24-b0d5-0fe702a6fa5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779564937, "uuid": "8c09fb28-7267-49c0-a876-8325c870205f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd153d63-5694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779533225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533225, "uuid": "e22dcf66-924f-4c87-96d8-6b415a00280d", "comment": "Malware payload", "value": "b4492a372a5e043001e48791ec4f3a60", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533225, "uuid": "3308460c-9493-4eca-879f-b00e9c0415a0", "comment": "Malware payload", "value": "fa39dcf8ffb9c620a97ebba2c348c2edfb5b398b4309f07e85f0e76345b178d2", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533225, "uuid": "71931d77-adc6-4805-8bc4-aebe55cec35b", "comment": "Malware payload", "value": "4d2d046ecdb6325297b94da7dad5cb5cd310da60", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779533225, "uuid": "6b2f3c65-4de4-4ee2-a232-fb5bfd8b6aad", "comment": "Malware payload", "value": "e2914113512dc4bf689196cd80629c8530f25de49a987d2e6308aaa1661865745e7ce391bce6331fe184bac6d56339af", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533225, "uuid": "9e551591-74d8-4bab-8196-791e1958232f", "value": "T1EE41132417E2026AE7F79B35E8FDB212B6127816EE10EF8F0180435955B5920F4A7F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533225, "uuid": "19ac9341-e939-4989-9339-515cc0eddb93", "value": "48:8CPmeKpUQw1g3Rr7qU0EMcyf3/4wnUIA6q6Cax:8CPOCP1gBnqU0EMc6P4wnUl6q6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779533225, "uuid": "8ad55c7a-054c-4698-aa1f-b6a574b4faa2", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779533225, "uuid": "bb218680-8bda-4f9c-91cd-f29c91f0bcb7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779533225, "uuid": "094ec779-e06c-49ca-aaaa-f38711d040c9", "value": "fa39dcf8ffb9c620a97ebba2c348c2edfb5b398b4309f07e85f0e76345b178d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd03271-56f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779576093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576093, "uuid": "0e346bc0-02d1-43ea-8b3d-49ad0572be65", "comment": "Malware payload", "value": "d04041dcbe0efbff1298967d51a84f6b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576093, "uuid": "d803df0c-29e7-4504-927f-86e428dc0d07", "comment": "Malware payload", "value": "fa8dee1c2209b87c7406aa4c95e7e3b62f45cf339c08c94dc6479ea6329f9546", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576093, "uuid": "b65fa598-ec3d-4540-a59f-4be8f309c661", "comment": "Malware payload", "value": "3f2cb3588f37c13c48ec1245e000a8d19df13fa5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779576093, "uuid": "773eefeb-99d9-405f-a07d-aaec12d1c827", "comment": "Malware payload", "value": "f02498812bcccbaab60fdc929a667d6938b198da395badc7e799c93261f56e45f10033b4448f3679eca4dc2f62a051ac", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576093, "uuid": "3836a7ed-88a9-4c60-ac01-cbe06eadc219", "value": "T1EE47224BFCA105F6C0AEA23289225186BB617C451F3127CB6E90B7B82FB3BE45C75715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576093, "uuid": "3fba75ae-50a3-44d0-be2a-499e1472bea4", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576093, "uuid": "d706a736-4609-4046-8045-37449a9b2902", "value": "393216:X2eJdcM3yv74ZCeJqyiC5fnIa/6tvQtQnC/zaKHEPw1aAi:XDbdyv74FhZxnj/gC/tHEHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779576093, "uuid": "a54bcea5-54c4-45fe-895c-05eb192c28e4", "value": 26214400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779576093, "uuid": "6a4b1e9f-0cdc-4cf6-84cc-3ad4516830ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779576093, "uuid": "13a5569b-ae3b-4faa-b8fe-603f92f39420", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb28bc8-5649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779500800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779500800, "uuid": "376527e2-a5a9-4035-87c6-5bdafdb3a2e2", "comment": "Malware payload", "value": "d323748319e835b1492fa4dd10633b59", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779500800, "uuid": "675e6aa8-efcf-4bf2-a32b-3350b1f5d2ce", "comment": "Malware payload", "value": "faf9f58775b9eac12bfab1831fb52426110565e3059e18f119495072736586f0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779500800, "uuid": "769219cb-533c-4a25-afca-e065d82af1cd", "comment": "Malware payload", "value": "165220d0804fad17517c1e17859a07fe51c61442", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779500800, "uuid": "bf2a6886-0997-4ad8-87ee-9a1c5bcde17e", "comment": "Malware payload", "value": "d3e776992c021a3de66106b6e810c5d40cc32e8185c3ef22907fe937fc9980867a1f45c0b5557cfb9e21bb5d13602d2e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779500800, "uuid": "7a1fbb40-3464-4748-b2dd-3bdf0e8f429b", "value": "T145541262EBE50938F3B206750BF04B03CABAB4468BA50AFF1741422E6A757D15477F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779500800, "uuid": "63f8f901-0a8e-47c9-a4cc-61741bab4098", "value": "f472730ed692970bfc4989116b7b8d76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779500800, "uuid": "3c3a261a-b0f5-496a-ba04-a1d4ae9395b5", "value": "6144:pe+nKYBqgSpkD/wQL5Vq3HdzNba+Sl+11LHjvi320DZ3j4NL:c+nKYdSpkD/wQXq3dzY+Sl01fKdZkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779500800, "uuid": "4f56cebf-10b0-444d-acc4-7f91b25a8b7a", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779500800, "uuid": "1fd2a73d-4912-4d0c-a47b-d759d71c9477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779500800, "uuid": "f0e3b593-494c-4eb6-b8b7-70e60498a624", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02abcb9-5689-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779528505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528505, "uuid": "75df4130-ced1-4c83-9beb-b64b1f2dd79b", "comment": "Malware payload (Mirai)", "value": "1b1436cd18b41d3e108f33a01a8db804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528505, "uuid": "82e4d185-8e87-455f-9e47-2c7d8e751323", "comment": "Malware payload (Mirai)", "value": "fcc3c7646fdd174c7cc3aa0e3c7fb5f699e0fdcbcef7a57e625b62575c67aed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528505, "uuid": "28bb4408-a41d-4cfb-a0a3-81699c63dec4", "comment": "Malware payload (Mirai)", "value": "dd97ea092006f64173c7e50193db235e06b8c754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779528505, "uuid": "d683cb8a-2834-4587-b412-b376391b9be6", "comment": "Malware payload (Mirai)", "value": "ace02aecf646b6e475f603bdb3f9975a8e87d9c3ed5b8d1ac107b42a9c13c8139448f8ee74cf2c2786d21f7d99f3b608", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528505, "uuid": "ecb3532c-c51d-475b-9c50-d3627f620feb", "value": "T13F738C22E4B81E64C15415B0B464CF794773D5A1818B1FBA285AC37EE087FEDFA1A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528505, "uuid": "2d44a7f3-989a-4cfd-9e17-dce4bdff5460", "value": "1536:iaux1+1jjrjQsdbA9RzkvPrKoBmxjVLUyWNC50Xx:i58vdvPOo0VoyWNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779528505, "uuid": "0d379326-c9bd-4fda-89cf-bf9f9c3619e0", "value": 75140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779528505, "uuid": "e5b0ba5e-c96e-4f36-b452-57fc8154f391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779528505, "uuid": "87f00e7c-2413-4fab-8a43-129dd530f407", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d0c784-5687-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779527730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527730, "uuid": "db802948-aa0b-4af8-88c0-a6ae57ce3183", "comment": "Malware payload (WannaCry)", "value": "d76303273ecccf98c941d19ff6862047", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527730, "uuid": "8b67977d-6d9d-493b-ba98-4c7ca9ab5243", "comment": "Malware payload (WannaCry)", "value": "fd0624de9ea9869b0835832ce14cf6220f804b97fc35a86ce277b167acdab7bc", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527730, "uuid": "b2dab6a7-01d4-409a-8bc3-ba63c8953c49", "comment": "Malware payload (WannaCry)", "value": "7f4d5104e1c99b03de57e890ed4c195832cc3a1e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779527730, "uuid": "1b253641-b1d1-4f6e-8e7b-fa778f491532", "comment": "Malware payload (WannaCry)", "value": "101f6fc71e164266d1b2bc68a0278a59e508c8050a8d599d009b83ba812c2a7bbfa75b933ff89450afc95afcf2a99e54", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527730, "uuid": "4ce63207-9a06-4e79-993c-118bc926a8c2", "value": "T1D136339822A8A1BCE0550BB484B38E2AF7B73C5573798B0F57C487AB0D0379B6F94751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527730, "uuid": "0f9e7d91-bb5f-41ee-9b98-4f8adf4a31bc", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527730, "uuid": "2dc81c22-3853-4615-97a5-8d8f045055d8", "value": "98304:DXDqPoBhz1aRxcSUwxWa9P593R8yAVp2H:DXDqPe1CxcpadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779527730, "uuid": "5dc59019-de65-467b-9014-5d32499c00dd", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779527730, "uuid": "8455beda-4dcc-4082-86d0-1a3317a19000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779527730, "uuid": "44d41437-9ad1-43b5-9521-bdeb09463749", "value": "fd0624de9ea9869b0835832ce14cf6220f804b97fc35a86ce277b167acdab7bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b708f7-566d-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779516573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516573, "uuid": "50fb70bc-9489-47b8-97d8-9f13df53fcd8", "comment": "Malware payload (Efimer)", "value": "95674de1e29621a5d76b044625882342", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516573, "uuid": "e07cc8c8-4038-454f-bb01-523aec38ee3a", "comment": "Malware payload (Efimer)", "value": "fd627cc0a9479dcdf43256e42a13f9c50177e5c6d20feb400bddc27f971733fa", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516573, "uuid": "67bc3c14-20b4-40a4-904b-1c41b40bae47", "comment": "Malware payload (Efimer)", "value": "45740d79ad0c94b7c7126bf77fa02a1fd0ea6c9e", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779516573, "uuid": "754a72c5-936b-47bf-b62b-0d916a4de668", "comment": "Malware payload (Efimer)", "value": "0ee5b173c17ec05616cd8d13cbc4c24d897c70d4ee63d5d5a7b03ccfff199765a9d9bc0edf8c0296f1a1ac04dfe95153", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gencirc", "colour": "#6851CA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516573, "uuid": "29f13f91-ce55-4721-a180-695e2679d6a8", "value": "T19DD6331CD58660FEC2B29478BEE41778F039B0B4A1724D765B88EBB4AD574E0DA1C42F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516573, "uuid": "d29350bf-4e84-4375-9b45-3fb546d273ef", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516573, "uuid": "89d44ead-5b72-4fe8-bca5-e5f2d42e24b0", "value": "393216:cwgv4YDDjM3A7v9wGCXMCHWUjX5cuI3/PGTAI:cwgv4YHuM95CXMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779516573, "uuid": "283d113b-1e4a-4da5-a232-e0bf592af47b", "value": 13866587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779516573, "uuid": "715754a0-8619-482b-ad5b-eb7d852c77d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779516573, "uuid": "7924225e-4849-4111-93b4-484e8d9eacf6", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcc9c4d-56ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779543188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543188, "uuid": "2eff4507-dbb6-4cb3-a950-bea6aba32d32", "comment": "Malware payload (Phorpiex)", "value": "3b63ada005e094af9a9bde2d8fe65883", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543188, "uuid": "59c06c82-ed39-42bf-a8f3-745f42202bc5", "comment": "Malware payload (Phorpiex)", "value": "fd77b5475fc9d02e154b3048897d373c34362671533b6ca19cab19ded2ff9396", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543188, "uuid": "a850105d-f59f-49f5-a792-c1795477fc5f", "comment": "Malware payload (Phorpiex)", "value": "239e58634659b6be640124e481639230decf6d26", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779543188, "uuid": "6b16b201-1105-47c5-b459-47634abe4dee", "comment": "Malware payload (Phorpiex)", "value": "59a116554466965520f3cc7510532b9c4e3132d35b6da1c614a8c4d6ea74e0b7aa802b9faafbb94cd09bcbe80e877230", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543188, "uuid": "d442fddd-1f84-40e9-ac1d-6eb1cb4b09bd", "value": "T105824B0FF9814216D1E110B05675863BDAB99C72338454EFFBD48A9D0BA86E6FC3225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543188, "uuid": "09123cd7-ddb0-4bd4-a552-43a20c70e78e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543188, "uuid": "723b2c8b-73fb-46b5-8841-ecab274f6560", "value": "384:VlIJlVYer7bskwAd0ZHu9JgiG7QWav8U9cc:Ogw0w9wa0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779543188, "uuid": "3a9e6557-6b49-448d-84e0-17ff8fb7cc7f", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779543188, "uuid": "ca11e129-b1e4-47ec-98c7-e9afaa04c3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779543188, "uuid": "fddb1a7f-f057-40b2-a338-0e26de979203", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e167b6e-5640-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779497041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497041, "uuid": "2d1179ff-b3be-4956-9cc7-3024fce8d961", "comment": "Malware payload", "value": "7f6c9a29bc7129a853184f0b7ac3e0ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497041, "uuid": "8fd1d2f2-0f30-4ce3-8d1a-97418ade00d4", "comment": "Malware payload", "value": "ff5c77d094590a166fd78980adca9698713171ce48e56830937b3ff7d638121a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497041, "uuid": "70e0edad-f610-4324-a377-efe6d1933ab8", "comment": "Malware payload", "value": "44503bf6d4002050c43f37452179d9074b6996aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779497041, "uuid": "384fed66-14d2-407b-8887-480001187670", "comment": "Malware payload", "value": "849ce14558a339db660d81bcdaf69b74be3946b8351d2fc81ed05fbd96f103f30b0666d50b7cd77388a4ff96f966a43f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497041, "uuid": "3f8221b4-79b2-4e53-989d-486fe9ac1215", "value": "T1A535E003F670CF6DE555317829B28A5167B605870BE70357C278EA217B7022D4E2FBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497041, "uuid": "22639928-0296-4664-bf80-ddd69f4d02cb", "value": "12288:5P3ZWoueXpaoa/Tr4EGRyexj//r57oN+iH/mxHOI8Nhf3jtzlqohENU5B6OZsQUT:tl0GRWNDuxdstzhhENU1IZay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779497041, "uuid": "d010ef46-5d4e-47f5-ad4c-63e40189630e", "value": 1073073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779497041, "uuid": "13f28353-c74c-43a6-9328-df2b10fb023a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779497041, "uuid": "2ace6469-8fb6-43e6-ab12-878093f63485", "value": "bjsvazz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }