{ "Event": { "published": true, "date": "2022-08-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-08-07", "timestamp": 1659916981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "60810840-92dc-4bff-b182-0915b44ee915", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a08b7ed-164b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Neshta)", "timestamp": 1659874948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874948, "uuid": "a0907092-e1f6-4911-9c9b-adde1cfd3e0b", "comment": "Malware payload (Neshta)", "value": "66ec236f7e3706529af4c68b2d557507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874948, "uuid": "6d296971-e54a-491e-a30c-8846dbec9022", "comment": "Malware payload (Neshta)", "value": "002627ee9699b28cedc585da9a1bec3421da624eadcfc42bbb7f64471c8c770a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874948, "uuid": "f804c7c0-0c82-468b-a865-1f98cbf6129e", "comment": "Malware payload (Neshta)", "value": "507f6c2309ed1bf9ccaf6f3cd9d77c9047732e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874948, "uuid": "f520d682-5b57-466c-8e2d-db13f25e7f1a", "comment": "Malware payload (Neshta)", "value": "a89ade9f7ab4818987b73edc37ccc77f9106deef9c1d5d9f3415c84af64cb4b5735cc48ec84ff4662d6fa5220ffdec15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874948, "uuid": "ffaf533c-e0ad-469a-b42a-d4e5b6dccdaf", "value": "T1F2A57A803FD5BE26D66712F09ED307A78B3F8CAA759C2765F0A484D44B48602E8517BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874948, "uuid": "0964f0bc-0997-42bb-94f6-c40ba6c6316a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874948, "uuid": "6faf9fff-713b-48f7-98c9-583e31377a40", "value": "49152:prxui7iH/p8FySHGoke2FkGqPQxDZ/LlyDbJn:VwW/F532kGvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659874948, "uuid": "3a688efc-e060-410b-ba0b-9d51ba7590ca", "value": 2219520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659874948, "uuid": "e772e93e-5c46-4409-8c30-538337719298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874948, "uuid": "0ecd5652-7345-4cd8-93da-d6dd96f7f81c", "value": "Pre Alert Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2390b06-1625-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659858640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858640, "uuid": "43be8fe5-afc4-4279-a649-0cb1cc824763", "comment": "Malware payload (AsyncRAT)", "value": "0cdcef177086eeecd2b795f24f93c606", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858640, "uuid": "70b3c420-0f8f-41a2-8229-932146f90226", "comment": "Malware payload (AsyncRAT)", "value": "015ebea1b926e4e977a008ff5092cbf74b96f94614526d29c459bd9881fa5dd2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858640, "uuid": "62151fd4-3c3d-4629-a673-88b2d330f814", "comment": "Malware payload (AsyncRAT)", "value": "829c508200a7a398eeeadb9498803bb2c69bf31e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858640, "uuid": "59966095-3e2c-4671-990e-7637948e402c", "comment": "Malware payload (AsyncRAT)", "value": "a9b0a4a8aa037065b80cfb88ccaf6089010312e4771003299b19b7f037a283563e3eeb76af733fe6b6794681d4473123", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858640, "uuid": "e42911e9-2236-470f-a57c-6c58cd85db48", "value": "T11205F69DB21132DFC957C872CEA81C64EA5175BB831F9203A02725EDDA1D8A7DF148F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858640, "uuid": "4331c2e0-10b2-4cba-8a27-b238c718d903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858640, "uuid": "1e5e6019-1741-4b14-943a-6513ec52091a", "value": "12288:98gyNJbPwagx2iNxlwtT6KbtjCtp8VTA4Gd/VG6JfzQ9mt5nyCDSj5rYQyz1Kbt9:WXNuvx19KbztqVGoMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659858640, "uuid": "790a46a3-818f-4339-b680-4d5c7671c88f", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659858640, "uuid": "0300119a-071d-485f-bedf-aea58329d0ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858640, "uuid": "2b252284-5d1b-4ced-b242-ae31bc8494c6", "value": "0cdcef177086eeecd2b795f24f93c606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b58b48-1647-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1659873039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659873039, "uuid": "e9b9843a-7e85-4df5-a5c6-e18864b1b127", "comment": "Malware payload (DCRat)", "value": "515f3fd89ac0656b28c449b6da2e7dea", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659873039, "uuid": "69c3a3eb-42fa-4b29-957d-fd11cd28d53e", "comment": "Malware payload (DCRat)", "value": "02daa4900ae5e3ec8c7d2e04eef110b92cba4b63bb2794c927c0cca83fc85767", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659873039, "uuid": "95e5d36c-1426-4934-b44e-451a6c1b92d7", "comment": "Malware payload (DCRat)", "value": "9f96212b074749b54e97c36e17b7b57da3079170", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659873039, "uuid": "2f55bb7b-0c92-462a-bec0-e682dee91b36", "comment": "Malware payload (DCRat)", "value": "794c75bd332f9b42b0cb400de8edbf9914d3bb096185f296a413e506ff1593a1fb83372565afa1cee53e7ed3efd8a179", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659873039, "uuid": "6c92baf3-15f0-48c0-a6ba-c941387c0410", "value": "T1B0558B027A49CA02D0A91737CCEFC41847E9BD42AA26D71A3E9E33AD15513E75E5E0CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659873039, "uuid": "b1c8f7f1-561a-468a-848c-15692ec4b4a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659873039, "uuid": "50954140-b62c-4d2b-bf08-03c5ef833afa", "value": "12288:6gzbaiHb1YQdaUwf5rpp71eUP09PyvQSJH3e57bZBehStNXG8PoQyGSYTkkB7JVy:ZR7BJwxpreUcTluS283OsQ0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659873039, "uuid": "5bb25c91-6cff-49b6-a79d-59b8e0897072", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659873039, "uuid": "fa13c077-3671-4d56-b034-51038f35f593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659873039, "uuid": "0509dda2-836e-40a3-97bd-f3536876e1f3", "value": "515f3fd89ac0656b28c449b6da2e7dea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421b6479-164d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659875659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659875659, "uuid": "aa09bb08-2daf-45d8-9515-abf36d51b9b0", "comment": "Malware payload", "value": "1ef9c948e6045d8d8794a89cc9545b0f", "object_relation": "md5", "Tag": [ { "name": "Erbium", "colour": "#0E88E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659875659, "uuid": "a7a35e71-9cec-4075-828c-6cc881a20263", "comment": "Malware payload", "value": "04642249b0ad41b1c6cc8862ec372c3b9b1e855d104a16a6a3fae694cc23ec0c", "object_relation": "sha256", "Tag": [ { "name": "Erbium", "colour": "#0E88E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659875659, "uuid": "3480d94c-3a92-4fe2-9458-47cf4c1a1b57", "comment": "Malware payload", "value": "7fa3530f3cc242075c04a43593faea2a8ce7a194", "object_relation": "sha1", "Tag": [ { "name": "Erbium", "colour": "#0E88E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659875659, "uuid": "8985cf53-b554-47b9-998d-8fe432e95fb9", "comment": "Malware payload", "value": "9d9a0ffcfd924727cc9582e496ebd278f2354d66808cba27ba1ae17ee9682fe70f905701d82fd2988da55a218430e387", "object_relation": "sha3-384", "Tag": [ { "name": "Erbium", "colour": "#0E88E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659875659, "uuid": "7c4e2132-8c69-4c5d-8d02-321671eb8840", "value": "T1B8059E21F842F072E09100769AFC6B77ED3DAC3407299DE7A3D4397D6A704D1A639B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659875659, "uuid": "c7851976-00f4-4562-b6a0-a1c5a31b4ba6", "value": "e0a6293991c65f12bff07e54c871d60d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659875659, "uuid": "ce90a31f-77b6-45dd-9a7b-ab96018a21bf", "value": "12288:buT+iN+L6m8nLoIGs/FrvyALu8aeBVnFqfBwmkUmIZksaqQuVt+OeO+OeNhBBhhJ:CT+iNGJuY+DUm/sa3uVZX1fH6nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659875659, "uuid": "3432e92e-fe05-4983-8fbb-168e5a55d5cd", "value": 839227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659875659, "uuid": "eb1497df-e437-4cff-bb30-da17d56b2fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659875659, "uuid": "f39adb77-dd61-4236-9071-12df85a6a294", "value": "Default@Geroin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a850d1-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831808, "uuid": "95ab1ab7-b8a2-44b0-806a-1f838ed96b7d", "comment": "Malware payload (Mirai)", "value": "05044aeb0fa9e3c8dfdfa999bb6903c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831808, "uuid": "53a0210e-bf8d-4114-9516-217fe688cec7", "comment": "Malware payload (Mirai)", "value": "07a5ad68a359612b92e16ed8834f189f97c2f81b59371d9f7ef771c0c2f245af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831808, "uuid": "4d07239c-6f8a-4132-9798-e07918ae43d4", "comment": "Malware payload (Mirai)", "value": "b5b7506d9c8c2f144fff6d3e4dfaad428079f45f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831808, "uuid": "71c7e0f6-2733-4dd4-a3ba-df9d4011582d", "comment": "Malware payload (Mirai)", "value": "7bb701e389b2764194763dfdbd4c3cc26b0659f3580759ee2729abe331144fc7be7f21cad2ba2037b858e6c58ffc8fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831808, "uuid": "866d054d-d8e5-4908-9c35-0043ec697a11", "value": "T1A8E2D0CC3040ADAACDBE8E3E255D0239C51D75C122CB9F188761DDA1B7AB5873E9D81C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831808, "uuid": "0d19679c-d592-4f51-9184-989e80b77ff2", "value": "768:cBxWJLGGST36P9slMdWWpoXrFpozTwrFYLpW4VSl+WMK:IE0TTKsOdZ+r1V4VSlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831808, "uuid": "c9413efe-34fc-4495-bc7f-2e63b6c8a78a", "value": 31968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831808, "uuid": "473cff7b-49f0-405a-9b75-d6344b8bbee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831808, "uuid": "8d100f41-34fa-4ee3-a1b4-826df3740bdb", "value": "yakuza.mpsl-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b3145d-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902799, "uuid": "83ba6739-de78-4d1e-9b7c-4e54bc2f9738", "comment": "Malware payload", "value": "9f4c93cd5f4ef131d58ac45cf1c1caba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902799, "uuid": "46429f2f-5cc6-4ab7-a722-a0c1aa73dc10", "comment": "Malware payload", "value": "0a7f8b0356498f73390a747f47dd69d0c5a368cfd78ac23e55cfc115c707af49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902799, "uuid": "a13a1cd1-8d86-4742-b9c5-f5705b463746", "comment": "Malware payload", "value": "1c43fa4de976576e06846559d654601a8bdb0cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902799, "uuid": "6ec60803-5e11-4afb-8311-4374773258fc", "comment": "Malware payload", "value": "0db7f1cf0e1405da18eedccdf1d6eeae03452513f99c12a3041dcd9b09db0014b659b65ca28d0d82184f58afd6953f03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902799, "uuid": "2194eb5f-ae7f-40dc-8ded-9f02628d978f", "value": "T174D3C86FBB180787C8CB46B0292B63F14FE8AD6212D150C6E15ABE401BB3574B527FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902799, "uuid": "1d668755-e59e-4bab-ba08-206d0b280d28", "value": "3072:lbX86OW2UKOqJfW61B7C+mY007nV7genO:lbX86OWJKOuptC+mY007nV7genO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902799, "uuid": "63113601-dc23-4e80-99e2-5eaaac5daa29", "value": 134787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902799, "uuid": "980174cc-2d64-4da9-996e-b8ab30a7dfec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902799, "uuid": "6bca6860-d678-4f34-950e-78f3bfa04e84", "value": "9f4c93cd5f4ef131d58ac45cf1c1caba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f0fad-1682-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659898391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898391, "uuid": "72fba487-9025-4e67-bb1a-15ed0c630715", "comment": "Malware payload (AgentTesla)", "value": "002ac66db8e4808ec21abbf7217560d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898391, "uuid": "b246db0f-540c-4fef-8205-ff23afc41dd3", "comment": "Malware payload (AgentTesla)", "value": "0f68fcba9bf369ec97da810e16e0f2a5fc45178b19a2bde5569892d7d1618d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898391, "uuid": "222055eb-5e5c-4cb3-8a93-58bfe454858b", "comment": "Malware payload (AgentTesla)", "value": "e03f38d0e46460d866a0b11b4dbd1db38d4eb728", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898391, "uuid": "9ec18a21-05a6-44e7-8987-9714a58878c1", "comment": "Malware payload (AgentTesla)", "value": "cbcb79fb5f8bc2565563f485d626581a6a0458569025d1d570aee05263ac08286b17d23c073ac47cb94204509c061162", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898391, "uuid": "de7c552c-53e0-4381-9982-2418e5cad3ae", "value": "T175E4CE6115C57225F4265B7846E058394BFAFE11FA2BF2AD3CA87384DB33FC08661923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898391, "uuid": "01b8a147-94aa-4a63-9979-61e4bbc6131e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898391, "uuid": "3dd0466c-0bd6-4736-aff0-a172e48ce2a5", "value": "12288:pBDlnrkYuxPjwi9BZNbvYbagLX4q6kWxmP4qY6FCqtXcLHMDhOBt:C7jwi9BHtgLX4q4K4q2qdcoOBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659898391, "uuid": "82528fe7-f800-4234-9823-79a4bcf4691c", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659898391, "uuid": "1dc7145a-bd99-4d81-9d72-cfa6baa0de2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898391, "uuid": "0845f290-189f-447f-bb3a-781a37a5abe8", "value": "5287654-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcff6dc-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902734, "uuid": "c25f2a97-c3e8-42e2-bed5-16c4d6b1c4cb", "comment": "Malware payload", "value": "87d14a1bc8b25d7d57f9143dd577d32e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902734, "uuid": "51dda6c2-532a-48e3-b341-56dab9ba8f21", "comment": "Malware payload", "value": "17357f022255ac5a1a3043e0779cb14ece3012a7e6f2d8efda119380dde172b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902734, "uuid": "7be0c9e4-b170-4649-b7bf-61e794e08f38", "comment": "Malware payload", "value": "47cf189eb76a72a9f369f6e498f29b79d0c59f9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902734, "uuid": "90bf6b76-f9ef-4d7c-aeda-a6b4c3d13267", "comment": "Malware payload", "value": "7abb250cabfa647f4eb2f5ce815b2cc6a34146f5437d3c74339895225a7846ff4a837f1f6bde0c8e17440abba3faddd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902734, "uuid": "4eaafe5a-6708-4136-98c2-6b11ae6d326e", "value": "T1BBB33BB259B1E973D20317F002ABE76502B2EDBF2917C651E36F7DB496320887390769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902734, "uuid": "6377d8a5-749b-4869-8485-1964cb7c10bf", "value": "3072:2G/PXUw9DCj1e5dLNgvXMbTpK9u9TuntmruOBmST0nYXbg1DE:/h9DCj1wdZgvO6u9Q+uOBmST0nYXbg1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902734, "uuid": "fa102884-cf24-4a90-9443-3b50b566f14b", "value": 112526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902734, "uuid": "3d7d39b2-eb8a-4010-a207-3687813e17e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902734, "uuid": "4709d266-e0d9-4be6-b473-6a3705c322fd", "value": "87d14a1bc8b25d7d57f9143dd577d32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86ff379-1643-11ed-93bb-42010a9c0043", "comment": "Malware payload (TeamBot)", "timestamp": 1659871536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659871536, "uuid": "12fee4db-5131-4a07-bfae-1e679dd48a27", "comment": "Malware payload (TeamBot)", "value": "bb31e4ecaa19065d33c2b997cae2c6d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659871536, "uuid": "d87559f0-f6cc-4096-abda-f0f2f0a94c5d", "comment": "Malware payload (TeamBot)", "value": "19206ae96c605ebf5d0dcc13082c92244bc8de81655c83db61f7556b49063180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659871536, "uuid": "11ec8581-ce55-46a7-b7b0-b2c565b271bc", "comment": "Malware payload (TeamBot)", "value": "890d084606528a5ca85a80d850ec51229126a170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659871536, "uuid": "88f4a189-4f83-4645-a224-db393b010237", "comment": "Malware payload (TeamBot)", "value": "b87a34114a5217d74a69652467446c5f1e4ae41cb81d2e5d0387f794dc2718df45cf45b04639f38ee149aca879f83c65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659871536, "uuid": "e509eea4-1090-45df-b99f-2bef7eb98b50", "value": "T132050100BB90C035E6B625F44976C6A8B52E3ED1972451CF23D83AEE5B35AE1ED3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659871536, "uuid": "3cd3da0e-5192-4b46-b0ca-8e21016bc148", "value": "08698d14d1e7fa83050959c8515b39ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659871536, "uuid": "c83e63ae-2778-4a6f-8563-2cd3bb000f9c", "value": "12288:AVqGfA+dQjyTHVcSghQAArvnTkMdG/DwSse9OS7CxfJDY8Zy9uF6Mx9Yc0e/:+zADjA3ghnAjg9wSsQCBq7uZ9Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659871536, "uuid": "1160aa71-a0b8-4615-b349-edaadc0d09d0", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659871536, "uuid": "98251e18-b2a5-45e7-8874-3cc293e44a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659871536, "uuid": "e3e27027-7b23-4cea-aaf2-0232b6f5a979", "value": "bb31e4ecaa19065d33c2b997cae2c6d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f4ed92-1698-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659907829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907829, "uuid": "76873f15-1184-48b9-98cd-c7416e1760d3", "comment": "Malware payload (ArkeiStealer)", "value": "6fe01f3da170cd20be1c0fc082226ddf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907829, "uuid": "82bfcd75-4e78-4311-b17b-c3839e860740", "comment": "Malware payload (ArkeiStealer)", "value": "1be4782dc3839c4ab537b7d5ce80601334de1d84f4be455db7c80b4ae3ec51ce", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907829, "uuid": "f9a20641-8a5f-45b4-afcc-c889fc0b375b", "comment": "Malware payload (ArkeiStealer)", "value": "feacce4748c1b69f27c8917b3a61ac65cfe79194", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907829, "uuid": "4be74006-f720-4a9e-994d-40d072cc27ab", "comment": "Malware payload (ArkeiStealer)", "value": "c11cd9ca3c7cace87d472068244d703a4366a0e7ddddd715d29e0892bb73d1b2df9304e330e2455c96ccaeaae6ad3d98", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907829, "uuid": "4bab14e6-e1fd-4e19-b322-0492ea44e822", "value": "T128549D216750D036D363103DEA91A7F5CABA7C313915A157EBE41A2EEEB02D6DB3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907829, "uuid": "4ce1dda6-a578-4d8a-9517-e69bb8c4c882", "value": "8c50a8ce086310257ae68d43bbfc77c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907829, "uuid": "ed318979-acf4-4962-b7e1-be74eec6c3b4", "value": "3072:AYsC5IZ2xyrOePmfesrwmbk4wR92fA9wGWU/w3lYLt+E5okkR9wZlFl+NtVSQK+t:A8gzcr02sUfEWax1okxFyuQK+ZgHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659907829, "uuid": "9b00a792-656d-41a5-a259-4d097a4e76ff", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659907829, "uuid": "189956b5-c453-4220-bb6f-8afad7ea3eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907829, "uuid": "bce2cbd9-4115-4939-beaa-662634bd5464", "value": "6fe01f3da170cd20be1c0fc082226ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe026f6-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659911706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911706, "uuid": "a0ac6fc0-7b91-4db4-a74f-cca60c26ef90", "comment": "Malware payload (Mirai)", "value": "84e72935693b87f6d007693568157b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911706, "uuid": "47379e50-a70b-4786-9447-a36e9babf6d2", "comment": "Malware payload (Mirai)", "value": "1e3a9cb7ed3bc2f5b2c84a04bab6837859ca6f825389671015599948b14fadc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911706, "uuid": "221af79d-965e-4f53-922a-98137debd104", "comment": "Malware payload (Mirai)", "value": "79d0c145cb0417f026773c52bd50d29e0dbe078e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911706, "uuid": "03c54a08-cbc2-492a-b64b-a37ab67dda31", "comment": "Malware payload (Mirai)", "value": "eda416105231652474e917274bc3c209fec86630a20524bf97746449a33122f15f664b0d6822ff920760a8c45d64ef71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911706, "uuid": "ba272578-68ea-4736-ae24-a2599b2c2686", "value": "T12C337D65F8642CF8D8120174E4788AB9D3939EB641C90CB62CDDE65008FBF5DB68DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911706, "uuid": "4e5af4f8-73ce-496d-a866-543b81cdd7ee", "value": "768:YHm764mELERgEpMEFH9YBjsxc4ea8MK9f7UnGOA92ntVsRaDRmhqmq7kSjkFHgfE:12kQnzFH9/kFH4sT9rPDEwhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911706, "uuid": "8071a059-c6f8-408e-b104-e816456d2df4", "value": 54144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911706, "uuid": "2922d7f1-6a2d-4e29-86d6-e79a4ee00c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911706, "uuid": "8ec62749-3ba2-49d2-ba46-89aca3097703", "value": "84e72935693b87f6d007693568157b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2716d1-1675-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659892831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892831, "uuid": "bcebec91-5089-4665-9b84-0ef47e27adba", "comment": "Malware payload (RecordBreaker)", "value": "524b292f1499d13b7acc1af8f6e0161b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892831, "uuid": "d4b67549-33c9-47ff-91b8-326825ab272d", "comment": "Malware payload (RecordBreaker)", "value": "1ee4cefacf38cfc2928f412ee4d23e2254c8265754d8eb4b86e331f2ca8616e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892831, "uuid": "057c4389-301d-42d9-aa32-14105479cb9d", "comment": "Malware payload (RecordBreaker)", "value": "b7f73375d8f4246a9974ca72b4fe150f7fd2fc55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892831, "uuid": "4c04a2c7-e0ff-431c-b184-87345b846186", "comment": "Malware payload (RecordBreaker)", "value": "e6499f611fe47c7ef7848947facce90329c8194747e539d32abfb2afd8c733d63cccab867de47a933eb473efc29d0476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892831, "uuid": "0cfdd369-539f-403f-bc62-cdb715cec7e5", "value": "T1D4D47D33B1E08433D2762B7C9E5B53A89C2A7E106D78B84A2FE41D8C5F3D6913939197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892831, "uuid": "19735b0c-379e-4507-8d87-313dee602901", "value": "222c367e9ac4d337d94bcf41d218e853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892831, "uuid": "791ef194-573b-4b64-8d0d-b73235403b3b", "value": "12288:U7hEmjpxH7rbl+6ji1aFDfPY9O2KCJcxeoo53Sc:IpTnJ+6cWDuqsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659892831, "uuid": "233bda19-8b94-4ac2-9f7d-3badc2c7514b", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659892831, "uuid": "99d28089-d7f4-4381-b801-01b30a8b8ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892831, "uuid": "22988b18-004b-434d-943d-1973d878ec87", "value": "524b292f1499d13b7acc1af8f6e0161b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947fee09-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842297, "uuid": "d17bc4de-c4af-40d3-95db-b0967df5125b", "comment": "Malware payload (Mirai)", "value": "9ceb13594eb13b4372fdfbd4396f24d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842297, "uuid": "4fe7b878-5f9d-4201-9ff9-197fe2e09bbe", "comment": "Malware payload (Mirai)", "value": "207c119886ac260dcef3b67063fe33afa6c9183b721e42e8393ad4f01c6ec984", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842297, "uuid": "fe85c9d8-7239-495f-9355-a41abdb765f2", "comment": "Malware payload (Mirai)", "value": "7edcaea0fca0d6d1e5dcf3206880b89d6edbe1ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842297, "uuid": "f8950581-6fe0-460b-8b65-ac5ee0085be7", "comment": "Malware payload (Mirai)", "value": "e0c0176acb0f15e30f516d3401c3a1c1d181113fd46e6ff1007770dd32ea508141cb3ba3f4c251abbd9b0e6bc5f27e96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842297, "uuid": "354c2236-455c-41ea-92e3-bcd9285f7bb8", "value": "T19F730751B8818A23C6E4237BF96E51CD372563E892DF3207AD212F6477C682F1D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842297, "uuid": "11e64d8c-a59a-4b39-b99a-80d6c8fff73c", "value": "1536:L0TYdvgcgQvt8ybKsyicfjfS3TL1PnVIahWlJsTh055JZTq35Ri1:L0FfO3lPnVThKB5U3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842297, "uuid": "c228efb2-b0c5-457e-a319-59e62503504e", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842297, "uuid": "4f3274e2-8d9a-429f-ad72-1f0b48d3fec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842297, "uuid": "16f34918-f93d-4bc7-baf4-9db63f2f0cf2", "value": "9ceb13594eb13b4372fdfbd4396f24d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7644bb-1637-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659866439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659866439, "uuid": "d2754fc0-a18f-4f9b-bbab-33a6e8ca3655", "comment": "Malware payload (Stop)", "value": "6b831064a7f28889fe118cf965cc92ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659866439, "uuid": "86ce3e4f-d1a2-4fed-98bc-6016fc75763b", "comment": "Malware payload (Stop)", "value": "20ec8ae5a8e4fe86e910d40b4db347a51b8cc84d4a851e8d000471e2933c20f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659866439, "uuid": "5d49c0c4-ef64-4273-aee9-dc2bb7e8d0f3", "comment": "Malware payload (Stop)", "value": "3733ea846fd1f885528a702c7fe6264665693e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659866439, "uuid": "63b91237-db18-43d5-bb1b-165892ad09dc", "comment": "Malware payload (Stop)", "value": "29bde851adb7be3e6823c78ee15e881a63ccf74421bd9b8565ef6cff6299e9bd9cdad9357b2c41641b33b638e3a86452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659866439, "uuid": "0e4b8c21-bfbb-4690-ae4b-b39fc8b655bb", "value": "T158050100BB90C038F1B616F59AB683ADB12E7ED16B2554CB62D93AED57386D1EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659866439, "uuid": "3343b54f-c589-46e9-838b-564558701fab", "value": "c69f2bf46d64c24653b01cc6fcf4d6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659866439, "uuid": "d31d2499-7a90-462f-90d9-95ecfc0f6bc4", "value": "12288:ST3e+l+Tzv+ifExDFP9vtudfCCujBq2hMP3sKhnMnqqalOk8vOhyycdUrpqU/NGk:m+v+7tzkd6XRhyPGqqxxvFkq6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659866439, "uuid": "c346f68a-36b3-4b71-9f92-8faf2f3707f8", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659866439, "uuid": "59e8d073-1ab4-433e-9621-99ca276ceed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659866439, "uuid": "0c66ce64-4c49-4195-9e10-dcf79b1d8f1e", "value": "6b831064a7f28889fe118cf965cc92ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d82eb8-1635-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659865537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659865537, "uuid": "c5207426-afa1-4b5e-8922-84a116897d44", "comment": "Malware payload (Stop)", "value": "47355f25f69cb3c56a29e338a4780b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659865537, "uuid": "b9bec333-2d3f-4b61-9a24-ce89a26b5629", "comment": "Malware payload (Stop)", "value": "22eedeec8258af5a76c94379b7984bb4e1d3a0aef8bfcb0554f34ed7148355ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659865537, "uuid": "fe51c179-6961-4a9f-98f4-8e9351e3c072", "comment": "Malware payload (Stop)", "value": "abd5ccebb3145e81deae46ec1278c80c7dc1b5de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659865537, "uuid": "a276ca01-4b5a-4484-bdb6-37ec3b1f4328", "comment": "Malware payload (Stop)", "value": "715d854cf1d2159fb300df1753c4d055d5fc267633e9e269b68520e78521306261627ea846293e448537e357c8e3959c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659865537, "uuid": "8c536263-edf3-4dc9-b790-0b24c881ad82", "value": "T1E9050200BB90C435E4B222F45E7A936CB93E7E90972514CB62E53BDE67396E4EC31607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659865537, "uuid": "4a3d45f7-1733-4c8b-963e-26c3780ff32d", "value": "08698d14d1e7fa83050959c8515b39ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659865537, "uuid": "a6c1bf19-5a38-4eff-aee9-0eed8007d649", "value": "24576:8ZAXzP+4bNZhjcvn5lyuDOO9TVfak7/gTTbMu7:8a39cv5lDNxVrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659865537, "uuid": "10760c09-f51f-4129-91b8-8d38ba847cb7", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659865537, "uuid": "07761a0a-bf63-449c-8428-25e6b797ed8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659865537, "uuid": "e4c60a6b-d2ae-4777-b4db-db55e3ffc20d", "value": "47355f25f69cb3c56a29e338a4780b92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94daab3-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842385, "uuid": "5b442034-3b49-43be-988e-8a83104879c1", "comment": "Malware payload (Mirai)", "value": "4e43d5183c550d9bb0a76d86ec906bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842385, "uuid": "e0c09619-ad3b-4613-abf0-eba640281075", "comment": "Malware payload (Mirai)", "value": "23c40e580430804c0875a2519bfb11244b1062bd37fb0f4f3b33a0b4d6135c66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842385, "uuid": "e7f7a893-3f5c-4c82-b377-c96eabaa73a6", "comment": "Malware payload (Mirai)", "value": "d1b1565a9f326b73c5e4f915104832ed07934d79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842385, "uuid": "92f8d5e2-f151-47a8-8296-76eb61b45626", "comment": "Malware payload (Mirai)", "value": "d88c001e7ca41f4d652035265e6364e302b3fba2454cdbb4743e55f595a064cba6bf3edc44f2a962aa93cc95946c44d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842385, "uuid": "4ab76c4f-6d41-4ce7-86e0-27364af5bda6", "value": "T1F3A3C60ABF250FF7D86BDD3709E92B06198C550A22E97B367930C858F64B21F19E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842385, "uuid": "d14ed699-cbed-4e55-a28a-2de4eb417a07", "value": "1536:5kkhyTy3yryaiNLVeMcWpIFqzSPfmoilIINZTB+xZD2wvxzWnx:5kQ0UMKJGWAoS3Ij+xCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842385, "uuid": "2ff98723-1e8d-4733-91ab-0a0e663c4f63", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842385, "uuid": "9f1a1233-b8b9-4f90-a7be-44cabbbae557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842385, "uuid": "3a34bbd0-3c6d-44eb-bc2d-a8de3831f2cc", "value": "4e43d5183c550d9bb0a76d86ec906bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c0a8d5-165a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Neurevt)", "timestamp": 1659881133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881133, "uuid": "22815869-c521-4745-bb92-55255c6b08b8", "comment": "Malware payload (Neurevt)", "value": "02e35d591e53085dc1eea9f64b718691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881133, "uuid": "1b37b9e4-2462-4c09-87c9-e2b712bb60eb", "comment": "Malware payload (Neurevt)", "value": "24316b3ae1c1bafee76ca8bb33807d37130a58bc6aa19042f06c304af59af615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881133, "uuid": "bb3010ba-df93-48ad-a0b4-d46b726dec70", "comment": "Malware payload (Neurevt)", "value": "6b579e43003cf746e9412774edeb3cb49ad9c9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881133, "uuid": "3891c2bf-eab1-44d4-9884-9625a0b0b1e4", "comment": "Malware payload (Neurevt)", "value": "260148d39f5cb2a8bc365295de32055a843bb72ac1b72f9d27be900487c3c01feb263cb3fea3038659300e057cc24c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881133, "uuid": "15d45df8-652e-461c-a39c-b5ff98b47241", "value": "T1BBC5F102CECFF8BBC7899AB194A35B2841D22F342459662A5C5C3F1505BCDFD3B796A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881133, "uuid": "6a696d03-9b7b-408d-a86d-16461e5bc0c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881133, "uuid": "32fb78f9-3882-4d3d-af01-90ff788fa650", "value": "6144:vFy12viwDdm49yWsKWstIqwQOZevSlmazLJV8n8Lwc57yG4:9ysvlLw/AwLev7iVV8ny6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659881133, "uuid": "0ca282be-4f5f-48d9-b093-7b2d1e43ccbe", "value": 2722291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659881133, "uuid": "b9b25407-a492-4497-9f9e-b287e77744f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881133, "uuid": "e3af4c1b-e1c4-4e7c-bd18-d94bef00944c", "value": "24316B3AE1C1BAFEE76CA8BB33807D37130A58BC6AA19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144d88b7-165c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1659882025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882025, "uuid": "8573fc57-76d9-441c-9406-e6e11daf0cb9", "comment": "Malware payload (AveMariaRAT)", "value": "197f3142621b9032694e389207aa6b4a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882025, "uuid": "dce66f8d-93a5-48a0-9a18-17613121f6e8", "comment": "Malware payload (AveMariaRAT)", "value": "24c7b2ff6e99c51401070f22e74c87bf181c38d0171abc9f332bb43f0d483875", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882025, "uuid": "5371fb87-0aea-46d5-8601-86a204848b7d", "comment": "Malware payload (AveMariaRAT)", "value": "63fab4db202dae0703aed654686835ab9418371c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882025, "uuid": "bf1e940f-d9c1-4f2b-88ef-558485a96097", "comment": "Malware payload (AveMariaRAT)", "value": "9778fbe090b81950e5339a6217716f44cc7ea724ca1e0c47854e1045bf131ea1637b7e4b232c022bc908d109e9b96e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882025, "uuid": "1787b3d0-874d-40a9-83bc-9a8ca5a32c39", "value": "T104E2E64673F85B33E839A3F82571660057F168ABB4A5EB0D7CCA30D62B6AF104142F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882025, "uuid": "a987ce54-3288-49aa-b7bc-dacd203e54d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882025, "uuid": "be50f36d-d6e2-4a74-b475-2217ca97c278", "value": "384:g77Rh9cy2uray/DhNIcpTFt/MGkvj4cR2ELpQw/D6nl2OC7TucHCEQOsm/V0aBn8:c7a117LrA0HV/5OotcIMDc5tuQsxYhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659882025, "uuid": "013bc962-1b20-47eb-a74a-31e97a198a53", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659882025, "uuid": "50093e79-614d-4fdc-81ff-ad10c4c1a337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882025, "uuid": "ab18ff4a-a6ea-4db5-adea-1779e80154b8", "value": "VPO - SP.9686 Flex rev 2 - BL65338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b0e68e-1679-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659894753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894753, "uuid": "b9b02a07-77c2-49f7-92ab-608ac580fc30", "comment": "Malware payload (Mirai)", "value": "82666f447b40ad095f0e8bb66544430b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894753, "uuid": "8b2d35f9-c5b4-4188-bbeb-c8a57d6777c2", "comment": "Malware payload (Mirai)", "value": "2513d06e0d5c804096695c5a535b0394587c46b3acc9231c2ad71e124330a911", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894753, "uuid": "9af1cf54-1d67-4768-bc13-ee6b17c2b93f", "comment": "Malware payload (Mirai)", "value": "aadbad7c04ed26b0a80eb686b2b42adb67fb6420", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894753, "uuid": "d125bffa-6df9-41aa-89c4-27422f47a2b9", "comment": "Malware payload (Mirai)", "value": "a2aba0da00337ca8dec00c92c8f2b92c7262790d4d0c99c6ba207b5e2f07d4efe185502efc61d4721338c64f65bd54b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894753, "uuid": "076a611d-7f04-4e77-99a3-4576a076d5cd", "value": "T18D13D64AF9519A13C6C452B7FB0E43CD3776539CE1EE72039D295FA627CB92B0E2A041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894753, "uuid": "0605c3b0-6a2b-43d1-91ff-fffb472fd828", "value": "768:jCLQhlW5m0rKnQsmxAGDwc14EdSkdd1mIlfT1KbTI/YavKM/58AHPqVXOZn:4QhlCm0rsmxv8kdvr5xKYQai+5RAYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659894753, "uuid": "7c5e8f2e-d51c-4854-a9af-e916068b4990", "value": 43792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659894753, "uuid": "839a8fdd-0593-4d8f-9d40-356008096881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894753, "uuid": "a6677a43-ba23-4f29-9579-a0f3bc210f8e", "value": "82666f447b40ad095f0e8bb66544430b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede74694-1660-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659884108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659884108, "uuid": "72e3696c-2a7c-4e79-89ed-6a136832a58e", "comment": "Malware payload", "value": "37d58e17051c7abab62ec3955d48e0c7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659884108, "uuid": "9b12ed6a-0e71-4d13-b9c5-6b5dd5aa18a0", "comment": "Malware payload", "value": "251eea43e33bc6a4f40e9cc38dfc8f04bcc7ec7a1ddd395ee934052f1ea5159d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659884108, "uuid": "3703fc9d-9d51-4090-b5e6-1a9eea0eb8c4", "comment": "Malware payload", "value": "cb1308185b40efcfa9e25e84a19b8b190f2e4cb0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659884108, "uuid": "a82c8be5-dd8d-43fa-813f-914c3497723d", "comment": "Malware payload", "value": "f7b40fd17af82a5e6e27372d16542f2c3c8f9050f6ca7acc09d7c7490d713fdb261fba6f30d80e9b94b7b9d1e67099ce", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659884108, "uuid": "96b5f9ad-b9e2-4bf0-8cc7-d60ce62a415c", "value": "T1E2B61291E32D941FE8F7503048AA4262A5945E8489A7772F3E1CF64DAB776C43F98FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659884108, "uuid": "84ec0507-082e-4681-9ce6-fed6604d854b", "value": "196608:e9RYEO7McsfocCls9R5tHzQmi6SNHdNtppDV8UcEQlNaSRuDk58A6:ebYEOYcxcClsptHzeN9LfyNIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659884108, "uuid": "b5eeb758-e491-4920-b1cc-d2c6f0ade7f2", "value": 11361342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659884108, "uuid": "5f58f1c4-a666-4ff0-84dd-6b069c19ff6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659884108, "uuid": "640b795a-fadf-4a39-86bb-bfa6dfc76385", "value": "QRScanner_1.1.0_14.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecffebc-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831818, "uuid": "be23e1e5-01b8-47aa-bc6d-6c850850c72b", "comment": "Malware payload (Mirai)", "value": "19915ced6da24df5e7b493d5a4669a16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831818, "uuid": "676322bd-3728-4d2a-b8e3-43eeae1bf87e", "comment": "Malware payload (Mirai)", "value": "2af8777b4a19c8cca6b9eea171a369e31aa667faa158e6ee6e98236dbd6d82d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831818, "uuid": "e7c41f0d-eeaf-4eb0-97c3-3d1e36b202ea", "comment": "Malware payload (Mirai)", "value": "031a854ccf174466608522af8d102f8bc5f4f750", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831818, "uuid": "2a67f16b-92d1-459a-8563-29143335e002", "comment": "Malware payload (Mirai)", "value": "97fc774dff276b75e84e2eec7014153eb78abeafd5034627bf09a39832ec5506477dbeca9e9ec0fdde8e9be03f455e65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831818, "uuid": "1b8392bc-38e6-42a5-afad-4e2e5ff6672d", "value": "T130B2E060BD4199D3CAE10E31E7FB810AA14D167AF61A15543BD2DBBABCC30C25F6C4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831818, "uuid": "e2978e62-a533-4f9c-a677-37494afeba7b", "value": "384:z6cYlsi7D+6KjUlREC49loZLRA0TK4k6f5V+ReqO3JSaY25kR7FjXhV3mdGU5EBg:zWlsx6KaEt94RPTXBv+RevSyg7FP33UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831818, "uuid": "1cf6121a-5e96-4cc2-9be1-d0d2fc2bb593", "value": 24292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831818, "uuid": "0d762c17-960e-455b-840d-54375dc40f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831818, "uuid": "8d39de14-8eed-4c19-aa9f-889ed51418c9", "value": "yakuza.arm5-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d764ac68-1622-11ed-93bb-42010a9c0043", "comment": "Malware payload (N-W0rm)", "timestamp": 1659857441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659857441, "uuid": "d27d3589-2da5-466b-bf93-a0c05f6df450", "comment": "Malware payload (N-W0rm)", "value": "379a6a4f7be0d0e21a5e5b996ea8aeeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659857441, "uuid": "268b79c3-ed15-4e06-824f-34237e71541a", "comment": "Malware payload (N-W0rm)", "value": "3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659857441, "uuid": "99133c16-a01c-41aa-851d-997d2ea3f888", "comment": "Malware payload (N-W0rm)", "value": "27df283dcb89ee72f304df89d3938239acc32439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659857441, "uuid": "abb7e3a8-0212-4c0b-a7cf-d28bdc5b7579", "comment": "Malware payload (N-W0rm)", "value": "b65e5d397a23ff6ba0a43842dc8cce50fadb8e7ad62a6374dc44ac517ced9cbf1ed0e8b970719b4a4e77ecacf8dd1120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659857441, "uuid": "0903dcaa-0849-4c56-9066-b550cb32cbab", "value": "T153456C35E70615B4D62357B1C6DEFA7B9B14BA248022AE3FFF4AD90CB9331027C85256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659857441, "uuid": "41d6bddc-c35a-4382-b277-3ccde421ea4d", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659857441, "uuid": "e8758787-c601-4e37-b78d-4461fd352157", "value": "24576:E3J4L4PuehYxYVX8wALgMlpdftuveocvtRp4jSLSfpACb:+4L8u0pGdYfpACb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659857441, "uuid": "b4ff8d73-f6e2-4251-89a1-98a64a5c3310", "value": 1251120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659857441, "uuid": "d2d06def-ee5d-41eb-ae48-344236b1a301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659857441, "uuid": "1be82a48-914f-4411-b031-8be7ac0e7195", "value": "379a6a4f7be0d0e21a5e5b996ea8aeeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579dd945-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902753, "uuid": "f0dfa046-6de5-41a4-89ef-786e9fb0ea09", "comment": "Malware payload", "value": "63ff613de754ae03826ced6466992916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902753, "uuid": "628c4158-eba8-4695-8b8d-9e7f56cff32b", "comment": "Malware payload", "value": "31aa6cb290ab3dd88ffaf72c43097af2bf172d09a8df6c66c36af6870811496f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902753, "uuid": "2e20d9bf-113e-4e63-8d0a-b5a4f042d10a", "comment": "Malware payload", "value": "7ede44e1209218ce9d34de174ff9a31d1a044f75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902753, "uuid": "b33a9664-e0fa-42bb-b825-758cef66cac7", "comment": "Malware payload", "value": "00177ebeaa771bd5d6ac39b003bf945fca4ac73fe9e802d60727f9322771c0ef5a189a3e60dc22792112870c12c1f21a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902753, "uuid": "7445645e-4915-4fff-b0cc-3f7384cc801a", "value": "T165E3F63F3B672F63C4C501B241E75334A8AEEE8C39A64BD3B9897E691E7859434443D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902753, "uuid": "e72547f1-c41c-4f55-88aa-c76e16571294", "value": "3072:sbY/Ja+Zz17l6NP/AKQ0ztmY0E73GZgk+O:NRa+mlK0ztmY0E73GZgk+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902753, "uuid": "056ca092-a7ac-4e2f-b479-a7fdfd919a38", "value": 147152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902753, "uuid": "b8615d0f-eb7b-456e-9dce-719d6055ec97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902753, "uuid": "62379922-3977-4f63-b0ec-271a3e9e250d", "value": "63ff613de754ae03826ced6466992916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad46051-1640-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1659870037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870037, "uuid": "d58590d3-f201-4c0f-9409-86ddf7bd596e", "comment": "Malware payload (njrat)", "value": "4cdd9265668a6c5dcc8845deedf79802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870037, "uuid": "82882513-d790-40e1-887c-ecc75ff357da", "comment": "Malware payload (njrat)", "value": "38b152d95fa2fec41b84833f70030ccce86c2295bcef323c7ee804591f0354ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870037, "uuid": "30d66d83-5385-4460-bc3d-4b26ae29f52b", "comment": "Malware payload (njrat)", "value": "8d68d14889d771405d5d55efeb6e4e4ef0d6a2ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870037, "uuid": "f7d871d7-ca25-48a3-a390-7ad6a086f7fc", "comment": "Malware payload (njrat)", "value": "3a750ef1704c4e030eed841d0edca3a99b71d8b16c69680dd2f43b0dfe9c96bc8b21e8e8b545485a6d95a6f85548108d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870037, "uuid": "9c69f824-6b0d-47d3-b9fa-76f1fcb322c8", "value": "T192A3D0ACF6E64565C1BD59B605B1520003B0E043D633E76E1DCBA4E62F6B3D84BC9AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870037, "uuid": "ebe08dbd-695e-4846-a81b-3a98cdc9397f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870037, "uuid": "324d8acb-2693-4643-8572-d98134190471", "value": "1536:BUKAVR4QVkwjkjGFJMwvwdzBpvugjWGqUAcLSJrkhgfgd9eF:An4TwXFJXvY7ugiKUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659870037, "uuid": "b8556931-c5aa-4f32-a074-72663c38e1e0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659870037, "uuid": "4d393d4d-07be-4e7d-956a-1809dccee34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870037, "uuid": "8f95dc27-85d8-4384-93f6-beed7208eed7", "value": "4cdd9265668a6c5dcc8845deedf79802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852ff21a-167a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659895099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895099, "uuid": "8593606f-47b0-4c1d-a97b-dd040943be93", "comment": "Malware payload", "value": "72c812cf21909a48eb9cceb9e04b865d", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "AutoIt trojan", "colour": "#E8F447", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895099, "uuid": "968fa229-f917-40eb-9c10-3d8740fa781a", "comment": "Malware payload", "value": "39fb927c32221134a423760c5d1f58bca4cbbcc87c891c79e390a22b63608eb4", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "AutoIt trojan", "colour": "#E8F447", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895099, "uuid": "712c1873-c28c-45c9-87b0-76355fd4ddab", "comment": "Malware payload", "value": "2dc265f23be4cf7cda328bdf5826601cf4f4bf43", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "AutoIt trojan", "colour": "#E8F447", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895099, "uuid": "867ef77c-a470-4b59-99f1-558d77b78203", "comment": "Malware payload", "value": "6bfabb06d7c9c340ce46fc1937860d0298142d69a2db1bc543f4c764d46c3e512c604e7054923941b06de07c49a54e64", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "AutoIt trojan", "colour": "#E8F447", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895099, "uuid": "a6310094-a267-4dbc-9de9-74e2fa222773", "value": "T1E374239D91284FD1820504F0EFDE8DE562CA49E2168C3E867E9B45D16F33FA1B4826FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895099, "uuid": "f439ec55-b986-4946-857a-8d41a83166b8", "value": "6144:zB1De0g/RC7lTqMAwraJOZMtXEHJGPSgwsTx/xE99jvQrZqZDxlK0oZ9TK2A6CO8:6+lq1wWAZMtUHJGPksFJYtdlK5TXuWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659895099, "uuid": "6a6d0fbf-ba99-43dd-b520-3fa7e1157d3e", "value": 358546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659895099, "uuid": "08f74b7f-c2d8-4301-a020-b33c5a8a7c0f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895099, "uuid": "a6bbed11-c8fb-4b29-803c-45feefa92281", "value": "Material.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a69979-1640-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659870135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870135, "uuid": "f6348245-eee5-4b0b-8e14-bc09973199dc", "comment": "Malware payload (Mirai)", "value": "bf23538b68a80003a32e4dcc6b3ca3cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870135, "uuid": "c978a6f6-af4f-4456-aac5-316ce2b7bead", "comment": "Malware payload (Mirai)", "value": "3c33ab1325e1b2a27ed83bf665e4782f2cc883bab13c9bb8cd3e6fa9de60e78c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870135, "uuid": "eebc1602-70e1-4da7-ac17-88e873c74426", "comment": "Malware payload (Mirai)", "value": "0e475a7089996d93fc355882d049fc2f72b87b22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870135, "uuid": "b33c650e-6646-4830-9148-ad872892d4a7", "comment": "Malware payload (Mirai)", "value": "c619a5d264d57749b276e261756cf20eb41171d6639c27a3a63317cb08b75a1cd10cf44fdbb62b5ad125144ec9df01bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870135, "uuid": "89effcbf-5248-43b9-a0c6-f13fc34ca5d3", "value": "T1B6B2DF9480D0C805C84777FE195F02CED462ECA20BBFC791AF5BAE4B5AB71117A2DB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870135, "uuid": "8fc49c5e-bc98-4998-8e3c-9e5990b3e2c2", "value": "384:MviiBi3f2PSrf64K5WFSlvNjJ6sj6mUCNzjY1oP+fyfJYt4+jLMM957TYtziTv1j:BiBiv2PSbePxNN27CtFYa+jLT9VYtuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659870135, "uuid": "3ed3d4c0-d826-4798-8a6a-3f2450b0d01c", "value": 23432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659870135, "uuid": "d3a1460a-4cf7-49fa-9a0a-fd0fb7030d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870135, "uuid": "cb8a1e1e-ec87-4921-9bdb-31abc79ed266", "value": "bf23538b68a80003a32e4dcc6b3ca3cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69e83c0-16a0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659911610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911610, "uuid": "cb5f7999-e4cf-4ace-a527-0fbbafc81011", "comment": "Malware payload (Mirai)", "value": "d6fa114772e0456c9fa550fb66ce930d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911610, "uuid": "b53b523f-f586-48f8-aafb-16f757c64fb5", "comment": "Malware payload (Mirai)", "value": "3e9c0c9663e762a7150223cf6c43878309107b7a6d2356f3f5c9ff89d2b19107", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911610, "uuid": "0b82de5b-1ebd-4f5c-b91a-5190f8a6f187", "comment": "Malware payload (Mirai)", "value": "8d20e5b79bee753d348dd9e11657f60931fee9fa", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911610, "uuid": "ef1de46d-51be-4f40-858d-99c5eb0a3d15", "comment": "Malware payload (Mirai)", "value": "53b36c9fcf0cf3bfe5e7602ab9c79b256a84c71a08fe1b7a72d0570a06cbc44b95d35c6b933bacf17cc301aaf88567f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911610, "uuid": "cdc614bd-42d7-407f-a958-b012acf99f71", "value": "T1DE331903B846C0FCD55AC2B199AFD572D632B8AC51307D6F0788FA722F29E31665EB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911610, "uuid": "fd2d1b16-c418-456c-a1f4-1fb8b437f04b", "value": "768:NgplhD19+0yAuhIlCmTRP0IuYebtkaBLtR40Nj5UEr:ijxyUCmTRzL0JtZNjZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911610, "uuid": "9c007267-299f-4bcd-b551-5dfcef428698", "value": 52296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911610, "uuid": "0bd9455a-e5b2-4ac4-a667-821bf88ec4eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911610, "uuid": "b23a5d60-7e57-49e2-a812-d70625f8e088", "value": "d6fa114772e0456c9fa550fb66ce930d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2802f022-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1659902674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902674, "uuid": "d9c26009-669d-4d3c-bebe-8002c9b902ae", "comment": "Malware payload (Gafgyt)", "value": "6cfb0b3010e880ae51d9318884b71856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902674, "uuid": "15f03a32-4f9c-4fa5-a93a-b88356efaa05", "comment": "Malware payload (Gafgyt)", "value": "3fea4a5001a0bfbaeba14df35b892d6b75e81d3b9f89bb5b32586a2715abb2d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902674, "uuid": "3497ffba-3e10-4027-82a1-39ed20a44a42", "comment": "Malware payload (Gafgyt)", "value": "466d418df3df27cae808fd595129379251336c1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902674, "uuid": "5072cab7-1f85-4611-8baa-f3367f439ee4", "comment": "Malware payload (Gafgyt)", "value": "ed2171038c733b989d62113449d9d449df7b27847e6f3f1d3dad7de4eb5df8b4e455ea2fbe00c0f295817d513d53e3ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902674, "uuid": "1efcce6e-ecab-49fa-b9f7-9d19fe2f3fec", "value": "T194E32801D4504B6BC2D367BEF75AA28E73721E986B873319C718BEB01BD07A95D3D212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902674, "uuid": "2a97ba15-ce5f-4a62-b1c7-62b2ada06316", "value": "3072:gk6317g6Cy++t/8teKPZvYZFaqcaJJYD1yHVim6HcPgJGmyOEQrCUEGT:b6wPZgZFaqca9VijcPAGmyOEQrCUEGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902674, "uuid": "98231f67-4e63-48f9-9aa7-1adb70a3aec2", "value": 156463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902674, "uuid": "770c9fae-0697-4894-bc67-e7ae5c72e786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902674, "uuid": "adbff924-d4e2-43a5-964d-580511a09005", "value": "6cfb0b3010e880ae51d9318884b71856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29670b17-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831809, "uuid": "0579f619-82dc-4180-89a8-970af7d755ba", "comment": "Malware payload (Mirai)", "value": "90fd9c129c4e37634f2521307ec9bdae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831809, "uuid": "e1af730e-fc43-48ed-8b04-d5f4a7bd7926", "comment": "Malware payload (Mirai)", "value": "455468d0425ad0fd7f11d4257e77e395510e9f700c7da2448ab1a68446cbdca3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831809, "uuid": "492c38d7-15a0-4d5c-ba14-ac78d7ab574d", "comment": "Malware payload (Mirai)", "value": "c1cc677b705d477e5d2caa9dad59ef4ca1fb23d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831809, "uuid": "9eb0efca-8d04-433b-b405-4ffb1e2a2c91", "comment": "Malware payload (Mirai)", "value": "31f35b000e9a69db5cb440c35e658451a867eac850612b0366513f78059951387b96218d2da40699095238a706e99c66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831809, "uuid": "a92928aa-121c-473f-a7dc-07c138c6e530", "value": "T1FAC2F1A1365F0C70C141D7FB6768851DC175EF4013F4C9A24CEE9BAE2FB69892E1081B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831809, "uuid": "10fcb4ee-9602-4f44-b335-73765083f1db", "value": "384:Msp+H4vr9fzyHMkJ3Wo6+IlVxJQw3anugx8n71CggSbmXecX/rhaKMFNK7YKVU:9/vZ7AJ3V0HQa1gU8PSbmuY/ryK8KVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831809, "uuid": "d407782c-037c-4021-92e8-6e39b371dc5d", "value": 28136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831809, "uuid": "c1e2bfc6-4999-46e7-af5b-9ccf3787736c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831809, "uuid": "6ccd9be6-9700-4717-82f6-198dd26504c2", "value": "yakuza.x86-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d79bc2-1652-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659878023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878023, "uuid": "db170166-1d12-4ae9-83f1-12b6fa6cb21c", "comment": "Malware payload (AsyncRAT)", "value": "6df8f9c4b35c6e66495411542d78ce56", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878023, "uuid": "4dbe7408-064e-41cc-8039-3a4c0af654f4", "comment": "Malware payload (AsyncRAT)", "value": "45b2bf20c57c6abcdbe51abaa00885ed9cfe2b64adcef0cb8db055def98621f2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878023, "uuid": "7165dfe2-dad9-438f-9157-676c18a2d24b", "comment": "Malware payload (AsyncRAT)", "value": "8c3410c30913d91655c2d5eadd4cd3e06362d5a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878023, "uuid": "70aec6ba-e445-40c3-a08e-04dc7248cb7c", "comment": "Malware payload (AsyncRAT)", "value": "9597e8d0d7b029ae4e99c150642b3226579a930b1a1b95c83a0c0706b63cf2f41de5dec9d4f37c3cb1ff7b1ecde676f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878023, "uuid": "5a52a43e-8ca5-4be0-a5fa-1aa9ac0c832d", "value": "T1C2232C003BE8822BF2BE4F78ACF26145867AF6A72503D54D1CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878023, "uuid": "97e93a8b-3e52-4a72-b53c-c2fd9d4fa046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878023, "uuid": "a886a3b1-9601-43f5-ac62-e0cf8b812e03", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3ig6iRFb090D3URXBDZSx:vuwCfTgp/2OKYDy3bCXS/iTYujUjdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659878023, "uuid": "71e7ad45-0403-47f5-bb25-a59c4c1acf32", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659878023, "uuid": "133cfcf3-3841-4a45-a7cf-c65a297d42d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878023, "uuid": "538b98c3-9fb3-4cea-864c-b694d497f1d2", "value": "6df8f9c4b35c6e66495411542d78ce56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9ef729-16a7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1659914544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659914544, "uuid": "7fab888a-fae4-4a03-bdfa-3db31d74bc0a", "comment": "Malware payload (RemoteManipulator)", "value": "773d1b7a96cc0fbba599e43eb8092592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659914544, "uuid": "a268ef26-a91d-4ef1-8ae6-73ef63c5c1e3", "comment": "Malware payload (RemoteManipulator)", "value": "45e104696a11a2a22dad21ca1b9cf5456444f47130b059ca1952e7052264876d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659914544, "uuid": "efe0f8da-a33f-4d06-bd77-f212ae0dfb07", "comment": "Malware payload (RemoteManipulator)", "value": "2c5aab7eea3ac86e543ec537d5b8149d4c9d15d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659914544, "uuid": "c5806bd5-1b74-46fd-b702-66375bb55d56", "comment": "Malware payload (RemoteManipulator)", "value": "46e46e7835e550f05cf64a968ee4e118c12b39c6f79edf97c4f4dfb996d14b2707227defc3c11cea0cb38827846d6bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659914544, "uuid": "42507abf-e48b-43b9-9d41-d35babf125b0", "value": "T18B1733C3FBF00859E8BB577598F65F1C4A3AEDACAB74530D09D0F229647398208662D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659914544, "uuid": "edb95feb-34ac-4ce5-b489-a20c03217caa", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659914544, "uuid": "1cf8fb03-84a3-4fd8-94ce-56d11ca30269", "value": "393216:77+HEoyBneMDHmIraWad0tyvpreOQ1YIJN/RQo1gEB0j:7aHEoyBegmoad0LONg5Qo2tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659914544, "uuid": "fdcb5199-f324-4aef-b59d-30b0e6e71db2", "value": 18715632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659914544, "uuid": "a87e4837-79a7-4803-b110-9eb531c7dd03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659914544, "uuid": "daaa7c84-b32f-430d-950d-738b95550e3d", "value": "45E104696A11A2A22DAD21CA1B9CF5456444F47130B05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a9316f-1677-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659893722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893722, "uuid": "11c65a42-62d7-4a62-b7da-a0e4790f9504", "comment": "Malware payload (Mirai)", "value": "b2427b1015d9ac6a0c2426c57a2996cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893722, "uuid": "573b6141-e5c9-42a6-ac05-dad56897c151", "comment": "Malware payload (Mirai)", "value": "4636a2ed185e746a901b730778af3a05a38383e5e557a94dbaf2dbe07540f036", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893722, "uuid": "177b7102-341a-4fff-8a1c-7fe7f0264cab", "comment": "Malware payload (Mirai)", "value": "0167fd6fadcdbd5c29bb35d2589f2e7526d39758", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893722, "uuid": "19597245-e26e-4ed2-83ae-9dfcb9753ed9", "comment": "Malware payload (Mirai)", "value": "1efc0321800caad8fa86f6daaea381b5ad226be90265504ae620c4a8f21c0f7be7a83a3e3789f9f1255bd951890bb26a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893722, "uuid": "80cbd525-8cbd-4873-ada6-18edd568d65b", "value": "T170036C8CD403D8FBF81301F121AA5BA1A9B6E179646ADC96E3943934FC66D41E30B3DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893722, "uuid": "2dd56f53-dee9-4a2d-86d6-33f38a35f3f6", "value": "768:CuTdzo/t55IOj9SbI9VLb6hup+2VmDX+N54fd7uS20KVbbuVmarQQ:CjlLdj9Ss9VLbUup+2VmzG4VySJgbbfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659893722, "uuid": "134406fa-7bd3-4bd6-b445-df79d702627d", "value": 39448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659893722, "uuid": "be314218-b3e0-450a-b216-cf5d8b1fabac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893722, "uuid": "ff448178-de33-4d81-a408-74471ecd9ab7", "value": "b2427b1015d9ac6a0c2426c57a2996cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9865ea-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831816, "uuid": "8babcef2-38a7-4cf3-9b26-0df63f63274f", "comment": "Malware payload (Mirai)", "value": "4e98466129dc1a3541c3d9f6d3bd5cef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831816, "uuid": "2523e1a7-40d5-42a2-a70c-03210ab2611f", "comment": "Malware payload (Mirai)", "value": "46c53e2be47d068b6e5f5aa5ba8cbda08e74eb40156d8f02a641597f711fd581", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831816, "uuid": "b86412a7-3c67-4516-978e-9f2677f0dde0", "comment": "Malware payload (Mirai)", "value": "6886cf06bf00fc0cd6164dcd9b0552691c3e4d22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831816, "uuid": "40679cb7-8f56-432f-94e2-205c29069f54", "comment": "Malware payload (Mirai)", "value": "468e1ebb63a9723b314285bbc7cf1b09a780fad8742b88b6818b90bbe5b4efb32f2978fdfc068a68c15b20a59ef7e7c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831816, "uuid": "bc830d2d-c9bb-4f18-b473-1ad4376189d0", "value": "T14C330192F89D2372DEB244B7ADA0D90332EDFD50F4B62AE91D50E35E88558A781B3D01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831816, "uuid": "1ba6b876-8753-4d15-8dc8-58266ebbc4b7", "value": "768:PbtZQInh96Znruky/jHsMZ4TfodPnmhLXdVHO1xgq3UIrvsdYFgsf6+gJfJEdpob:PbLt96ZnnyLHsMCanmduP3jsSqLJWdNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831816, "uuid": "9c1ce638-0bf1-447d-ba82-9877b97bf70c", "value": 53288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831816, "uuid": "c87df5b4-ddb6-40f8-87fc-0eb520bdd89c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831816, "uuid": "924d284f-d03e-4f64-bcfd-4470a666d2c7", "value": "yakuza.arm7-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a27b63-15f8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659839074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659839074, "uuid": "eca985fe-36e6-4cff-91f2-1e2ac85f159d", "comment": "Malware payload (Mirai)", "value": "d2a8de9106b1f2aa8e6f9e9fd8998d78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659839074, "uuid": "f5c969e1-dd0d-4ba1-a7b8-90ed8364741f", "comment": "Malware payload (Mirai)", "value": "4738c6f6834d93b3dca1ad952c297fa362afeb7ca7eabf0278813a7f3f4b3d9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659839074, "uuid": "61908cc0-f266-4031-9350-fffd14363321", "comment": "Malware payload (Mirai)", "value": "4a14fea94bda96314f7327ebe1311b8898e55eea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659839074, "uuid": "f4c5f3cc-57e0-43fe-a950-66371ea252ae", "comment": "Malware payload (Mirai)", "value": "0450d97e0fa159901efd371124b732618306a87da5d63151b9bb0cc83127148bcd77e00c65293eee243b14c784d965de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659839074, "uuid": "43828052-0493-4074-a1e0-03814ab69b8d", "value": "T165735CD9F4024E3CF98BE5BD90160E05BD6063D567970F2BE2AAFCE36D731546A02E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659839074, "uuid": "81d247ad-e5fc-4576-a88b-93d8a857cf4d", "value": "768:0ecFz+oFABep23g1vjPlHuJ0SWXXPtAxAXuS8ohEh83ErYrTqwVXWT4Nr:02623g1OG/T+S8ohnErYruwVAkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659839074, "uuid": "d98c6545-262b-4434-9274-20f9e9e6de39", "value": 75928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659839074, "uuid": "0c4e679d-b2c4-4762-8470-2488e25b67dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659839074, "uuid": "0fb86a6c-0787-4f8d-9857-bc20a132e914", "value": "d2a8de9106b1f2aa8e6f9e9fd8998d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59eeb428-1624-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659858090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858090, "uuid": "3b198fa2-4f83-41c9-8e44-3a337670f4ff", "comment": "Malware payload", "value": "ad8b80c0695f49d20ae8bb90ca6d26a3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858090, "uuid": "87b85fe0-253a-4e05-b3ce-c6b17bd406ea", "comment": "Malware payload", "value": "4aaa5e91a2974bd499ee8535b9772e03d4390f83c2e51f1577bc448539b00625", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858090, "uuid": "d78a29c9-1339-4c2c-b696-87ece5a421cf", "comment": "Malware payload", "value": "2a64c5fea12113671af519e7a0257435a9017e86", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858090, "uuid": "c0b15f72-3e67-4b95-a7c3-4197e1379d93", "comment": "Malware payload", "value": "088e8e7f22be5356649809b5fe3f81605eee772d7714cb4b3c8bcadfd12d96432571b951a4edb9d871be4a2bcee280ee", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858090, "uuid": "600a008e-1acc-4288-8c16-1f73505dd6ba", "value": "T15565331316187C30DE99A2B256ED6DF03196A944D20F43481A3BD42FB5FA58F7B822FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858090, "uuid": "a239debf-0e3e-4ed2-aed7-a338d7db887d", "value": "24576:hN2Mi9M/PDXiFJsDbKJePjMPJuWF5qVKDss/s3giV1aCCGqnVxcAGVmjnHqT:hZiGnjYJgLPScWb+0HE391MGqVxcZVmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659858090, "uuid": "cf912329-c509-4e67-8ae5-5932f3a14623", "value": 1544233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659858090, "uuid": "5cd65f61-1f3e-4a0d-a303-6b3e87ed0759", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858090, "uuid": "deadb14a-5a17-4ce8-8c64-fe80c3c78265", "value": "SecuriteInfo.com.Trojan.GenericKD.61201629.21049.20622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d9e0f0-1651-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659877685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877685, "uuid": "4b9f965a-fd1e-4da0-8df1-d74d05f84918", "comment": "Malware payload", "value": "dfe5059987959d113bb9efab9f47fc64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877685, "uuid": "645af6f3-86e2-4896-a838-680d11367fc3", "comment": "Malware payload", "value": "4ed47e57c12d786f6a9129d978ad73b26a1c42b82ca57ea3d5965227c39da303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877685, "uuid": "c3cdf838-193a-4e8a-b58c-d128402ef072", "comment": "Malware payload", "value": "9f6df69d768aa01a90923e902fd5ff913e714455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877685, "uuid": "cbb8ab15-6588-408d-92ab-e539c997e79b", "comment": "Malware payload", "value": "6da7c2abf447f06e00d145fdd5b3bedf30452e183667fb0b640e611c77114e57d28061c288cafd7fce2f54bf09e73c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877685, "uuid": "90f04681-1486-4da2-9708-59397b7b4799", "value": "T147F43A2D5594F4F2E231F2759441763FFAA23F45026625AE13F0B6E30FBA27087AD618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877685, "uuid": "b7dc77c6-8df3-4d59-b418-b67fb996d8aa", "value": "69768c52c1392fbdd0a1dd85330d09ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877685, "uuid": "5f5d2a37-388d-4991-9f5f-e388cb792d79", "value": "12288:KlcDtxlYGY1XHBsVNsr/pamBNAYiPXUwcfseGBys+0PWEdZHGOUxOoqbX+u6Fb3I:/DG9aqAYi/UwEsh+0/dZHGOUkoe+/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877685, "uuid": "296c849a-a9d9-4d5e-9828-d81c02fa9c2d", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877685, "uuid": "87f5bc70-3e70-4050-9fae-5396af9fa769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877685, "uuid": "9ef9aa87-2a10-4195-9cd5-bd1e642136af", "value": "dfe5059987959d113bb9efab9f47fc64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc41a08d-1652-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1659878011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878011, "uuid": "d1e392d5-4025-4d95-bb2d-b918190d5c92", "comment": "Malware payload (AsyncRAT)", "value": "52ed92c27eca6156a71d9c1af2a3b249", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878011, "uuid": "4204797b-074c-44ae-93f1-9e5a585786b2", "comment": "Malware payload (AsyncRAT)", "value": "546eb85717e02b1d16df99eade200e4bca7464014f732f62c9c4d3885b1a2854", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878011, "uuid": "35c96e27-5e1e-4b6c-bd1f-db6834069683", "comment": "Malware payload (AsyncRAT)", "value": "cf490003c793b10bbabfeb126933b60f10bca8f6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878011, "uuid": "2d4bdc7d-735c-44fc-bd83-a7ebe5ed9cbf", "comment": "Malware payload (AsyncRAT)", "value": "aa3924637b980378802d2a845e5ddb0507cd3849d3e520b538aab4364dbc6b79c50077699f195880c4330a193f05b673", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878011, "uuid": "23e44c4a-3974-4ccb-8d3a-21573cfe6b6c", "value": "T1B1C4D0D09317EE73F02876B3B550910C2B20562E81E5D57999ACB8EF70B274B1AF5E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878011, "uuid": "0c768291-40b0-4b2a-b1cd-d772f732dfb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878011, "uuid": "85adb8e5-253a-4716-964b-73a355612827", "value": "12288:/b1g6SKlpxO2/KfQ+QJVODBhux2IWq0n:/bTLlpxR/KfQ+3rHqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659878011, "uuid": "b7fd1fcd-4cfb-48f2-a42f-05df7774d9c9", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659878011, "uuid": "33d08e94-f361-47a5-a877-b331fc4c8414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878011, "uuid": "1212dc4c-7238-46c9-a7d7-b6f1f9c2756f", "value": "52ed92c27eca6156a71d9c1af2a3b249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198fe3d0-165b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659881604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881604, "uuid": "aade708c-acdd-4d50-b60a-fcb49955a43b", "comment": "Malware payload (Mirai)", "value": "5a2fe024029c7b8894885ded5f08e42e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881604, "uuid": "74123b77-592c-47d2-9764-0498a91db218", "comment": "Malware payload (Mirai)", "value": "55ff25b090dc1b380d8ca152428ba28ec14e9ef13a48b3fd162e965244b0d39b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881604, "uuid": "f43ac869-4035-4104-811a-edc71db8d03c", "comment": "Malware payload (Mirai)", "value": "564ce63b3939e10fd8ae3df1bc764083582707bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881604, "uuid": "a5e0b275-79c1-4571-b09c-4ba9487dccef", "comment": "Malware payload (Mirai)", "value": "bb9c2754504de93974df56c9666da9fc976d2b9a9b3396927a31c20338528659496e4352f455ec013362b40100a4ab26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881604, "uuid": "051886dd-f6a5-457b-ae71-29a640ba1471", "value": "T17F833964E4CCDD15F5D22676BE0D81BD372667E4D3E6F112CA2F9BA0238648B2F26341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881604, "uuid": "05ec13eb-b3b5-4cd0-a093-19fccbd9ad54", "value": "1536:m5FPKCK7PgSb2MccOcuJlyKzKWftZIgMm4+iTik:sK7Tb2M3OcuJlyKmItZIgs+Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659881604, "uuid": "907e2c93-118d-4cfe-9bd3-e2ad7dd58111", "value": 87484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659881604, "uuid": "06756924-b5ce-4ef0-b0fd-1bc2cdffbe26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881604, "uuid": "1f065c97-04bf-47af-8522-26f2e06ef1dd", "value": "55ff25b090dc1b380d8ca152428ba28ec14e9ef13a48b3fd162e965244b0d39b.elf.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3927a9fc-1611-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659849874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659849874, "uuid": "04021dd4-3939-40dc-83b8-7aa9a2f60790", "comment": "Malware payload", "value": "2b73910ec4bcce1fbfc1a81d3d29f2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659849874, "uuid": "c32107dc-7b38-4ce1-95a2-69389a45db7e", "comment": "Malware payload", "value": "5636b99242d2f26e7ed420b54b0ed45da6cc6f360a531ef89b467c973347a2c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659849874, "uuid": "3853eab5-3dff-45c4-af1f-d920155a99c2", "comment": "Malware payload", "value": "13b879d791cdac86e59c7150d15bfac9ae13d749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659849874, "uuid": "05b48b8a-21ef-423a-8774-99cfbaa7823a", "comment": "Malware payload", "value": "fd928bd94c290a7591e57371a94272da7bc73c38651aed269c1cc7c0dfa3a94000c5e83ec1f903879b99a351c143da0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659849874, "uuid": "b71d0dcd-ca18-4899-a2a2-488f9568f880", "value": "T1B5852368EA80C027CCB72A313A54AB16C375BE23057592971B857F373E713EA5A7931C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659849874, "uuid": "2a6ae9e8-94c2-4df5-bead-82e6dba9ffe9", "value": "65d6a9688f009ae6cdbcf245e165220f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659849874, "uuid": "d673eece-d9d4-41d2-8540-eefe30f6d486", "value": "49152:voxjpz0Y3YbijUZhMUKLfVrb1wMiyFVhJ6rQcsP/LBY:wxjZIPCpj1b6/yn+r+P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659849874, "uuid": "c1e309b5-9e5f-48f1-94e2-624d120eb267", "value": 1816472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659849874, "uuid": "53c8086d-5279-4e38-8b1f-673ff6de897d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659849874, "uuid": "5b4d51b4-7c50-4df0-a363-f19d3ea74002", "value": "vida.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d5c818-163a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659867694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867694, "uuid": "249000fd-907a-4daa-8a51-5b79496718be", "comment": "Malware payload", "value": "51976ffa944f0c5f294d4a058b32febf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867694, "uuid": "001a1a36-b181-4bbe-a8f8-83e08d0bbc81", "comment": "Malware payload", "value": "60a1b584d95c1bb625e8519c2155be4b7e2baec7c4fa54be3ba9d545c53c3dfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867694, "uuid": "9043d591-4b06-451b-8875-6022b88b2d56", "comment": "Malware payload", "value": "6d96980f2ffc1be96d80bfb49159459a28cf50e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867694, "uuid": "ff6521fa-cab3-4008-aa1d-b2fc96bcc60a", "comment": "Malware payload", "value": "4a7f4c12c80f9ee2665c09626d49cffe66ab8ff13bc6034359fc49321b440b124eb6ac30e1f2dd5ca250bcf6177ff702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867694, "uuid": "38029044-3626-4765-bd89-629703946f5f", "value": "T1808523B4365CD15FE803893A9DAFE9BBCE8E2875627486D384667339111ECB3C8CD464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867694, "uuid": "44cd9429-7c93-412c-bcf6-f92418521d63", "value": "a8edba105869c8b0330adec370df50cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867694, "uuid": "351ec542-580a-4fb2-bcbf-cd6f06c86415", "value": "49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659867694, "uuid": "87bcfa25-0de9-4a3e-9e87-665bc74097f4", "value": 1856910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659867694, "uuid": "7a3c2569-ee35-4c44-b37f-6c41b819b95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867694, "uuid": "7319618f-11f8-4ca5-be6e-445395131065", "value": "51976ffa944f0c5f294d4a058b32febf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ca01fd-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902769, "uuid": "57dee073-3a23-4466-9681-676bdb435ea7", "comment": "Malware payload", "value": "fae54a5e1b23fb8c3ae1424a1743dc12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902769, "uuid": "ce6401f0-e30b-438d-8844-2909bda0819a", "comment": "Malware payload", "value": "60d61bef11c8a7bb20a0739e202b18ea59fd51278819e9247570f69346ad9b26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902769, "uuid": "d496d790-e543-42b9-88e3-76b6b438bdb7", "comment": "Malware payload", "value": "68d46dabd008afe4ca7219714091169b93318a61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902769, "uuid": "f527ecbe-60d2-4e13-a0ee-c66a339d2701", "comment": "Malware payload", "value": "404f67148391a5fd63618d3bc82bb12cc8090a1612fd85cda4922c3323ea1f4911a3315ec818eb360a5bad770ea332b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902769, "uuid": "673a6610-07f2-4cfa-942b-99b19b436bc8", "value": "T16AD30893B450DF56F44F8A3606C78B20B6B0FFAA1E430A31673779629AB71D16972F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902769, "uuid": "12f26cad-0582-4178-b74e-45349baf46dc", "value": "3072:tjDPK8EP5lYEHFTK2bazJwj6vKLryVQidzHVgVmxY007nGZgebO:tnQLYEHFTpadwmvKLryVBxgVmxY007nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902769, "uuid": "7db2ef6a-16e3-48ef-b5a2-2a4a960eb181", "value": 132313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902769, "uuid": "cf4806a2-e6b1-48d1-a9d4-71e5b2563773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902769, "uuid": "0b35fbe1-97a2-4d3f-8dcb-6c54cd42dc6c", "value": "fae54a5e1b23fb8c3ae1424a1743dc12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a759673d-166f-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1659890432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890432, "uuid": "c9f22805-7db5-45bd-ac2b-f0383d3dd9c8", "comment": "Malware payload (njrat)", "value": "5d75398548301de0e0bf8c2271e81abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890432, "uuid": "5c9c8bb4-fa78-464b-b914-afd8f4909138", "comment": "Malware payload (njrat)", "value": "60e79b70aa06d2e84f5406906ce5a993e02c5fa2c0528ec879c4ce0f006bdb1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890432, "uuid": "1ad223c3-e1ab-47d0-bc40-cda42a9b8d3f", "comment": "Malware payload (njrat)", "value": "4b190b9219d69212aa7e1840cd32ab1c0c156e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890432, "uuid": "12872a26-089e-437f-ad39-e13855e7f7aa", "comment": "Malware payload (njrat)", "value": "e2f2691d8a42b35423d0d5680cfab4b8db4b94068742f99396d2528026de9c8da8a646b3834c9075338721a2b4149b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890432, "uuid": "b07b2e50-0298-47ea-9f38-b74a38f3cdd2", "value": "T1AB13E74DB694E174D5FF8BF1B4A2B2890B71A01BAC06930F99F114D94F73AC0A611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890432, "uuid": "f3803d51-8a35-4f95-98a0-7dcb3258279a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890432, "uuid": "3cc8158d-5d18-41e9-a3fd-964d7d6f2811", "value": "384:nZyc2bzvK1iDcsyO7P0mpUuSkEWFcafTzLIij+ZsNO3PlpJKkkjh/TzF7pWntztm:ZcbzvKU4pOr0bxKcvuXQ/oQztk+L4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659890432, "uuid": "6692f941-1ddb-4a00-a66e-90df8a961e0d", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659890432, "uuid": "df5c71ea-44da-4afc-b651-2073174e45b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890432, "uuid": "cc0d8898-78fb-4364-bc52-066ca7e4ae86", "value": "5d75398548301de0e0bf8c2271e81abf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccb1da8-16a0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659911621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911621, "uuid": "ccdd8a4d-bd66-4e44-9baa-5236a3de7944", "comment": "Malware payload", "value": "a5958ca9946b340df7962d24e6014fa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911621, "uuid": "32e64e95-1e28-4ed5-adca-96f86b587bb5", "comment": "Malware payload", "value": "6147888672b182ce9bc43f93747760350f04d701aa27c61a11f5fcb01cbfb5dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911621, "uuid": "9b2c6cd5-e257-4a23-a507-93117dad5bab", "comment": "Malware payload", "value": "15ee389706e64af3b60a0e7d20a5ef1abcf9e354", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911621, "uuid": "c4f1c30a-53e9-4824-b868-c8879f4e23e6", "comment": "Malware payload", "value": "ac39ef49d7675c4058d8042caa3be5eaf96fcee5f5a731917186ff17002b1d51357dfeab3db32357bd5c149631543aca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911621, "uuid": "41bcd810-ae3b-477e-8f48-438ffe008ca9", "value": "T106632BC3F410DBBEF418D73B0C6749157271F2604E870A266BA77B5BE96A198092BFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911621, "uuid": "b9d26579-00c2-491d-860a-fbdad0b97ced", "value": "1536:LC7e1etlZ8IqFfzQekacWVcW0JcWcBuVbgRAgLTcytLxGwLc9Iis/0:LiewNqtzQekacWVcW0JcWcBmbgRNXd8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911621, "uuid": "3d6d874c-bcee-4311-a616-27d35f3be75f", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911621, "uuid": "f6423e90-4596-43ce-b2ad-c053edebcfdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911621, "uuid": "31bde436-e6cf-412e-b28e-006fde7d0af2", "value": "a5958ca9946b340df7962d24e6014fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06346511-168f-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1659903905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903905, "uuid": "89bc91e4-230c-4094-87e2-869af99204ca", "comment": "Malware payload (NanoCore)", "value": "ac8596ab991ff8edac00ad3ecefb8bde", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903905, "uuid": "3246f703-6630-4601-96e0-e071965febf5", "comment": "Malware payload (NanoCore)", "value": "6198d6e4a7def1d5b431b708a3700c24f7a9a955ab9b02040bfda4ebc3bb85be", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903905, "uuid": "c1a76470-9766-44dc-81ee-df1484d1f17c", "comment": "Malware payload (NanoCore)", "value": "7c5cc9000703eaac75c6eec77f101e206abdac3f", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903905, "uuid": "8fadde6c-8d0a-4fd6-8385-599aecc5d7b0", "comment": "Malware payload (NanoCore)", "value": "3229090e4d8ca5e28b2c0ccfed523607c0aceed23430a89480ed6625d3f7159be074d3c503c279579ac756d0cbad2a14", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903905, "uuid": "5dcc2a64-4f25-4609-98e7-85035cf68c2f", "value": "T10214CF1637F98A2FD2DE8679602211528778C2D3E8D3F3DE28D855B78B267E00A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903905, "uuid": "98efca3b-f008-491a-8b1a-b92bdfbc5ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903905, "uuid": "02b80844-911d-497b-b87f-b03df4a76ab1", "value": "6144:gLV6Bta6dtJmakIM5zp07I0o3SEoJ7X5wa:gLV6BtpmkQp0do/oJ7Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659903905, "uuid": "2589b0f9-1703-47c0-8105-4fe6d04f7184", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659903905, "uuid": "fb3a6115-48c9-4d6e-8c24-19e762e38a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903905, "uuid": "0e79191a-8ec0-4b05-b59b-9a35d6b34197", "value": "JvUpdateX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4028905f-1642-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659870931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870931, "uuid": "5db03e6b-34e4-4598-8ecd-d7a44e3af708", "comment": "Malware payload (Stop)", "value": "064c437bff63845d77b7524c8f8a0483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870931, "uuid": "1d34ca81-04aa-46c3-83ed-5d342fcd2d93", "comment": "Malware payload (Stop)", "value": "61f9a4998fd5e3db092db5af0d8f1778c89fe3ec0d7c9f3723096303d8cad28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870931, "uuid": "60dafebe-05fd-4c30-944e-9070d4f2cf5d", "comment": "Malware payload (Stop)", "value": "01ad8d0260cd582b48ecc67d30fd3b162ec5fc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659870931, "uuid": "0b7a60cf-9d4a-4803-a5a0-7bfc2c566c35", "comment": "Malware payload (Stop)", "value": "9ca3a1a6f543b0a5aea6016121efe8ceab5a872bdbe766c31e5e5977aabf30a85d6790fdad44bad6aebccc9a622046c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870931, "uuid": "a20543ab-8fdf-41d4-9de9-bde40cd51129", "value": "T1A0050200A790C435F6B651F059BA93ACB93E7DE19B2065CB22D53AEE5738AD0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870931, "uuid": "8554eba0-a849-4695-98e0-e97bf32bcedc", "value": "08698d14d1e7fa83050959c8515b39ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870931, "uuid": "1d2ca2d2-4fd1-42db-ac44-6d131dc5d6be", "value": "24576:NaA9/+TFnmDjqDGRbmpEaHzk0Wv8hmQ5WM:NmlEjqDPpRiv8X5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659870931, "uuid": "6ae39ae2-5591-47a7-8cdd-4189d0110aab", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659870931, "uuid": "a83fcdca-dceb-489a-b445-d6f092051fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659870931, "uuid": "3928885b-0819-4ad3-a95a-16a695b83ef0", "value": "064c437bff63845d77b7524c8f8a0483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c6baae-1631-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659863738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659863738, "uuid": "bc4f8d59-3e40-41f8-a3f3-13a91f2d22ca", "comment": "Malware payload (ArkeiStealer)", "value": "b74ace79864a3ca768b69863fb12cb2c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659863738, "uuid": "70c15e89-c16e-48a0-9eb5-b29c0b27a9ca", "comment": "Malware payload (ArkeiStealer)", "value": "63a5eca37b972e7ca0019c71c27abf305a19d251cd89249137a47135ba447509", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659863738, "uuid": "25e4f30c-1de9-4630-b1c6-6b940f390bd7", "comment": "Malware payload (ArkeiStealer)", "value": "451dcb678617fc119a5db52efe291b8bd54a064a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659863738, "uuid": "7da6f2bb-c461-425a-92a8-81c290dedb28", "comment": "Malware payload (ArkeiStealer)", "value": "4e4ed4479b5cd57eb66fe031bad4c9de89b5bf3df7b004c9885c1ebd77b41dcbc5a6aa73a12ee37168a15572ecf59450", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659863738, "uuid": "6cb03d9c-1167-43bf-a55d-b37d825d8286", "value": "T1B9648C00BBA0C035E5B616F4597AD3ACB93D7EE0A72554CB62D52BEE5634AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659863738, "uuid": "8a2b429f-7e0b-4371-9aa2-31cd5bc82c94", "value": "08698d14d1e7fa83050959c8515b39ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659863738, "uuid": "e5cba680-34d6-4d6d-8af7-2a5b7c6e059a", "value": "6144:1c6PR+3Ke5Ab1NI3e15z2fObkSlIDAdanIoyKAW3uA85Ju6p2nmCMjl:66Q62AbP15z2fObfu0dcIy0A85JkMjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659863738, "uuid": "87fa8fbe-a4c7-4b14-bf42-e77524d7a395", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659863738, "uuid": "9acb6c36-f80b-47f2-8d80-fdca9888c326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659863738, "uuid": "642c3003-6393-4cfe-9475-b7a17e9c064a", "value": "b74ace79864a3ca768b69863fb12cb2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a627c3-167e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659896729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896729, "uuid": "a9e02429-9eb2-455b-ba0e-f8006a429884", "comment": "Malware payload (Stop)", "value": "eb0aa18eefc118faee72deb21a5a890a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896729, "uuid": "8567a361-1761-4233-9916-efe5cec6c868", "comment": "Malware payload (Stop)", "value": "678dfbd3e2b09d2d78bca1ae07099a1e547f48ad9caee38fd068d9c7ceaec7f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896729, "uuid": "4db2e0a0-1930-4a50-98a7-04e38d1872b3", "comment": "Malware payload (Stop)", "value": "d21dd7c60bf354343ef4914fc0819dd255cf081b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896729, "uuid": "5ceed285-07dd-4faa-8c61-eb1e7b20ffdf", "comment": "Malware payload (Stop)", "value": "c799df14d0e299f11adc7838db01e1092ca9fe258ef598937410a61af7258d627d294ab063fb0dab478e1e81ead19ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896729, "uuid": "10f35fb3-d125-4b15-b025-85930947e9f8", "value": "T1DA050100AB90D439F4F665F4897692ACB82D3EE19B2554CF23D53BEE96346E0EC31253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896729, "uuid": "b58f9c82-60ba-46e5-a721-5270cd60744b", "value": "db528410afedd73528144ea2e475f330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896729, "uuid": "6d7e0b65-b9ff-4355-9296-650075763848", "value": "12288:bsBKsQrl6D1zYMqlCCk3GON8SxbIWk8kzUuRK+k1YBTLFQfmYcHiayJrS4u1I2lf:wDQ4DVI4CkHhfGUIBOfbaq21vlPYGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659896729, "uuid": "0d39bb5a-c10c-4242-9ebf-dabbf90bcd06", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659896729, "uuid": "d7e888e2-62a5-4b0e-917f-879e994ec2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896729, "uuid": "5d770bea-7eb0-426d-af16-00a6c855350b", "value": "eb0aa18eefc118faee72deb21a5a890a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58faeaa6-1670-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659890730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890730, "uuid": "65f1a79d-da65-4171-a787-06be72266a66", "comment": "Malware payload (Stop)", "value": "a625f073c0c5f0721868c0c97fc7a554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890730, "uuid": "89ee600a-4fd0-4524-8522-c5d83c197855", "comment": "Malware payload (Stop)", "value": "6aebe59eadb1fc20d4d73f23322fbd15f21009d7cfa16a1de4cc89c151239d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890730, "uuid": "ffa63e70-5a25-4ad9-9539-0e381e6f3afc", "comment": "Malware payload (Stop)", "value": "9401583a0d7cfeb0d9e0263eddf8d2a3a5826576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659890730, "uuid": "d9b674c3-ce7e-4904-af5f-8dc2a7079fad", "comment": "Malware payload (Stop)", "value": "b5f435c775afd3072c432c185c27e1a70ae3b6d0bf3aee56234c292d28302e140e825a760b31d1bae53a33ab976bfe2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890730, "uuid": "e69fa4df-15d1-4153-b5b3-fa4b5fb50e11", "value": "T1DD05F200BB90C434F0F216F48ABA93AD792D7EA1972455CB62D87ADE57396E0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890730, "uuid": "4f0b8ba6-3c35-481b-906e-20a42d12d400", "value": "db528410afedd73528144ea2e475f330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890730, "uuid": "3f0d05ee-df35-40e6-9b1b-d6818b736a46", "value": "24576:6XQw+2/n2vvi9ro94qbCeTNN8+3wlvC7X5EH5/jV9:6b+++MomqOGNRA1C7XGZLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659890730, "uuid": "0666b23e-dc4c-4887-b3f0-9a39dcd2ebff", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659890730, "uuid": "9d6340eb-65d1-489b-9a07-43fcdd9a2cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659890730, "uuid": "92597ecd-d0ce-4931-874c-2b98d01e7b06", "value": "a625f073c0c5f0721868c0c97fc7a554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210f1101-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1659902662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902662, "uuid": "56202946-a461-45d9-b5dd-f6497d5e4f03", "comment": "Malware payload (Gafgyt)", "value": "2785bc25d9080350c56e02875ce24c6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902662, "uuid": "e67154aa-8185-4622-bace-b36d8b9a9b5c", "comment": "Malware payload (Gafgyt)", "value": "7260bfb5a4801d7df030e1f9fe8a6338a3e69af88bab2a143079e63e68669a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902662, "uuid": "51a19901-74d9-43e0-92ad-f077ab3d5aac", "comment": "Malware payload (Gafgyt)", "value": "1f4c6cf2b56fde89dad059723866c548c765d6c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902662, "uuid": "71793cb3-62cc-46a5-a90f-97fc01ef0726", "comment": "Malware payload (Gafgyt)", "value": "6d093301d91ee33ae22d7fc1ddf981ea472a31b05047b5a62eeb7b19dea76780caba99557482122c5e6e45a7dea70e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902662, "uuid": "db78dfc8-d051-48a6-98a2-b1dbf18bc026", "value": "T1A7B30845A552C5F6C4830AB2125FF93B01A0FE2B596B5F66E33ABCB5DB334843212397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902662, "uuid": "73dcb644-6943-48ac-b66a-e16b9d2aa329", "value": "3072:j98HdmPaFGq5PBSVjDW6iw7qLQ68E97JEXPk7fD1621Vnt7jsEmST0nYXbg1DE:juH8+5PBSVjDW6XNu1EXPOfD1629/sEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902662, "uuid": "dd3ff43c-b85c-4278-bc3e-0f9c55ad8b57", "value": 116622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902662, "uuid": "dccf064d-be76-4873-a968-9e855f29f40b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902662, "uuid": "4bd1a078-bf66-4bf9-bce3-bf000b312929", "value": "2785bc25d9080350c56e02875ce24c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cc0eeb-168b-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659902430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902430, "uuid": "4e4dbd8d-e725-45f8-bc57-dc2d79544886", "comment": "Malware payload (RecordBreaker)", "value": "638b05de457bd94078b45e51a2a62868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902430, "uuid": "9613b79d-ced1-43b5-bca8-d4b2c19c43b3", "comment": "Malware payload (RecordBreaker)", "value": "74301fb233d9c41e48f38e515251410d40ad647bb5b0ba01967cde9b72047393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902430, "uuid": "63f01f9f-0cd2-4125-b820-add7742901b1", "comment": "Malware payload (RecordBreaker)", "value": "9852a0393d214dc9ac638c41ca75f31517e06bdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902430, "uuid": "5f001f69-762a-4464-bbde-fc80f2a9d46d", "comment": "Malware payload (RecordBreaker)", "value": "9f830bf80fc367b76a646ef7de942be519019de5f3c8faf1684d55879f32ef7fdd1d24fa66f9a9a1cb200e08c279b19f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902430, "uuid": "31306d00-5ea8-4de8-81af-22bbdb541a58", "value": "T167D47D33B1E08437D2762B7C9E5B53989C2A7E106D38B84A2FE41D8C5F3D6913939297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902430, "uuid": "f0e98348-f29a-4cce-842e-f3aff342ebc4", "value": "222c367e9ac4d337d94bcf41d218e853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902430, "uuid": "5cf2c75f-5d32-4093-9806-c694d44c200d", "value": "12288:U7hEmjpxH7rbl+6ji1aFDfPY9O2KCJcxOoo53Sc:IpTnJ+6cWDuqsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902430, "uuid": "0cee22c0-429e-4bd9-9fc7-8717cf970df7", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902430, "uuid": "84be9e2e-6d47-4979-b2c2-85c8c0f2774e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902430, "uuid": "0ba810e6-c9a2-4f10-96a2-e1dd77047e48", "value": "638b05de457bd94078b45e51a2a62868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52087139-1698-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659907898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907898, "uuid": "f9a060f1-ad31-4698-929a-ed4af0260631", "comment": "Malware payload", "value": "8971f70b6ddcad8077f0832e4e96a249", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907898, "uuid": "29739e5b-0d89-456c-acd8-6b2cf455ea08", "comment": "Malware payload", "value": "75bc0a1913c404f1c02eea4a95900226a53b3775af78ee035e0b39c369d44b4f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907898, "uuid": "db6531a9-ae00-4cf3-8c53-fbd528dd0e27", "comment": "Malware payload", "value": "9c03b3d74df86166e747bc85f3ac9651886e0175", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659907898, "uuid": "92ef08e1-2bb0-4677-abb9-b546509de073", "comment": "Malware payload", "value": "da559eaf0e1a9710505449067bc47d67776316f1538bf03e9350eae608254ef63c2f97eb74e79e9ba547ef33e74b8ab8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907898, "uuid": "7a98160e-d161-4bfc-aacf-a986f23ae3cd", "value": "T1BFF5332BF8935230D867547C90B1A5FDED4A13B9DA146F033640968F4DE2E19DA03EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907898, "uuid": "9d9700ca-bc02-40cd-936b-7c953518c2d3", "value": "98304:ZEVF6aL7fDW3v0AMYfccAteMOQ/97o1einVQL1wviIu:Z46x3vKcAti+QeinIpIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659907898, "uuid": "fa2342b3-998b-49d1-8a9e-c59087ad1a5a", "value": 3423255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659907898, "uuid": "89074dbf-47c5-46c8-93bc-6acd5620229f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659907898, "uuid": "ef30e5fd-69ae-473f-ad95-42d4b5cdc511", "value": "gen_signed (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7493c6d6-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842243, "uuid": "e4bb1da6-0302-4370-9ace-bacbaac8c44e", "comment": "Malware payload (Mirai)", "value": "08ab2d3929a2c79279848c4db63aee2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842243, "uuid": "a47dc53e-67de-4108-af23-d0cb0a4d2a35", "comment": "Malware payload (Mirai)", "value": "76cca36017b3d34e22069f547e8060ef3b983ee6a8494d1c06beab71c9eeae1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842243, "uuid": "755dd5e4-c801-47ea-a80d-f4d846a77f24", "comment": "Malware payload (Mirai)", "value": "d9300273473dd10a6918e138238d10ff87eed2aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842243, "uuid": "405c648b-4756-4d20-90dd-76d127442798", "comment": "Malware payload (Mirai)", "value": "38276095ec5ce03bcff0a6ffe3d99b39f842160515812b734a7f45e8d5fc2424953de6febe77661f13c66f7d3cf2de30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842243, "uuid": "a95175d6-4651-445d-9549-22ae5795d003", "value": "T139733936F9392A23C1D0A47E11F74B51B6F11BCE36A8C61E7D720E4EEF616506412EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842243, "uuid": "7b9782f0-f99e-4173-b165-58d0b1ae98a5", "value": "1536:pMsk4f4UnhM0t+Hq/OyFU3+STWJ3sJjR1GyRc2O:Csko+K/mT+cJfRcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842243, "uuid": "d64f9cf4-a0f5-4872-9b56-60b04b35dc82", "value": 79792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842243, "uuid": "83485309-43f1-4ab3-9c4e-cbbdc19aa662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842243, "uuid": "e0040340-acee-4cfd-a938-eb397ce8b62e", "value": "08ab2d3929a2c79279848c4db63aee2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc5fc9e-1651-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659877692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877692, "uuid": "3639ffe7-af58-4dcf-a3f3-fb05976f135b", "comment": "Malware payload (RedLineStealer)", "value": "6934d7d78318d69da870b8b10cb9018b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877692, "uuid": "9d7487b5-4228-42d3-aadd-e02afe338f73", "comment": "Malware payload (RedLineStealer)", "value": "7cfd8599454287cb2902c491eb686bb79cc9f1fc9442606271860e38b8d80365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877692, "uuid": "eac85ddc-33da-4ea3-9821-9a8af503dc35", "comment": "Malware payload (RedLineStealer)", "value": "8001ad47a1b1cd37f147865ff664bfd6aa137536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877692, "uuid": "c85cea38-565a-4061-a49c-f4bff8683e0f", "comment": "Malware payload (RedLineStealer)", "value": "ce4b1a0842ac475da43c8ba4bd97f9623e6aa7c261c5f81199e6a2e5f1811ef6f9974a5320900a83fbecac217463dd3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877692, "uuid": "bfb0b00b-0d49-46e2-b315-b2b4fb21a49c", "value": "T1F0C41D6C95F0CFD6EE5113ED80A814A6E118DB5119F3F6CF9F86F806BC3A616C903896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877692, "uuid": "3ce7a7cd-c25b-436d-81fc-6d88c07ac341", "value": "b5adee44b8e65b15cce4b294d2789449", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877692, "uuid": "1d3c99d7-2113-40b1-862b-fc0e6e32f8fd", "value": "6144:s1R1L8mrM+jZNz9kgyBjzlrldVMROsZleJBaFcsO5ouNwObr5DB+m+PNjnKPd89Q:s1R1L8mrM+jZNz9kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877692, "uuid": "5166eb0c-a6cf-4ab6-be7e-18a3bd72214b", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877692, "uuid": "bec82acb-0dda-47a3-8304-37f3212acba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877692, "uuid": "f0cb4587-6f38-4600-a81d-479a90deaa3a", "value": "6934d7d78318d69da870b8b10cb9018b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bead4db-1688-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1659900935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659900935, "uuid": "470670ef-9e85-4869-943f-f42cc93b459b", "comment": "Malware payload (njrat)", "value": "691f16a0d88cc004b1306a51ae76fd8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659900935, "uuid": "91695ffa-36d1-4a6f-a27a-97e99a92a840", "comment": "Malware payload (njrat)", "value": "7d537d2d1154875170ff26364f831eb72920777514790d4149f2f90e29b38cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659900935, "uuid": "5e62feaf-2aef-4e6f-a953-83c14ace7fbe", "comment": "Malware payload (njrat)", "value": "97a81ada5f5bd95f7abf8317ddef03bc9dd7d68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659900935, "uuid": "f1d2d798-2c2d-48a7-b788-90ea72c1ecf7", "comment": "Malware payload (njrat)", "value": "756ca033d7b110e127590a95a398a45fc1e86dc643d12d17109af70cbd0396046d6a49b04d32d80d9c6ff499ea446eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659900935, "uuid": "9b208a3b-0420-480a-8121-86730282db68", "value": "T1FEC2094A7FA88851C47C17748572DA344371AD870422DF2A8CD5BCD7BB736CA1D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659900935, "uuid": "e116f266-5edd-4914-95da-ad8e9a983733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659900935, "uuid": "872ac57f-4edd-4577-b2d9-476079d1e4aa", "value": "384:H+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZnItqE5:gm+71d5XRpcnuvqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659900935, "uuid": "f01f4c77-4156-4e0f-9433-4e4ad2952fd8", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659900935, "uuid": "58ade707-e3e1-438f-a375-53f3145813cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659900935, "uuid": "45017fb8-6178-4c2f-9f33-98f0076c84a9", "value": "691f16a0d88cc004b1306a51ae76fd8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a356640-1664-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659885471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885471, "uuid": "f4c791d6-f120-4030-85c6-82c608becb35", "comment": "Malware payload (AgentTesla)", "value": "09605ac7f9d342417b22334b5ba57d81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885471, "uuid": "de909ba5-e702-447f-b60d-f26496cb421e", "comment": "Malware payload (AgentTesla)", "value": "81f5912095da9a0c604cd8cb34e9bc777d32ba243d537a7af9c6bf60f801d5a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885471, "uuid": "743303b9-b409-4c4a-a24e-db1094d128df", "comment": "Malware payload (AgentTesla)", "value": "c0d6fb29008cbb1529d7f436027b9dcd851eee64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885471, "uuid": "d00c8ec2-4d44-482b-b0a9-dd953f8b7929", "comment": "Malware payload (AgentTesla)", "value": "298395361033f24348fa63b32f1f62b94eb1eef542ee752fa497d832f96709acb7befe8c91f196f9faff35036325a90d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885471, "uuid": "103995a2-e5e0-4b36-9ea2-5ce33ea5c8ac", "value": "T118E4CF5115C57625F46A5B3846E068390BFAFE12FA2BF26D7CA473C4DB33EC08662523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885471, "uuid": "5ad987af-5db8-42aa-8c51-584f66d6235f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885471, "uuid": "d51fcaef-d56a-4ae4-ac31-6f3f4e9e91df", "value": "12288:aS1LBFjuMPjwi9BZNbvYbagLQoN3Hw1wBnYdqtwdm66X5vUn5VPNrUBY90y6LO:9jwi9BHtgLQK3HtGkty5q5Un/NrYY90g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659885471, "uuid": "9eac8983-dab3-42ff-8f2f-926e6d223dfc", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659885471, "uuid": "a86455d8-5738-46d4-a83b-2a21e967d018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885471, "uuid": "4301cd9d-e24c-464e-bbba-ac3dab538b21", "value": "P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a434bda-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659911670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911670, "uuid": "f82762ab-387e-4782-bf53-5d597a028a3a", "comment": "Malware payload (Mirai)", "value": "8e9731bc0b78678e710382a9d166348d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911670, "uuid": "1dc16872-3cb8-48b9-8f26-ca422d708094", "comment": "Malware payload (Mirai)", "value": "83d3a5cb0b50eaec1cd4867b480a19deb659f81f0c12abb256cbbd10f26a7355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911670, "uuid": "6051f01d-5014-4dee-9288-7c2e72a921ae", "comment": "Malware payload (Mirai)", "value": "ab1b17e3babf1efb7b781b70e2cc8713e5a1b44b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911670, "uuid": "06ba6cd3-e2fe-4617-adc9-c35483bc368d", "comment": "Malware payload (Mirai)", "value": "54613e941a59c649621282be85e79ed446e69adceb895ccd61c2f7b234dbab46cc507aad06e4f7f489ef23235531ceeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911670, "uuid": "c6a59dc7-0069-4bbb-929a-6e6e574fedfa", "value": "T1F7934B32377A4A23C4E6643881E78737B3F79B851D30411BBA946F887F5AAD031937A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911670, "uuid": "166ada41-1127-4d78-bd56-7f5605ca2781", "value": "1536:RMtmq5+UhAgokISUyAVv9Ks4OL92l5sdxt/+DQnqt+Aecm5jSa:RTmokjUyQvB4fsdXHnqZeDYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911670, "uuid": "3524946f-ad6d-48bf-8927-376544268255", "value": 97283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911670, "uuid": "069bc271-68da-4ba9-9921-3e1135293432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911670, "uuid": "3ab8db96-834e-447b-a34d-c3022887598b", "value": "8e9731bc0b78678e710382a9d166348d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263f58e6-1668-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659887209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887209, "uuid": "67958f54-4f34-4f9a-8ccc-6b817b54939f", "comment": "Malware payload", "value": "134e5ada417ccbbd055535757b3b7643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887209, "uuid": "6fd7332e-dc46-464c-90d5-7d3df3b5baae", "comment": "Malware payload", "value": "83f6c72a3babe3ead16431e4c7afaab1b99e95ec071374ec2a0d38fb8bc46ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887209, "uuid": "a83919fd-2305-4987-9c50-668b5dd99a1b", "comment": "Malware payload", "value": "254cc43879797b02f2347e7638003fa900596de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887209, "uuid": "33ff495b-7a91-43f9-bd9b-e74f1da6b802", "comment": "Malware payload", "value": "fd04f5b76f3e10ac156734d4a623ecc97c1393c001fa1ae1163eee6a21ec866dcdcac54ddbbbaba09b4a79cb34c59bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887209, "uuid": "010c79a8-0cff-4488-9d67-ac0c118d817c", "value": "T18A8523B4365CD15FE803893A9DAFE9BBCE8E2875627486D384667339111ECB3C8CD464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887209, "uuid": "eb795a11-719c-44a8-8c87-669c14e4f3a3", "value": "a8edba105869c8b0330adec370df50cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887209, "uuid": "d852e9d7-7739-4304-8931-be19a42839b4", "value": "49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659887209, "uuid": "b5cf9137-3012-4baa-ad53-3cce2c1cfa8f", "value": 1857514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659887209, "uuid": "470dcdfa-b3f0-4e76-bf79-dd21bac180e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887209, "uuid": "f2502e91-8df4-4068-a8bf-e727f037aec3", "value": "SecuriteInfo.com.Variant.Barys.242088.18561.25053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7aa0caa-1673-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659892231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892231, "uuid": "bcae1c77-b14d-4c4b-8dd3-df7b6675c976", "comment": "Malware payload (RecordBreaker)", "value": "675e918f515d86e46ecc45745950d0fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892231, "uuid": "77eb6e99-17f4-4125-b9f7-70e564fdfa93", "comment": "Malware payload (RecordBreaker)", "value": "85599a173b0e02feec2e6a0260166da49b870cb8d87c2b0beb1e79473e921d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892231, "uuid": "f77d7107-2c88-48a9-9fb4-d3bf749d7b34", "comment": "Malware payload (RecordBreaker)", "value": "c4cd7a52f9ff434108690bb5a994ef004cb5a4e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892231, "uuid": "6d36a96c-2d62-4158-b686-3ad5c3adebe9", "comment": "Malware payload (RecordBreaker)", "value": "43ce3b877c0b0abd6439042bf444929750f94ce723123d6d6ba7237ce6a83a296215f0028e807782398e3d7430445193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892231, "uuid": "39deaa7c-6201-477b-bb81-c9ef880cc1a4", "value": "T162D46D37B1E08433D2762B7C9E1B53989C2A7E106D78B84A2FE41D8C5F3D6913939297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892231, "uuid": "84782ccd-96f1-434a-a4bb-6e7d24ec48e7", "value": "222c367e9ac4d337d94bcf41d218e853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892231, "uuid": "d22d6ca7-8af6-4f52-ad79-025e147b469e", "value": "12288:U7hEmjpxH7rbl+6ji1aFDfPY9O2KCJcxuoo53Sc:IpTnJ+6cWDuqsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659892231, "uuid": "4f6af58c-cdd1-4c5f-9371-2e631d4dc8e6", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659892231, "uuid": "b90f1675-1c4d-49bf-bcfa-85371a5c810a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892231, "uuid": "4327b97a-394f-4410-b6b4-bc429c27ac0f", "value": "675e918f515d86e46ecc45745950d0fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e938ce6a-1650-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659877228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877228, "uuid": "fc01fadd-69ee-4ed3-a83d-fd50a0ce26ee", "comment": "Malware payload (ArkeiStealer)", "value": "5614ef198967e9205f2dde3698cd2c17", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877228, "uuid": "ad62ded9-8384-4bc9-bd6d-3ddeb3d59abb", "comment": "Malware payload (ArkeiStealer)", "value": "8618f8f804629a0eea36718a7cc29dc6bba30614f180650c972f82017753a82c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877228, "uuid": "849cf4f9-434c-403a-8232-84fcb06cafad", "comment": "Malware payload (ArkeiStealer)", "value": "f6f50625d306ed3eda698414966219187856d983", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877228, "uuid": "03591771-fa09-434e-8a92-de9ed811c1b2", "comment": "Malware payload (ArkeiStealer)", "value": "0ada7780ef0d1fc5555c416a554e5b6abc6df5ee5441f84631cca9474b55fdf0ed3956c51921138a2ba6f34d4bd79205", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877228, "uuid": "88f288da-771a-4394-8fea-41625c2eeb7a", "value": "T1A3A4BE1173C2B472E9B2043B85F789698A7E796307E567EF37D417EE0E212C19933826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877228, "uuid": "d6859b4d-a04b-42f3-991b-f1c7daed4cfb", "value": "7d4a40cda4fdf87d0637555ab5a51d81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877228, "uuid": "d80d9a33-9da8-4c8a-85b2-90751abf6dc7", "value": "6144:GTwlBnBGWAG0HXAOvkFCqQNRo5DMojzoKdCl4hSlH7+IaIA5cy9IYhP:kwlBB8t+DT9d1+b3aaYhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877228, "uuid": "559cf936-9996-4759-9c43-4ec96310ce30", "value": 490480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877228, "uuid": "56c932fd-cb64-4d4c-b5ed-25e157b34722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877228, "uuid": "de5f5d57-8686-4cdc-9ed2-ff908a9cd5f0", "value": "5614ef198967e9205f2dde3698cd2c17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f163ea1f-1675-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659893133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893133, "uuid": "735b3226-ccee-44c9-a651-d069a9b446f7", "comment": "Malware payload", "value": "15a2f3b482255a420a1fe638508441d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893133, "uuid": "9aafe46e-d881-40e2-ad51-8c817d6bc061", "comment": "Malware payload", "value": "8af87d451b3e4ad09ed0e60ec837bb2d361cceb488a750186f9dc992db3f64bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893133, "uuid": "3c89fcdb-db77-47c3-b823-3c83587a3ab0", "comment": "Malware payload", "value": "0f2e6f4f88e3ca6a711a717c35f535a51fe48d70", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893133, "uuid": "500ff72a-f8e5-43c7-bdd9-2f2e7ed7943b", "comment": "Malware payload", "value": "4713ff41f10a0268ad83f368426afab9169db3f5eed017ee08c645f16310f08aced33f69e251ab4496872f1cbf86c115", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893133, "uuid": "4a125e31-8340-47d4-a9bd-d0a77cdc0321", "value": "T113F3EA8380FE77EE50EEE75973651682D8DD283F1029E698E6A6CC90ECD00657DCE4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893133, "uuid": "2c0945b8-a536-4ace-9d4a-372e16372a47", "value": "96:n66666666666666666666666666666666666666666666FQmS9S666666666666A:5QF9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659893133, "uuid": "2498708a-df4c-45aa-95e7-fba13a62d8d7", "value": 171638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659893133, "uuid": "2788fbb8-0ff2-4e03-82e8-a398b03033cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893133, "uuid": "f64ec4db-d6a8-4be1-a4a2-d7d178b0f9b8", "value": "hXsrYMrTIC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18cacc8-165a-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659881483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881483, "uuid": "0d2b6584-bab2-4219-bf0b-88a4320333b1", "comment": "Malware payload (Mirai)", "value": "75181839d4eca01c095f5976cfe06f71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881483, "uuid": "1593d2da-c983-4467-a247-6287f04becf9", "comment": "Malware payload (Mirai)", "value": "8e9f87bb25ff83e4ad970366bba47afb838028f7028ea3a7c73c4d08906ec102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881483, "uuid": "c4370652-7d45-49fa-97c4-550a71ff8c41", "comment": "Malware payload (Mirai)", "value": "e8f05a1c719b0348a490afd6b0c213b53d9835ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881483, "uuid": "c35f0582-8a64-4054-9406-3d6f81a2eab4", "comment": "Malware payload (Mirai)", "value": "4313a9813b3a1273b1c451b3b57587e07c6963a64b68d8471cd9de3b7a08370c31f4ae7b49c7e444d1b79924beb57abb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881483, "uuid": "e068060d-7f17-4e07-a64c-8e7fdace8f05", "value": "T1D1A30929E9C05F07C0D62279FA4E534C332367E8E3EAF111DE1B1B6567BA85B2F26501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881483, "uuid": "9a9eef72-4b9b-405a-8624-1f57c50d5c02", "value": "3072:BZUDi35WYxr3S5ciLwCPbkXh1b6dkOLQ7h9TcM:UDi3sYsNwCm1b6dkOL49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659881483, "uuid": "0d65ef3e-5707-48ca-a8dc-895f557c2114", "value": 104536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659881483, "uuid": "008168c2-bafa-468a-ac2c-98d2a8098595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881483, "uuid": "e43c2506-9d0e-4190-a835-64c9dac8e6ee", "value": "8e9f87bb25ff83e4ad970366bba47afb838028f7028ea3a7c73c4d08906ec102.elf.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e009f431-165f-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1659883655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659883655, "uuid": "3b49c88b-f442-48cd-a27d-8a2c28dc53f7", "comment": "Malware payload (AveMariaRAT)", "value": "6b1adc55a5f4ba0ad77c354510789fe7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659883655, "uuid": "da29852f-f01b-4b65-859c-142a80b4ac18", "comment": "Malware payload (AveMariaRAT)", "value": "9055f97a348b61cd8c33b1efeecafb82c1c7c04431c26f3543fa9cb25d85ee6d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659883655, "uuid": "14797065-7b7b-4bbe-b0e6-5337155ee407", "comment": "Malware payload (AveMariaRAT)", "value": "f9e331487de0a02b275f67dd0782e0527b62706d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659883655, "uuid": "bcdd0215-79a9-47a3-9fb2-af26f9f0b59e", "comment": "Malware payload (AveMariaRAT)", "value": "a0137d33f0c0c721f3c836a1f05aed713d328b7da8cd67d3531099918226297b2822412a60b8a98c586c6d751b7dce5b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659883655, "uuid": "a0d43773-94bb-4387-9f9b-9de306324375", "value": "T10032BF7D538ADC12D47D02268B43F10412EBD6233DADDC564C1F1EA24948EAB9BEE898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659883655, "uuid": "05eb3163-3342-4d79-8191-3acf9fe98a39", "value": "192:VWmsPjDIRZGug9+LYSIb+88hC3/mbs97laxh4HRdsQVZtz/VW3ROP2TPRU4brT:VWxKZhc+sHa8tuwiSRyEZthQ5U4brT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659883655, "uuid": "e8c94221-b59d-4bc2-9fe8-ef1db03c4cbd", "value": 11254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659883655, "uuid": "77dc7d1b-153d-4067-8ff8-8e7347e3d2ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659883655, "uuid": "a6c8bdf0-e532-48c2-8542-e6b3157fae16", "value": "VPO - SP.9686 Flex rev 2 - BL65338.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0fb43e-167d-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1659896261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896261, "uuid": "4891e006-8fb4-4621-bc52-e45dff5ddb63", "comment": "Malware payload (AgentTesla)", "value": "67ebf4cbce36226d598ad0fd7edb198d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896261, "uuid": "2d3c54ac-1ab9-42f4-b7eb-bede473bdfd8", "comment": "Malware payload (AgentTesla)", "value": "94f9350f25fe1e40b4d3087070dc4c7b28eed2467771f0b509bafcd1ca03455e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896261, "uuid": "45ccac73-c2c6-46b1-9132-5e3396193693", "comment": "Malware payload (AgentTesla)", "value": "93d256f3dc59d3846a56062e3b3bf99805b98660", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659896261, "uuid": "b2dabe95-51bd-4f62-9aa4-2867462de38e", "comment": "Malware payload (AgentTesla)", "value": "9ea4d4a2cc49f05e27fe912f62dad425a60f53af0c14687b9bcbd528948638b65a22545c43ad765a2ce4d4e540356ed3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896261, "uuid": "2ab654f8-86b8-4bf1-8f0a-fd50a9be5c88", "value": "T1F6E4CF6105C53625F8265B3846E019794BFAFE16FA2BF26D3CA87384DB33FC18661523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896261, "uuid": "33e032e8-5762-4a44-bd07-8a1b5755b40f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896261, "uuid": "3242decd-5354-4a2c-bad3-64fe34f6e5a6", "value": "12288:E6ac15duJPjwi9BZNbvYbagLR8wSbo+/HYbji/vM83OeDn2ejcy2GYt0qTRy9:sjwi9BHtgLR8X/h/5DOyvYtBU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659896261, "uuid": "6642e986-e245-46d2-9992-0b824ccccb8e", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659896261, "uuid": "594da905-0b29-4f99-b36f-e7ac52953077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659896261, "uuid": "30ccfce1-e7de-4ec9-885c-80720c1b7839", "value": "RFQ-002022WMH0078R57888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6fc56a-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842417, "uuid": "ce5fb2db-0485-4aab-86c7-dd6a309e515a", "comment": "Malware payload (Mirai)", "value": "4e06d68f05e1cee3ec872205427e15fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842417, "uuid": "72d52a43-d034-49f8-b10d-c317c8a19b7b", "comment": "Malware payload (Mirai)", "value": "97981e9203340550f0681a85552294ef08016757831ff8b51b289e10dc2a8882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842417, "uuid": "47dea467-5258-4dd8-9b28-6ed4048e0ffd", "comment": "Malware payload (Mirai)", "value": "44c0c4b35c32059790bdf21fd8c70364583ec70e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842417, "uuid": "b968a7fd-ec86-40a6-9e1a-1a8173f165cf", "comment": "Malware payload (Mirai)", "value": "093060e108bb79c8731a466abc9aaab2a70416ea9256cb189e1651bae53f7bf93aebd4f0b55f782ac49cb3372749f1dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842417, "uuid": "1c8099f2-7b0f-4ff4-9e6d-4d3e1f950a16", "value": "T19593B41E7E258F7DF79982354BB78E22964837C627E1C141E19CEA015EB034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842417, "uuid": "433e5782-4df1-4950-ba63-ccc19de65ad5", "value": "1536:5+NOusT2iv4UnaGNYfovIhiyTjEJOnucsSoN6m7pYXmLdFj5:JuGbvrZY+IrTjWO0SoN6m7pYXKX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842417, "uuid": "51419489-7cac-4afb-b36f-b0a8098853c6", "value": 97584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842417, "uuid": "ee2267a7-7b64-484c-be38-a8ab9168265a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842417, "uuid": "2c32d366-b959-411d-b20d-e84d89cc2af2", "value": "4e06d68f05e1cee3ec872205427e15fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f8d75b-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842349, "uuid": "8bdd5a69-92a3-4be4-bbe3-109350850c03", "comment": "Malware payload (Mirai)", "value": "55ab855aacca5b0af77e6a00741f5bd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842349, "uuid": "0efb7a02-4eee-42fc-8ac6-be55971bd63d", "comment": "Malware payload (Mirai)", "value": "9c2ee9dedfb3679e5043af56bae0368449964084d8372b71f2546528767f4ad3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842349, "uuid": "9e2cf5db-5b97-4e68-a99e-3a379c09787b", "comment": "Malware payload (Mirai)", "value": "9723adbfa905e86ce3206242689463e20826e7f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842349, "uuid": "5e564ec7-a972-4cb3-bb79-ecf660e598d6", "comment": "Malware payload (Mirai)", "value": "4e14789832b2d9b33751384f6bbded80d483806863f169140dcbee7873473a7efd4aaeed3fbc50d7d8d23b2ba3ffa64c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842349, "uuid": "b7929043-8c3c-414f-b8ac-1b3253084cc9", "value": "T127634AC4B643D9F2ED0602B52477EF338E76F5B6216AF983D3D89937AC81A01950398D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842349, "uuid": "301acaf7-8a95-46c6-98ee-cfb583c70fae", "value": "1536:5g80fNaLw64nUcBTicXg5PcS/DLhtcrol2fas6vYUR5mn0Cg:WOw64nUcBOcXg1cS7LhtcroESyUW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842349, "uuid": "a0492818-db52-436b-b4ab-686d3f4aaaec", "value": 68176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842349, "uuid": "1a7247e2-627d-42a2-91af-2af22c4f7032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842349, "uuid": "dfe056ef-a7d7-4848-bbdc-12a215059310", "value": "55ab855aacca5b0af77e6a00741f5bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed8ee74-163d-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659868835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868835, "uuid": "ac762794-db39-4ad2-b7ba-2d07e2f817b1", "comment": "Malware payload (RedLineStealer)", "value": "4bce78bac1ef6c8018b98667995925d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868835, "uuid": "17ff8257-4f82-4998-86d1-944f60ba2fb6", "comment": "Malware payload (RedLineStealer)", "value": "9ceef6a61f77d5e5c9d65e5eff7c2ede91cd236839c09830322faf841167a5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868835, "uuid": "bfe79ebf-77a4-4fb2-afd9-05b800536022", "comment": "Malware payload (RedLineStealer)", "value": "96567709e4d46d7f6faa3dea9c0769300603f0cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868835, "uuid": "edec4eba-7278-43fa-978c-28a79d73f367", "comment": "Malware payload (RedLineStealer)", "value": "c03f049bb78f9fadefbcb0e6c6756c90bac1c7a958515596eab813762138677ca0eeb40ee0ba3814906274793428bcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868835, "uuid": "6ea582ec-736b-4a08-80c7-eaf1a6d60aa9", "value": "T11744D05A63E420A6E4BA577448F302975932BCB19B7882FF16C5C67E4E336D0B931B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868835, "uuid": "faabfb0b-c801-4bf9-82be-620b946de0b8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868835, "uuid": "5a2a9a15-08cc-4711-b4b1-4393b128be7e", "value": "6144:wahOwp0yN90QEzzYxTlle5vBtL2K6kRKl8Bym:wicy90YC5tL9Rym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659868835, "uuid": "8dd10112-f2a8-4218-914b-c7e19cf51a52", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659868835, "uuid": "e2af1a93-0363-4d39-80f5-7fe2fe8c1f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868835, "uuid": "04ccc613-f83e-48b2-b337-9d706d627e7c", "value": "4bce78bac1ef6c8018b98667995925d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a56e72-1677-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659893731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893731, "uuid": "fb37f56d-6341-481c-ac3c-26ab659a35ca", "comment": "Malware payload (Mirai)", "value": "618a3f6e115183bde85d3807b5b6579f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893731, "uuid": "cfafa5a2-93db-42df-871a-1e7d4648ead3", "comment": "Malware payload (Mirai)", "value": "9cfd8ba32fe8005eb165f7d74dbe292fff5510b4164a92e225a7b3edeb234090", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893731, "uuid": "d1dfa339-03bd-4e35-8c01-7a6c6ee6a9f4", "comment": "Malware payload (Mirai)", "value": "d695ec04591bd854b62023b5cb01b5f3038cd1e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659893731, "uuid": "3be5a298-2df7-42f7-af0d-a5594d982b27", "comment": "Malware payload (Mirai)", "value": "233ad93b0dc37ccb74a801b7e89fd14b2b557c770aad8ca8859c1ad9149a68bfe91b53ce42ed489c082e0f151ab52ba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893731, "uuid": "a45713bb-2038-47fb-9da5-98266cb127f8", "value": "T1CFF343797A22BF6EE27CC7310BF66BB4C396119237D19381E1ACC7189EB525C188E750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893731, "uuid": "e17b488c-a585-4c23-a344-97e4fb7e527a", "value": "1536:hX0XacCk6ThTu47dMBMhSoPjrhQ6GfyoZ+D2wepgxyvc2/pUpXab99LUxp8vv7PE:h6kYg4/UkTN+A7Q4TxJCV80f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659893731, "uuid": "38b3b615-a536-4c72-8711-5db5c2c02342", "value": 160226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659893731, "uuid": "f26005c7-19fd-4114-ae2d-2322f715c7f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659893731, "uuid": "331ccf5f-e711-4a2d-940e-3b287518de6c", "value": "618a3f6e115183bde85d3807b5b6579f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc1dd61-1659-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659880831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880831, "uuid": "9563b5d6-160c-4333-b454-85057dff6c05", "comment": "Malware payload (Stop)", "value": "2e3369caa2405f7500cf0f0d46d0cbe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880831, "uuid": "ce858b63-899d-4ab6-ba59-408c21971fd4", "comment": "Malware payload (Stop)", "value": "9e717bc53f37275e34d4018301be3f96817f86785934650bbd583c3486fd2384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880831, "uuid": "adf878b0-0821-4046-a3c0-26755ad37f42", "comment": "Malware payload (Stop)", "value": "abf40d481d24d0715635acd17ff313ece94789c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880831, "uuid": "8abf36bb-827d-4a89-a068-47264a3ac291", "comment": "Malware payload (Stop)", "value": "45ee00766adf441a365ddc7f3a9aff5f26b9c171b8f585f7137d634b34142655d66d13cb22735f3fccd0dedc8d5cfd15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880831, "uuid": "054d35e4-a2bf-4cb3-9529-810091a55d60", "value": "T17C05F100B780D435F5B712F489BAA3A8753E3E915B2564CB62D46AEE4B34AE1FC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880831, "uuid": "1bf58596-71dc-404d-92be-8c1db456ac4a", "value": "39e2a2a3ff0fef7be07267ef50e1be9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880831, "uuid": "daed043e-6b5d-4e4f-86dc-c4d9ed0e1ad6", "value": "12288:MpmHrMD/3IILUa2OsB+igv0SWVvyGdbXsWTsc0UzadUxRhb:4mc3dFHs20bxyGd4WTszUaOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659880831, "uuid": "81c9c9b6-173e-40ea-b2e6-03ac1d16252e", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659880831, "uuid": "3326de5f-56d1-4601-a1f6-8379880c8257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880831, "uuid": "d9ae4d9a-3c72-4e99-9aa1-d89c5754fb4e", "value": "2e3369caa2405f7500cf0f0d46d0cbe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08618567-1675-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1659892742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892742, "uuid": "3f34aeec-77c4-4e4c-aa0d-7523226901da", "comment": "Malware payload (SnakeKeylogger)", "value": "27ed406a98422f6a9627e31483298608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892742, "uuid": "2b96437c-b27d-4777-bd06-1d224791ad63", "comment": "Malware payload (SnakeKeylogger)", "value": "9ec2027523181be11615d24b326d3f0780d3754da57f5af2bb85e7494ba73eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892742, "uuid": "babce7a7-a665-46bd-8302-d4ad49d2b539", "comment": "Malware payload (SnakeKeylogger)", "value": "f459f38390e9c034b047eed7dfa09e439afef128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659892742, "uuid": "3cff7bf5-ec5d-4bc4-96f7-fce0924e7ee5", "comment": "Malware payload (SnakeKeylogger)", "value": "1bad82054690da6197a263fe83892e44cb4578628a84267d8a86999e2e4afacbecfc4e901e9e00bb135e9284a1754823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892742, "uuid": "b6ca8259-617d-4921-a6a5-7445747210cf", "value": "T17EF4BFD87312BDBFE027E833A9545C18AB10647E838BC213905F755EA55D58B8EF0AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892742, "uuid": "e9a124b1-1b93-487d-9447-c4667a89fbc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892742, "uuid": "c1a7bf0d-1b68-405f-9d82-1d23669e8db6", "value": "12288:IPg6SKlpxs6A6PWIDkQikfGV3MhsfTt0ZMVeCBjKX8JVekkBOSX79XUvkKPCwTo:IhLlpxsfIBi+u3ksfh0qxBj6lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659892742, "uuid": "4cfcaeba-84d3-4435-90cf-715a7f1553e6", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659892742, "uuid": "7c461f94-998c-42d6-9682-3b05b886b0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659892742, "uuid": "e2133fe4-46b9-43b6-b840-1de34f046246", "value": "MV GOLDEN SCHULTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d36d78-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659911683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911683, "uuid": "247da437-d8a0-455b-9ed8-801ab57fdc39", "comment": "Malware payload (Mirai)", "value": "d4ea97edb3160435b6c638ebf6d0e199", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911683, "uuid": "6111557c-3459-4d3c-8eea-4bfb03b5dba1", "comment": "Malware payload (Mirai)", "value": "9f3d61d5b36c93098168329955482ba4744237c2e6ffa2f20135e30c77bdc31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911683, "uuid": "36c4ca3b-f9b0-4e00-a4ca-7f325b4284c2", "comment": "Malware payload (Mirai)", "value": "d1b73f5977e12862804eed23da2e9afd8f960d20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911683, "uuid": "4fb47a3f-bb56-4360-afde-f594fcd73eff", "comment": "Malware payload (Mirai)", "value": "db06f52d1946bbe1cefb02c2f2b7937c77c55de926d107e4e059ebacd60e76cb5dbc3c1229f23e02c7c2fda4e466d92c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911683, "uuid": "9032700b-1d80-4ee4-814a-2d13c704d9a2", "value": "T1CA434B41B729084BE1E35DB03A3F27E287EE9E5120F45108795FFB49EA71D31098AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911683, "uuid": "87066e9e-d6e3-4451-8398-27094618fdb7", "value": "1536:Pn68iFJHmf88jQ1vNF2U6jF3H/r4N9Qs3WYhQA/H6T+ru:/68OBDrBNLRBhoKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911683, "uuid": "4d290913-d9bd-4ea1-aaf7-60f5624c596f", "value": 58924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911683, "uuid": "93b924ac-1ebf-4500-8388-edffb84411bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911683, "uuid": "c9a33b98-2b5e-44cb-919d-9cc11db9b0fd", "value": "d4ea97edb3160435b6c638ebf6d0e199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4ffe79-1657-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659879944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879944, "uuid": "38d08816-2cdf-4181-a80c-43fc74dede90", "comment": "Malware payload (RedLineStealer)", "value": "76237df22c3f4bfa1230e6442601afb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879944, "uuid": "d3bfa19e-db04-42ad-bd75-3d9711fb778f", "comment": "Malware payload (RedLineStealer)", "value": "9f44c4de4f263dea7ecfd438a1b33a4a34b616707aceb545e49de49276c46806", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879944, "uuid": "7e18b1c1-d119-4e3b-9e0d-d6264128382f", "comment": "Malware payload (RedLineStealer)", "value": "7abe0d40b739a6e233039bd5c3f6eed059726ea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879944, "uuid": "155bcbc0-0270-4aa1-8a66-d25ed62587f1", "comment": "Malware payload (RedLineStealer)", "value": "93fe832ae289dc9620f61da8311d3235c34eeedbad7a6b437535db23134176d12f7b9ea877ce7e96f1519b6aab8f7cf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879944, "uuid": "14650bd3-dd1d-418e-88f8-c90da1e70ae9", "value": "T163E49645FCF37FB2D129417D41CFC714A238D605BA414A279B88F537785222CABA3A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879944, "uuid": "17d284d3-d699-4203-9a88-a9ef3c51de99", "value": "b5adee44b8e65b15cce4b294d2789449", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879944, "uuid": "da0009cd-2370-44eb-89d5-5e21a27a8eda", "value": "6144:tPvUrFBjzcrlHGV/EoBJdl2T+/LhZytZraUGvnEncPinFIkPcHpP:VMlr2MUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659879944, "uuid": "ed82e4ba-5b4c-415f-b20b-89b35bea0726", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659879944, "uuid": "7390d2f7-f6c7-487d-8802-148ba3c6d18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879944, "uuid": "56464557-734f-41e9-b0d1-8ee97efdd894", "value": "76237df22c3f4bfa1230e6442601afb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afa74e3-162f-11ed-93bb-42010a9c0043", "comment": "Malware payload (SystemBC)", "timestamp": 1659862843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862843, "uuid": "9151a4d2-07a3-4030-9316-bf6254ad8890", "comment": "Malware payload (SystemBC)", "value": "3ccab164e14f82c6d597e2b069702153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862843, "uuid": "9f78a10f-2a1f-4831-9a4b-926488ed6fff", "comment": "Malware payload (SystemBC)", "value": "a0237f333f6811ecd9154b4646508daf4900e6296101c14088c6be816d3292c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862843, "uuid": "a0ce7e0a-8079-4f9c-b71b-8589e8c7b1ee", "comment": "Malware payload (SystemBC)", "value": "7bc7b58e0a8fafab8f9ae572082a5db2a0aaa67d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862843, "uuid": "f803470e-662b-401b-a0dd-e0b3c1ce0aad", "comment": "Malware payload (SystemBC)", "value": "518d60c56bdf36d82618c6a2751e973be1a4ee6d53ee89f45c1d56c30b4e07031dacacda7d1a13b8b3611f6f8c0f2a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862843, "uuid": "d651cf91-23cf-4a1a-9e54-2ac200d5144d", "value": "T151E2092A3850E1E1D49186F07F5FA750D6BE78364629A42DEFE05E6872B1AD3E706203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862843, "uuid": "abb84a81-53d7-412b-bd2c-1173fbbfb192", "value": "99b17a621ac9f74188dfe3c5c2fbe9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862843, "uuid": "841ff851-3383-4063-833f-0387df2797a3", "value": "768:w3EbYftoXG6+g91X794dmKhAhMISWRW4RoJijDM:lYf2XG6vVGxDWRW4Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659862843, "uuid": "37b5baf9-e3b3-4cae-b3ac-33379a4dcece", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659862843, "uuid": "d6b1c3e8-3d60-40da-8b71-2145ec057616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862843, "uuid": "4850c594-a91d-4ff8-bba0-d2a3dd8b581c", "value": "3ccab164e14f82c6d597e2b069702153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b68b6c2-1652-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1659877903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877903, "uuid": "3776f905-2c50-4288-9972-3d1114943655", "comment": "Malware payload (NetWire)", "value": "38d24212ffdc3b2ed75c7bfa6da7723e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877903, "uuid": "6886cace-3233-4de0-9361-eaa71dedeb57", "comment": "Malware payload (NetWire)", "value": "a03e2209954abb189898ff2c0af25fe38d6702995bcf9d3819968d9ffba7f972", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877903, "uuid": "39083e01-ec59-47b7-8ecf-9b0a1502ad58", "comment": "Malware payload (NetWire)", "value": "0167489af9f781052c684882145834fd18f8b0cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877903, "uuid": "9fc9a5ef-ee65-4852-8647-4797e4042b35", "comment": "Malware payload (NetWire)", "value": "5362e8da1037d76637f199fb327b4cf7984b53c73e2c5f056a12941222ae4c4cecdd9ff55b1befa77793b92ec93244d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877903, "uuid": "33c6d9e5-7027-49eb-bb83-7d1675648977", "value": "T1D1945C229B40BB5ED198695FE13D0A4E22F30745C4A2B3CD736BB50B67BDD0CA72952C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877903, "uuid": "e5307155-37c8-40bb-bdf0-0afc189ce2ca", "value": "6144:GiD9HcMyirdow6VsAxfuub4ztAmx6ubUmlJNI:GYPt6VskuuxKLbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877903, "uuid": "b4fb5ac4-3874-4094-a77f-5c3970f63ad7", "value": 437879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877903, "uuid": "1cb34ef8-4cf0-4300-8fb9-0e7d1572afc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877903, "uuid": "2622e111-7a21-4295-808e-8f8bd722ace0", "value": "Quote_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17e03fe-1679-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659894744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894744, "uuid": "0752a75b-6848-45b1-9f80-c0f585145b36", "comment": "Malware payload (Mirai)", "value": "9a4083cc52fdedb1e227cd5ad0119f50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894744, "uuid": "72f667b6-3799-44af-bc02-9b1980f601ef", "comment": "Malware payload (Mirai)", "value": "a218fdd6a89a982b28f9918526560f53590ef47952de3e8e9ab37cb62edfcfeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894744, "uuid": "2cc1661b-7a62-4688-b21a-ae9bc1ee8ee5", "comment": "Malware payload (Mirai)", "value": "7eea58fffcd0c84f2299bcdc1c8c144cc3574a11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894744, "uuid": "60851a19-8edf-49af-8516-41e6c99a9ea6", "comment": "Malware payload (Mirai)", "value": "3a4737fff076f842e603f6467ac27198755916a2783d890ac7a54aee049fd185983cabb458e71083e9064de251c3a2dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894744, "uuid": "3548eae5-d090-4199-b2c0-7f806564eb5c", "value": "T1FA733A0395719EA3D0476FB9217786380723D8324B471B61666AEBF84B03ECDBD987E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894744, "uuid": "b87df6aa-d20c-4716-a307-c3b4b63be2ff", "value": "1536:rmvKwpCXs0GEwkZ69hhyenoWM5s4BOmnoy98SOWP:sKps09Yhyeo/P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659894744, "uuid": "170b54f5-8016-4412-8edb-aafed94d238b", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659894744, "uuid": "93bcd6a0-8223-4275-87d9-9be9a4226150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894744, "uuid": "6a706a6b-10cd-48db-8973-a58b43c7366e", "value": "9a4083cc52fdedb1e227cd5ad0119f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93da6ee-1652-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659878033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878033, "uuid": "93e96481-3e28-480c-8d62-87c45a3d8f66", "comment": "Malware payload (RecordBreaker)", "value": "3f0373c5bcfed4d6abbf029eebce8ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878033, "uuid": "6b2c4db9-b1f5-4411-80e4-dcb3154cc9ea", "comment": "Malware payload (RecordBreaker)", "value": "a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878033, "uuid": "0108f802-d2e8-4cdd-9668-23fcd15139ee", "comment": "Malware payload (RecordBreaker)", "value": "0a99c5eb158f34e97c7f64806f1ae82240b23765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878033, "uuid": "f1b57722-ca4a-43e0-a7cc-70287b666a55", "comment": "Malware payload (RecordBreaker)", "value": "bfec65bf8e48ccf295cc22327284479363dd00ca088c6029cfb10acd98f770c18a96c800397f4ddcc22ec08d928aeaf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878033, "uuid": "794d014d-a21a-4510-bcd7-a3baa1b0ac27", "value": "T168552339A18186BAD0520D3A884BD332F637FA540F3E15DF7BDD191D9C1337A6A7128A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878033, "uuid": "076bba69-6518-4232-a806-3f2089418c73", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878033, "uuid": "a37184f8-77d9-4af4-a50a-113eada1e0a6", "value": "24576:pAT8QE+kxKkUsAqQwN7yw5NXNgWWcq75JHiIBVpWuulRbHhc5BmKqEDzTJcI:pAI+8Kkkq3N7P9hWcq7FVku8UmGD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659878033, "uuid": "30368abb-2377-45f7-987a-d076c369530c", "value": 1287409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659878033, "uuid": "7c570a25-599c-4628-a930-3a3744700915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878033, "uuid": "6fddd34a-d550-4bb3-b431-34991bf6cc4d", "value": "3f0373c5bcfed4d6abbf029eebce8ed5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b1af73-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902744, "uuid": "df9d1718-b7d8-4755-b939-37c64bfce508", "comment": "Malware payload", "value": "f8a396ad43a3a7e6124bba51dbccd581", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902744, "uuid": "5d536974-6945-4ef7-96c2-9b1b73acc5e8", "comment": "Malware payload", "value": "a37d8832c12009afd77fb68d7d264cd32e3917b6b9aa5968ee3f9803dc82807b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902744, "uuid": "f212e4d7-8217-4953-8217-0c2462f0a059", "comment": "Malware payload", "value": "6523c1c902b007dd31ab42673521d27aaf6b5383", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902744, "uuid": "4197f9e7-0f30-4d4d-a644-4a44287d4927", "comment": "Malware payload", "value": "522bba9a52afababc80337564deb1e00e01a8faa72ce621485cec75c0f277f9948a4de29e15dd5de96d00505969f1c22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902744, "uuid": "f75d64a2-ca70-4802-9245-f76f9dd3ed01", "value": "T182C31B874A60DEB7C043E93136B35564A795BE650F1F06866E2EFAA00E3F4CE740E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902744, "uuid": "8dc474f6-1dff-4eae-86de-9a61438fcd61", "value": "3072:N39EHxEWakMr0t4O8HwLS66sxzo2Bg307ChLgeY+:N3CHdME4LSSok2Bg307ChLgeY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902744, "uuid": "84483038-c9e0-4769-bcb7-fcc470677601", "value": 125007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902744, "uuid": "2f1ee752-97ee-4cef-92c3-12d3fa571f80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902744, "uuid": "ac066ad7-c5e4-4148-bad4-3b46ce2e5eb1", "value": "f8a396ad43a3a7e6124bba51dbccd581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3036c2a7-165e-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659882930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882930, "uuid": "16ce84fc-2351-445b-9610-58e052ed5a47", "comment": "Malware payload (Stop)", "value": "4653c7c009befc6d2fc5d13c5bb167f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882930, "uuid": "fc56b634-6049-4ebe-add3-01eacf5404a7", "comment": "Malware payload (Stop)", "value": "a48b6d332435fc6309ac14233badd268690ef1a55b38432394c2fcca0941fda5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882930, "uuid": "fbd4264a-a387-4dd7-a745-1b2af17337dd", "comment": "Malware payload (Stop)", "value": "33ed5dda36973dbe517d1e5016d6a06ec6cf82cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659882930, "uuid": "1d44a20a-4b58-4c77-b7fd-fb8301d427e6", "comment": "Malware payload (Stop)", "value": "fd30636d18eadd8caac73efc3094fd14d5b913ab3c2742fb83e293e535fff1c533a6f5f663d5e5d7dbee2b1372068e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882930, "uuid": "dff93de0-93a5-49b5-87fa-fcf1a9ebb753", "value": "T177050110BB80D435F5B362F44A3A83B8B93E7D91672555CF62E92AEA07346E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882930, "uuid": "96195d6c-7682-45a9-9fa6-d18a177fdbef", "value": "3e24cc85af3e94883de4009f1b8299b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882930, "uuid": "4f376cc8-b023-4ead-a566-fcd7865c2e0d", "value": "24576:8/XYb86lvRlla7V8Vs/uXAf3/7RoeW7N9:8NcZLWikJ//7See/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659882930, "uuid": "ea736ae4-1dcf-40f8-8e69-5e254c191647", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659882930, "uuid": "b3a8aac2-7ae8-4c41-97c8-8646f5c291b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659882930, "uuid": "7d6ef9c5-b883-4f99-b1fa-5f2598aca196", "value": "4653c7c009befc6d2fc5d13c5bb167f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fb319e-1652-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659877994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877994, "uuid": "6a6b5f56-ef1b-495f-b09c-d34859f048af", "comment": "Malware payload", "value": "9c8269122a95f26834b0c78a319ab871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877994, "uuid": "a0e0e8c9-b33e-49a8-bc4a-86db74d5b585", "comment": "Malware payload", "value": "a6e19f9228b78d6406f2bf464611e403871646b086e1bb1777dc0c61d6789c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877994, "uuid": "da9c5dc9-2b02-4b38-b195-9ec626b12074", "comment": "Malware payload", "value": "fc650bc1896f78b8f6772802dcb10dde90bda1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877994, "uuid": "6a41e9c3-40b0-4a9b-b73a-d02cce7d596c", "comment": "Malware payload", "value": "0692719e60cbd53b07daac38861d86bb7fac1a41b5e855bea0825a7ef9331d4d9fd96f3461050e9ca8170a82d8878596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877994, "uuid": "c578d02f-047b-45ed-9dca-a4f0a8b3eb46", "value": "T1DF447428B170D5B6C25612E556B051F5C0DB8F050BF2BACE8F9FBD0A7C28EE1D9468C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877994, "uuid": "bd63ddec-bd7b-488d-a89b-6dfe924751ab", "value": "b5adee44b8e65b15cce4b294d2789449", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877994, "uuid": "d4173170-e6d7-47c0-b83e-5090c89ba55f", "value": "3072:n/CDrWU856OXKGPaPY9mQoBjzRrlzYhM:n/CDrWU856OXKGPaPwiBjzRrlzYhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877994, "uuid": "c4a4b2fd-92eb-4709-b953-d5232c3f393e", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877994, "uuid": "775f9f9e-3797-4a65-adbc-000d69bfd4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877994, "uuid": "441145a7-bcae-4f8b-8976-f0de02117ae8", "value": "9c8269122a95f26834b0c78a319ab871.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26fdd8d-164a-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659874532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874532, "uuid": "0251290c-2f5e-4562-b724-75c3e2550ef4", "comment": "Malware payload (RecordBreaker)", "value": "536fedd693dd9be185d58141f92bc7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874532, "uuid": "46d1967c-5586-4bb3-8355-32dd8a25f1e1", "comment": "Malware payload (RecordBreaker)", "value": "a76deca3fe212c9ad36569e6501516949fdf9f965eae736dec2c2dc8192361b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874532, "uuid": "50a472ed-f79a-4e33-9f47-f7b56414b1ca", "comment": "Malware payload (RecordBreaker)", "value": "f66df3fe36b5d01bbfccecc7ba2c35018895006f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874532, "uuid": "36f80dd6-4eb4-4fde-9a9e-a1a2014a0280", "comment": "Malware payload (RecordBreaker)", "value": "75590f24d31f9243147e40656446a0522be4f8e1a2cc81e8e13fd31bff6e14fabd13273509a1cc5b8c935ce318f450ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874532, "uuid": "b3505794-7f45-4d4f-9044-b60c50f35005", "value": "T113934805B7A0EBD6E859D033F52E1271A3379A5C8573D72E69CC01EACFC3B9A0562709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874532, "uuid": "671cb9ed-64ad-4d3c-99ed-0a641e9997b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874532, "uuid": "ce3e3c40-51af-4286-b23a-d289e256ecfd", "value": "1536:9/e3G3+Dqxuah51+q6qqj6X7gS1baRVz/PpnW2pYpSNB4X+DDDDDDDDDDDDDDDDz:9/e3G3tDKq6qq+7gSCPpnxKkNB4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659874532, "uuid": "35d98672-b341-44c7-8398-dc6190fa1018", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659874532, "uuid": "711a07b5-d875-4e04-942c-da3775b4504b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874532, "uuid": "53c78896-e86f-4400-947a-819970fd98e0", "value": "536fedd693dd9be185d58141f92bc7c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea0ea5c-1624-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659858339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858339, "uuid": "c565b9a3-c5cb-47a3-9314-abcd7f6f06d9", "comment": "Malware payload (Stop)", "value": "7cee454a0fa55f668ae78efa9bf1eea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858339, "uuid": "df0ccdbb-0237-451b-92cf-bea084f48324", "comment": "Malware payload (Stop)", "value": "a78ca23dd7928b9580bb361e6e1c5d15e6ecd5f91371c88b22563d7bf13dd8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858339, "uuid": "6078228a-b071-4411-95fb-06e526042e9d", "comment": "Malware payload (Stop)", "value": "62978c2be5f684efff51b2dceb3400ddf6861569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659858339, "uuid": "0b9577c9-337c-4dc3-975f-c6f17972de00", "comment": "Malware payload (Stop)", "value": "4062ac16bfd25fbb29b249057eb1f59d4ab07bceb60a856f3a7610a7debbe855a69fb85c45f1382a0f664771f96c7c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858339, "uuid": "43f7d7ea-478f-4201-a38a-dfa6c61a15f2", "value": "T1E7050200BA50C439F5B715F48ABA82B8752E7ED1AB6650CB22D43BED57385E0EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858339, "uuid": "d9608fa6-16a9-47e5-af1e-242752c83509", "value": "09220c43a48769a57a51fe2bf629b1f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858339, "uuid": "3a47e85d-de84-4455-a939-b09d70214ffd", "value": "24576:TJqCjOq7Vxv6NzM8icOrBu6S/rRgjpN53uojDv9:TIM/dNu6Sj+p7xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659858339, "uuid": "20247c56-a11d-41c4-8f39-03eb51d597ef", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659858339, "uuid": "9b1f21f5-bf94-4280-b6f8-ac12d9041e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659858339, "uuid": "4c51332f-90c5-4110-865f-973ba4f1db59", "value": "7cee454a0fa55f668ae78efa9bf1eea7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0530fc7a-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659911635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911635, "uuid": "2ace42fd-55ae-4b91-90f4-5526e63fc0c0", "comment": "Malware payload", "value": "ad46d90a97b02f2eff3f388e14fa51dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911635, "uuid": "a7370db0-5907-400d-97b9-dbc499343ddd", "comment": "Malware payload", "value": "a79c87f96ca1412fe0a3d0d8de0ab22cd6f2f96ecae727e56ef9477cbd83f208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911635, "uuid": "323e48cb-1cc7-4cc5-8efc-63be63bc6ddd", "comment": "Malware payload", "value": "d3035bce16ea63271c7b986f6e91aa2394867c52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911635, "uuid": "e7db9933-3787-4ce8-89ea-66c37f690fa5", "comment": "Malware payload", "value": "43a5498101a71b74b62d72c1f939420097733c0e113f0ed704ac756c161fb8d02b63892397d9ed5550206160450eee13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911635, "uuid": "dfb4f48c-57df-448c-9bc8-1166b7e3b015", "value": "T129631A52B8809B66D5E056BAFE0E018D33531FF4E2DE72068D15BB3077ABD4A0EBB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911635, "uuid": "af174544-7e61-4992-bd39-1c912deace55", "value": "1536:iMn8fR3fHcuQNuIqtYTJjxOQrs5dsVw/W/YIBQkNKRr:eVEukMFuVw/W/h1KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911635, "uuid": "96a978a6-af8c-4593-be04-54c34db78c41", "value": 66904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911635, "uuid": "3ca5829a-1a88-4a54-82c7-906faba65fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911635, "uuid": "469a2ec0-d0ae-41c6-9690-3ec84093cfe0", "value": "ad46d90a97b02f2eff3f388e14fa51dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d974ec48-1698-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659908125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659908125, "uuid": "e85e2d31-72f3-4492-b105-2f06822b7078", "comment": "Malware payload (Stop)", "value": "705e375a877defbde325f0027641c68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659908125, "uuid": "2ffdf87a-bd3e-4279-9fd4-f0180620752c", "comment": "Malware payload (Stop)", "value": "a8d2e2896594ddd274093ab56d71d5850872bb9a4527445ef6dd5a5525df0ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659908125, "uuid": "267a3152-ba23-4f17-8b0c-e11a1a6cd0ad", "comment": "Malware payload (Stop)", "value": "a61cfd5e197465e3357897cc2d6340d9cca53ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659908125, "uuid": "d176adcc-f127-4a2a-9f31-a5e0bff1adfe", "comment": "Malware payload (Stop)", "value": "b2e4bf900660dbf160ea83049241d523ada1fa12ba67a9423a738bbe446e419d1ab00da7a3f0732ee57ecd486e4cd3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659908125, "uuid": "de9a0527-ac9d-4909-a1c8-cd42157bc443", "value": "T149050200A690C435F4A622F54A7A86A8B43E7ED17B6491CF63D46BEE93346E0FD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659908125, "uuid": "d2e68b27-e94d-4a8c-8536-ceb9b918864e", "value": "c69f2bf46d64c24653b01cc6fcf4d6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659908125, "uuid": "9a2ceaf8-be64-4d5e-81c8-f759098a9b02", "value": "12288:+9420Qrjy+qHhbz1RbBPasMFPucw6y50h4GQb6gO3OCPzR1t3C0hWK4T2xutI6ji:0tq+e3bBj2w6y50hNQMe2zR1tBnWrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659908125, "uuid": "c08cf4d9-abb3-4247-a66a-c48dc1b7662d", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659908125, "uuid": "8bfb9a0f-e251-443d-9568-3cec6fa46f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659908125, "uuid": "929263e1-a358-4c20-a717-9a71ccbdacfd", "value": "705e375a877defbde325f0027641c68a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f81658-167b-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1659895531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895531, "uuid": "e145f01f-a19f-4b57-a24c-70cd16ba54fd", "comment": "Malware payload (IcedID)", "value": "62125d4dac8bbb9a1364abad823c0200", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895531, "uuid": "1172512d-1a26-498a-992a-a060c594e662", "comment": "Malware payload (IcedID)", "value": "aa3f02a7d2bdc2dec13c109f5628652977b3038a6417bf0c0b2cce0166e6b660", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895531, "uuid": "70bad4fb-f795-40b4-8e09-19ec50327ab3", "comment": "Malware payload (IcedID)", "value": "cd170172cdf2ee31fe6f7b34c30012c1e66123a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895531, "uuid": "df4d1386-5143-47a6-9982-374587b35f22", "comment": "Malware payload (IcedID)", "value": "df1808da3fa5c064e2bf228a9a882fcd8dbb46e9b9796e2db86b94c6fd2b1791b7fa0228a0433a3d7305fe2348317bad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895531, "uuid": "a721f37b-5088-47b8-9c13-a3bc9c2c610c", "value": "T19A535B61E782D4E3D4690135C6817DD662327E504F8DCF8F8B647FE255A3B61AF1AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895531, "uuid": "411c2cf2-6b2a-42b3-9996-1e4c0334d66a", "value": "fe56e41d939dbdde07c2b0439e05a543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895531, "uuid": "17f37eb5-242b-4824-b90a-0d49142eec1d", "value": "1536:h5OoaceCg9wHyQs2hXpvOeG7O3j8taBhvtAwNdg4xI:hEVceuO2h1G7OTHdt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659895531, "uuid": "714c6b9e-8c8b-45d6-81e4-0e4337e42516", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659895531, "uuid": "b7d51e43-5079-4ceb-9c56-402e09e50fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895531, "uuid": "9fe3fe9d-ba83-4690-8167-67568820f6ae", "value": "62125d4dac8bbb9a1364abad823c0200.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2fb3ea-1679-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659894628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894628, "uuid": "ed015979-cce6-45a3-90e2-fe941ffcc274", "comment": "Malware payload (ArkeiStealer)", "value": "c3b846a2f4826347bd43fcc7b0991bb0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894628, "uuid": "41099786-b71f-46ce-b295-7d946f351b2f", "comment": "Malware payload (ArkeiStealer)", "value": "abcfb6f2422d8e6a35ca9afe1ad0ea941222f90d8e73c828b0d6c77a071c299d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894628, "uuid": "15a5aae5-7916-4075-8384-c369d0c0e62a", "comment": "Malware payload (ArkeiStealer)", "value": "daeb9a8c8a5091d8b20e759b369dbf12ff9f7041", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894628, "uuid": "8ab836e6-3107-49f0-91c3-89e68c0dfd04", "comment": "Malware payload (ArkeiStealer)", "value": "89fe49c7381c1c3dbafbebbc3754ef758be9596cd3da53f6edc70bac9b70fa909ec05bc29dd862144a276bd9bb6fe5eb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894628, "uuid": "247af19a-0e9a-4770-8653-09f7ec34e437", "value": "T1B505F100BB90C035E0B112F5597AD2A8B53E7DE0A76564CB63E93BEA5B346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894628, "uuid": "543eeaf5-8d3f-4986-be68-00fdd03d0c40", "value": "db528410afedd73528144ea2e475f330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894628, "uuid": "9e2b6532-37a9-4907-9583-a6517ab2c19d", "value": "12288:kR1h3QoZAv7mi+D5udvQQ7JZvWtntzPnHu+Cxo46FAxIOdaXE/zwFlwWGKF37pH:eTQBvmcdvF+ttzPHuBxoLAJd1mGKF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659894628, "uuid": "72769ad3-a7ac-4882-9094-e580fd092085", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659894628, "uuid": "c4916969-5818-4cb6-916e-4daaca3086bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894628, "uuid": "d07c215f-225b-4f45-a823-b8547f183fab", "value": "c3b846a2f4826347bd43fcc7b0991bb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf51206-162c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1659861638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861638, "uuid": "4c4f269b-dcf1-40cb-8c92-d8454af053d3", "comment": "Malware payload (Loki)", "value": "2e3470c68864b6cd2747f894bde65bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861638, "uuid": "b7d88560-19d3-4a79-a28b-0703d4a78333", "comment": "Malware payload (Loki)", "value": "ad85392a56452b9c64dd61b6548531ed9d0c8d9aaf088885f3d602877d785d09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861638, "uuid": "47cf9691-2e01-45da-810b-a95ee6ff0c64", "comment": "Malware payload (Loki)", "value": "c4f7b655987e9c01af6b39abf2c62b4caa973aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861638, "uuid": "25dad330-7693-4826-b828-08fd33177348", "comment": "Malware payload (Loki)", "value": "337c7cc343403528aacf466550ce8f7bc51cd0da472451e1ef985d2336caf033c71a1725e656c902e095ad87fe489b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861638, "uuid": "24b7f006-c4af-4208-9376-2b6a2a5ab750", "value": "T1B405BD4876D2C227C5EE0B768314549456F4C0ABD299FB8E1FB52CEF2C8B391AF0B156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861638, "uuid": "8c20f1cb-c44c-4b6c-9986-e19732114049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861638, "uuid": "d5b96903-d4c6-406f-b81a-af11c256a882", "value": "24576:fDysfd7YFdNasqnMeIKEgOyuJkqmxbPeJ+:bysfd7OgVIPLy01mtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659861638, "uuid": "538ab757-d0ae-42c5-9cad-d01d37178d71", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659861638, "uuid": "bc0a7ee4-6984-4766-aefa-7daa5ea9ee61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861638, "uuid": "443c7a01-7446-432c-bb2e-347e289a3f76", "value": "2e3470c68864b6cd2747f894bde65bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1ee95e-163a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659867708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867708, "uuid": "b0edaf67-72ce-4c8b-be7c-0d7fe17b360c", "comment": "Malware payload", "value": "4d169150caab2ef1be2fc291b97a0488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867708, "uuid": "fb9019b7-25d2-4bac-93ad-eb9efaba2165", "comment": "Malware payload", "value": "b259f8520a5ec4ee50a2144d859a4230a876659a5867d623709d8c8a336b9810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867708, "uuid": "7605c117-7e73-4617-a57e-0c36819aa607", "comment": "Malware payload", "value": "528608774ab244d71317cca80fe65d02377a733a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867708, "uuid": "d89fb1b0-2517-492e-b093-b85d1aff392a", "comment": "Malware payload", "value": "70c622752d6271dd4925cb58ab0486eb7f8201ba408ab598fdd99fb50fd549f0d95a6175ba9a2fa21e7c952b025f3a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867708, "uuid": "47ff6c7c-611d-427b-93eb-324e0a71e5da", "value": "T1428523B4365CD15FE803893A9DAFE9BBCE8E2875627486D384667339111ECB3C8CD464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867708, "uuid": "be996016-80db-4d31-a9c5-e20ea3288a79", "value": "a8edba105869c8b0330adec370df50cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867708, "uuid": "86ff15f1-8257-442a-82c0-7583aa70e1b6", "value": "49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659867708, "uuid": "d49aa436-3f49-4469-b431-eb53febf51f4", "value": 1856909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659867708, "uuid": "7059f1e3-ca2b-4acd-93c1-1848a9e306d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867708, "uuid": "e1a7d5c1-6ec5-45f2-a1f6-73ed0db02bc5", "value": "4d169150caab2ef1be2fc291b97a0488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4ae559-1657-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659880191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880191, "uuid": "fa9a344d-e649-4541-a864-f726e10f10ef", "comment": "Malware payload", "value": "5d8298099964765eaa7cfb29c26ebc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880191, "uuid": "19363ad5-d97d-4dfd-833d-54e867deb34d", "comment": "Malware payload", "value": "b396df78f135fc121f04ae3322adc20b69778852de773403a49fd021f4373058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880191, "uuid": "abc41990-317f-4279-b4de-124959e9d1a9", "comment": "Malware payload", "value": "9fbe0bf81261b401142af3d62743b117c35b81d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659880191, "uuid": "213d2db5-4c0f-442e-b796-0b07e9954d81", "comment": "Malware payload", "value": "0d046293d8e81a213df86f95a343506c7cbe5d8af5e5f1271d643e412d8ac052fced02562cc5dd5b01db670c42dcdcf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880191, "uuid": "92c3a209-2e86-4132-924c-25036b979154", "value": "T1568523B4365CD15FE803893A9DAFE9BBCE8E2875627486D384667339111ECB3C8CD464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880191, "uuid": "b569a379-216b-4f91-bbaf-0d2b8ab6bb70", "value": "a8edba105869c8b0330adec370df50cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880191, "uuid": "3fb53952-b7c8-43c9-82fd-bf9336ef1154", "value": "49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659880191, "uuid": "32005cbd-d614-4ed3-8ee4-e09dd04ef287", "value": 1857097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659880191, "uuid": "45a0a524-0c81-43c5-bca1-f2a9e54e28c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659880191, "uuid": "4f5e54a8-117e-42bc-9ba2-409565e831a7", "value": "SecuriteInfo.com.Variant.Barys.242088.20787.2791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4675111b-165a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659881250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881250, "uuid": "364a0f41-c147-4ce6-a709-e5bcbfc0372a", "comment": "Malware payload", "value": "d51d485f98810ab1278df4e41b692761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881250, "uuid": "877b5b35-303b-4816-9e02-16ebf2e10797", "comment": "Malware payload", "value": "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881250, "uuid": "f8edbdac-d408-42f5-8e33-5502621e6f2d", "comment": "Malware payload", "value": "0b28de2c2b0913cc5684461812d294f50fea6105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881250, "uuid": "fbf1366e-047d-4b20-8fbf-67198ea6e8a9", "comment": "Malware payload", "value": "42d57bf84dc112f393923f7e185e4e03a686dbad73cdb03b59cb5b96eb6c03b7276c547d9acf76e71108f2c34f921a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881250, "uuid": "28f612fd-1871-4666-a2c9-6834cdd331a0", "value": "T159E52916EBB651E5D9F6C03486636363B9B278598734ABD39A40572B0F33BF0A53E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881250, "uuid": "501dc34b-5d73-48bb-b21e-966bfb99ede6", "value": "f4e1c3aaec90d5dfa23c04da75ac9501", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881250, "uuid": "5158e350-6706-4f2d-b520-18aca7a64c20", "value": "49152:11Y2apHQbtZdQ15Prdh1cPwPV2PX68tOLvknTLccEPbx6bV:8dD/PQXlUGQx6bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659881250, "uuid": "950b0b7e-8747-4bf3-b8f4-5782034ac535", "value": 3311616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659881250, "uuid": "6723f411-197f-4e75-8cb9-ae59986a5414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881250, "uuid": "ee7ad949-3a6d-44c7-a9c7-a4aa6a332979", "value": "npmproxy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68be1f00-1680-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659897628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897628, "uuid": "b6b53011-3ef8-4d67-982e-a086a0c29c28", "comment": "Malware payload (Stop)", "value": "64e08736c7e9e3814c238ea1fce6753e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897628, "uuid": "b360a8f2-52fb-4e9b-babc-35ac6c5c5254", "comment": "Malware payload (Stop)", "value": "b68538b100ee150e781073702a255243ae98011f491f4bde3a4746da9ed46c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897628, "uuid": "13f3454b-731d-4afa-8209-601c964c1b8a", "comment": "Malware payload (Stop)", "value": "fd1d34d8142b62bd35f8a576895dede7d0fda36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897628, "uuid": "702a639a-1b2f-45be-90c1-5ba8b12e5458", "comment": "Malware payload (Stop)", "value": "25a221e3c4dcef011942ff5d146980672f704662bfc8ee50a6e181d8823b92ef09037a9d8a510dffc0a0e1b76f810e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897628, "uuid": "c0183e6a-9dbc-4a4f-bc27-bc241f6cca7f", "value": "T1A5050100BBA0D435F5F712F49EBA83A8B83E7991172454CB52D96BEA4B346D1EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897628, "uuid": "978ca41b-84f9-4aa1-94b0-18675b882914", "value": "3e24cc85af3e94883de4009f1b8299b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897628, "uuid": "d9dd3c3e-27d5-47f6-a0e9-d88ff9445372", "value": "12288:35/XPFyH7fD5M4rLtO86gXvnNsb5P7tPCzdxTC612LwehuuFSpklPH4i/mfASZUA:psHz1PSoNY5hPYTkHhuILOfAn6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659897628, "uuid": "0b733d92-1e4c-4284-bc02-122e5d70e024", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659897628, "uuid": "34ad1af2-ecd8-44f6-b561-de7acd32eb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897628, "uuid": "df6d7412-3be6-4bf5-8db7-b1884e65bd4f", "value": "64e08736c7e9e3814c238ea1fce6753e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf62f6a-162c-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1659861797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861797, "uuid": "67e604c1-3bb6-492c-884f-f56dccbc2661", "comment": "Malware payload (DBatLoader)", "value": "224a5532ebd723ef2ef09c3aa8262642", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861797, "uuid": "daf9a840-47fa-4f4a-b4b4-e78a9bd23c2c", "comment": "Malware payload (DBatLoader)", "value": "b7aacc2b12e6e8f89a954e2623b6a53137257e4039ecc45311998caf6cd41cf0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861797, "uuid": "98ec11e2-9050-4ea1-a6f9-98b4ddab8683", "comment": "Malware payload (DBatLoader)", "value": "d822c066fc10f00dbb3f19a0067d514936d6e523", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861797, "uuid": "fd5aed8b-da33-4d5b-8016-e95c59a1627a", "comment": "Malware payload (DBatLoader)", "value": "98f8111845210086012164ff4e7707c194d536eec85a8a965f411adacba60093c192685a80ddd07ea07bc69a576f3e81", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861797, "uuid": "8a1efa68-9307-41e6-b52b-159abdfe22e7", "value": "T18A159E26E69245F7CD7316795C1B62A9E9267F003A2C74875BE93CC88F39790382F193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861797, "uuid": "34f15b22-b779-4825-9bd6-d5473d528f68", "value": "a4007b8766ee5d4329767f121d77a6b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861797, "uuid": "3b2126dd-d50c-4563-b105-2d6783ced550", "value": "12288:cnwbJrStO3HYk7iikpbzYoKWCfGEFziGUPJH/WF923T6wiU+S81cZki:cnCJ34PZtYoMO4WffWFcDziUS1yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659861797, "uuid": "884d7ac1-2cf1-4673-97c3-e73979dd9b7d", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659861797, "uuid": "8c27b17c-e96e-4a75-9ca8-d47b91c582d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861797, "uuid": "db990102-d1db-43f6-b765-0cae1c54d5b9", "value": "SecuriteInfo.com.W32.AIDetect.malware2.6319.3121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037d3eb4-1653-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659878131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878131, "uuid": "b569f5f4-67d5-4a47-b5ec-1167a74683c6", "comment": "Malware payload (RecordBreaker)", "value": "7fd10ec76e8a107153675911c53bb528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878131, "uuid": "24c89247-d8ab-4ed6-9296-6e1656572558", "comment": "Malware payload (RecordBreaker)", "value": "bb014ee6df367a7536b5884058a370a029268ec576de51f0e29401413083a25b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878131, "uuid": "ebd7504e-6456-4d67-aece-605d6d0de95e", "comment": "Malware payload (RecordBreaker)", "value": "f684b8945603023195665519878bb04da5623181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878131, "uuid": "ab2279f2-71cd-4757-a369-15be2b6103ac", "comment": "Malware payload (RecordBreaker)", "value": "480ee298e3061917fceb2975ebfec2df1dd78eba89cda38502eaf76767d5863ef30aa93ed49f39108bbdbbccb7813de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878131, "uuid": "81a3ea0a-143f-4a7c-89a8-c31bf3181388", "value": "T1417623A72570418EE9E9CC75CE3B7D7131F1176A95C29C3EA9EF3BC12463271A207A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878131, "uuid": "c2218b96-6352-416e-be0a-817c0f1930a0", "value": "937ca6cd69333a6430e6daf1950bd1fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878131, "uuid": "8c144658-df7e-4c62-9963-ff7cbee031d4", "value": "196608:Wm8L4BomvZ5w85heJ92bz30q/OQTWLkPerMd3ZHv+2FIBr:pG4BhZCIhQ2Mq/OQK8ZnWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659878131, "uuid": "aad63aaa-da80-4069-a4f9-69dc04ced1c6", "value": 7200768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659878131, "uuid": "fe3c8a16-33d3-4d85-bf8e-1cd97472bbb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878131, "uuid": "31af777a-9bc6-41ef-a142-27f029da33d9", "value": "7fd10ec76e8a107153675911c53bb528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87089675-1682-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659898538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898538, "uuid": "7024173c-37bf-46c1-adc8-0f03b43927b4", "comment": "Malware payload (RedLineStealer)", "value": "73bc36fe4965dee12f699172c7157e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898538, "uuid": "4ed254e2-63e1-49f5-8c33-36dd4ba373e0", "comment": "Malware payload (RedLineStealer)", "value": "c145075dc14b155cc337a1c34b480a3c1d3634ace3aedfcd8152d1ea56435088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898538, "uuid": "761c0c10-cd2e-4e78-b6a6-d290f94d6b75", "comment": "Malware payload (RedLineStealer)", "value": "e8f107401ff934a18f5983bc3e84c80c5bfd71e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659898538, "uuid": "444ad9bc-1a31-4f53-aa07-1735d620dffd", "comment": "Malware payload (RedLineStealer)", "value": "3c0bba15a27885b22178cb27e1ddbf381ff414ca11c3fdd3a5951360ef4d306f675215bfc3c16b480a00a7c9557fe645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898538, "uuid": "68a8203a-9d14-48b9-a473-9944565086a3", "value": "T191A4CF00BBA1C03CE4B342F4B9BA83A9B82D7DA1572150CB62D57AEE57346E0ED75347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898538, "uuid": "2bd0786b-1b85-47ea-8765-4503c7638574", "value": "42657d19719e5309592e5bc5fbb92b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898538, "uuid": "87d5bc08-28d5-4243-8f30-92209a984f3e", "value": "6144:jyZBXuGl4gugg88qbVA9r3bfEK1vC9oiKyty7B4dqW6+yrXTV4Z6M0P12C6zBcOu:2HeggpqbVar3bfPNQASd6jzTi6M0Ni7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659898538, "uuid": "dbb74c42-d62d-4e2a-b37d-89138c86f563", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659898538, "uuid": "1362e1c7-c124-4250-83eb-0d69de1bfb7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659898538, "uuid": "e9eae4f8-46be-4585-be6a-79a0c6e112dd", "value": "Updated-KYC-TCs-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c276bb6-16ac-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659916451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916451, "uuid": "d00fda44-7c55-41de-a47b-aeba12db445c", "comment": "Malware payload", "value": "f2bf1249634c27a7be51c12b016e93ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916451, "uuid": "e535ff82-c5e4-4e9e-9b46-94ad4dde9eed", "comment": "Malware payload", "value": "c280db3cc3c4501bae9351381641c0d1766b407cff0d152d560d5ce933eec756", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916451, "uuid": "04198334-fa5b-4bd7-a61a-f7646fe5e159", "comment": "Malware payload", "value": "96fb1f52a149686fe824fdeabd6a08adb59651d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916451, "uuid": "8486bdee-9d28-45ab-ac7d-6d5da8e8269e", "comment": "Malware payload", "value": "b4bb110cc666b61700f6f3c87921544d789180c8aad5f77bec6dccb9e7f90a03c69dc976edf715da6eabcbde45c0f646", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916451, "uuid": "cd9539b4-7899-4fc7-8223-691d70908707", "value": "T11FE1D87567E22531E12B1A7A6EB7981E0B247E510F31813E4A1719CF1DF29AECC39B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916451, "uuid": "83b6d330-87dc-4aac-852e-e7d5e65a57b4", "value": "0ff4f8d0cff9b607ac7b2e461a52094d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916451, "uuid": "5befd9e6-d910-4159-acf4-1781381a62dd", "value": "96:cYYnzvLWFfv1YWEXLuOZlj7hrzNumivxqEXu28Fvn9In2V5vh:cJzzWFnrEXLhfj7pE9vdDyzV5vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659916451, "uuid": "4af30637-4c73-494b-987b-ac5f5567481a", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659916451, "uuid": "e5bc1505-427d-4ee2-95d8-3810d9823134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916451, "uuid": "03bdc52c-5b98-4ebc-8e37-67cf183147e8", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.8342.27330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cb033d-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902720, "uuid": "cc84b0d2-8e6f-4af9-be91-375e2be3dafa", "comment": "Malware payload", "value": "ec25cc18442baeec91d8f6e588f40b6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902720, "uuid": "e06d9cc7-a221-4d1e-8d1d-02382cbe69ce", "comment": "Malware payload", "value": "c442806d03f3500c3cd8dad7088c53191fc0945bdb00b41c58ce612fa5ac55ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902720, "uuid": "3361ef35-ab5a-424a-b107-3a15bbd82b38", "comment": "Malware payload", "value": "2ad822f1beb60ce8acd97395f950f6edf0c3375c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902720, "uuid": "31e450bf-c81c-4391-8057-d0b4dac89ee8", "comment": "Malware payload", "value": "24f98246f6afa21b1a84ce48be3f91e4f5c5e5354879e8db7ff42f53bcbc77358a07b1750fc1d9f144fc064e1b91d6b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902720, "uuid": "10500942-00ed-41b3-9451-a9eabaf32615", "value": "T1050485AE3E316B6EE15987320BF76E70C3942D9332E1A752D26DE6045EB038D185F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902720, "uuid": "9217a70d-3448-4f5f-b619-fc6edc960df2", "value": "3072:lVS8+TeVpTG0WntEN3CG6L0+iQm4inOSrldQnq2Z4c2bO:LStgptCP/EKSrldQnq2Z4c2bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902720, "uuid": "d9d52b22-c16a-4e97-bc12-6a58791d5ca7", "value": 174393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902720, "uuid": "857e7ffe-7249-4324-a66b-72e09997077d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902720, "uuid": "04b81a84-0ee2-46a5-9dda-ca765dc2dd80", "value": "ec25cc18442baeec91d8f6e588f40b6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9482d7-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1659902710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902710, "uuid": "43dd87a3-ab9c-48f3-8a0c-82181ab76b8a", "comment": "Malware payload (Gafgyt)", "value": "4a08a3cef55a8908a9990542b96ee1f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902710, "uuid": "ba86a4fe-17c0-450f-b260-41af4ad7153c", "comment": "Malware payload (Gafgyt)", "value": "c5334574536d54255baecfc480db0b6f0912fe4753e82e0fb8144efa52c37496", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902710, "uuid": "481f3caa-115d-405f-bc1b-e5e20a5d26ac", "comment": "Malware payload (Gafgyt)", "value": "1a941cd47d8bae11d1187a1a0fe1654ebc4bb815", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902710, "uuid": "46705aad-bb4e-472a-a626-dc8671fe2698", "comment": "Malware payload (Gafgyt)", "value": "81449ffaee974888323f21f4c54547e015da4977a04ae811874301006fe5c27d74277166b618ae139c048b8b04eb1cb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902710, "uuid": "d5182162-3c59-4469-a1ba-7985f42eb09a", "value": "T1DBD3F741F9404B2BC2C2A7BAF74592CE77B15E982F933305D7297DB027E0AA96D39211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902710, "uuid": "c1ba2c28-7e6d-406e-aaef-3985651d3d9b", "value": "3072:GafVcndVi66CpFBreA5RpVblP5oz6gavpYD0XSpF8IP17YfDQNLBmQWOO:GwebtGRavUPP17YfDQNLBmQWOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902710, "uuid": "4f5b5bd0-2c89-4d94-bba8-39a124454be4", "value": 137633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902710, "uuid": "230e84b3-303c-4a32-984f-87bfd33c9283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902710, "uuid": "af7add88-307a-4437-8085-9cc876a9eb10", "value": "4a08a3cef55a8908a9990542b96ee1f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9447809-168d-11ed-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1659903400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903400, "uuid": "ccf1766e-aec9-4a82-8753-623480ca4384", "comment": "Malware payload (DarkComet)", "value": "6b1e5ae13d6e91e1bb604bade8419b2b", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "annoying", "colour": "#1FAEE2", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "popup", "colour": "#3121E8", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903400, "uuid": "ffb4637f-4c0f-4901-aaa8-23521910de54", "comment": "Malware payload (DarkComet)", "value": "c7786e3cb22e7a6794d63cd9858ac55429f2bc4942769bcc94ded89ca4f9f0fa", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "annoying", "colour": "#1FAEE2", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "popup", "colour": "#3121E8", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903400, "uuid": "8e8c50e4-87ac-41ea-9c9d-f0abe41c8289", "comment": "Malware payload (DarkComet)", "value": "c1f1f117a06e7b34f9b40117e6d5bb2656d9fcee", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "annoying", "colour": "#1FAEE2", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "popup", "colour": "#3121E8", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659903400, "uuid": "e279bb05-e086-47f0-96dd-870d43d14346", "comment": "Malware payload (DarkComet)", "value": "a22d15847c5447fbf2d7551b8727669957f944c8c52a3b0cb537c33cbb406564df692fb0bdbb8c222fac15427c5f74e8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "annoying", "colour": "#1FAEE2", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "popup", "colour": "#3121E8", "exportable": true, "hide_tag": false }, { "name": "prank", "colour": "#F05A87", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903400, "uuid": "b82b7349-ea13-4807-bd5b-1101b44fb4c5", "value": "T14EE48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903400, "uuid": "64aafede-932c-45a8-a479-d6a80ca305c7", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903400, "uuid": "9fcb29b4-c85a-4918-b107-cf73ffebc5e1", "value": "12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hd:qZ1xuVVjfFoynPaVBUR8f+kN10EBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659903400, "uuid": "95108a33-5774-4b28-aef8-883b849647aa", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659903400, "uuid": "d3145525-7b73-4334-9d54-6b2bac9486e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659903400, "uuid": "45771e80-ab4a-479e-b66d-056e665def2e", "value": "Java 3.6 Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40ff232-164a-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659874669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874669, "uuid": "af04d8d8-8173-4736-a42b-24f91285b589", "comment": "Malware payload", "value": "ca2c5ae1214e066299f109488613c63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874669, "uuid": "cdcd0542-9535-4d49-8023-8d66a96c7e8e", "comment": "Malware payload", "value": "c844e7e526c2981ca67b33e31ec4b038cd2e56dec053523fe6e0a04a548a3b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874669, "uuid": "fa5a528f-2bbc-4427-b9ea-4958c03a45f0", "comment": "Malware payload", "value": "e7aef76e05251583255f5d9a88352da9a02f6265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659874669, "uuid": "e2b822e2-268f-4bc4-96d0-a67c385d2770", "comment": "Malware payload", "value": "0184083a942a7a1a3a308a0c868889567229a77135e72cef6da9224331366ca46f73caa68ff1cfa4fd19f582075cca0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874669, "uuid": "ed69ad37-955b-411f-b23e-19fef3f98491", "value": "T1F6B4DFC09367EE77F0346A77B410D1486B20162E80E5D56A9A9DB8EF70B274B18F5F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874669, "uuid": "449f4e7e-9cdb-4799-863c-1ce5bc879486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874669, "uuid": "0c207915-0207-4c72-a70b-9fdbcf325594", "value": "12288:0okg6SKlpxQL46o8iAvmqxsIQh6Hc9VN7RG:0oGLlpxQL4P8F+7hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659874669, "uuid": "739332ba-c1fc-4312-ae43-2393500b9e36", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659874669, "uuid": "573724a2-5ca4-4f61-9a03-a0fcb1fd3289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659874669, "uuid": "af9ee926-f2ac-416d-b28b-5dedb8af9749", "value": "Confirm bank datails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7c32a4-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842444, "uuid": "40fc6e2f-4fb8-4dda-9946-54041556e0ea", "comment": "Malware payload (Mirai)", "value": "488ebb8fc6de1b45bddc8959efc296d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842444, "uuid": "5cb24d72-ec67-4399-937a-29716f3590de", "comment": "Malware payload (Mirai)", "value": "c916e40feae275de13df236f2423b1d67cb560772a8663688ceafeb37ac9ae39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842444, "uuid": "a494b223-2640-4c33-9cdc-30f4ee1fee44", "comment": "Malware payload (Mirai)", "value": "346f3c818f05594f8e69be20e7b66456168f1e6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842444, "uuid": "95ae55c5-5849-49c0-8bc4-64a672dbae10", "comment": "Malware payload (Mirai)", "value": "e6b8b478e250be21b31ab60a9a0fd023d31f7566e6c2466279d012c3feb787aaee983df8ec241a066ee31b9f4ea18a73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842444, "uuid": "97dee668-2016-4536-b92e-855c291d4fe7", "value": "T13EE35C46FA818B13C4D517BABAAF01493332A79493DB730689285FB43FC6B5F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842444, "uuid": "34a17341-3e44-4b79-a936-5fe565dbe343", "value": "3072:75ta4omF5I9VKW9bTMqDAzjsDRW35rFmJNXB8lM/92bWe:75E4om5IP98jsDRW3hF8XBOM/92bWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842444, "uuid": "eb8e9105-b6aa-4840-9abb-51f27227171b", "value": 153267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842444, "uuid": "63cc9e0b-f2fd-44b8-8e72-6ba3bca48fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842444, "uuid": "0200b295-d021-446a-958f-a3e94a022b83", "value": "488ebb8fc6de1b45bddc8959efc296d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198ef557-163c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659868290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868290, "uuid": "50db25da-bf0a-45e5-8ae9-1795766af62f", "comment": "Malware payload", "value": "8ba447c1e8bb2a84e9a5f4c01e9981e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868290, "uuid": "b88bcf6c-a792-483d-8754-fc48662fe02b", "comment": "Malware payload", "value": "c9266ddd9fde30cdf231365c72ddc106c88fa6adedaff72424ca28037927aae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868290, "uuid": "e3c51a6d-cfc0-4eca-904e-f9f72f9c0b3d", "comment": "Malware payload", "value": "150773df5c26524c7b0691bf9d386bfed935ef87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868290, "uuid": "062c7888-5886-4262-a159-c03d568eef6b", "comment": "Malware payload", "value": "3ed15dcfe5832a9e9577c93f3d7dcf2b6e63a3bc1329d8a4d0e901e0fbf173eb54132f90056d99b079e1b7a5532d687b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868290, "uuid": "d9105ae7-11e6-4a87-8928-4ffece305ee0", "value": "T1DF8523B4365CD15FE803893A9DAFE9BBCE8E2875627486D384667339111ECB3C8CD464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868290, "uuid": "a52febcd-79b2-45bd-b5e8-d0b0cc7ae5c2", "value": "a8edba105869c8b0330adec370df50cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868290, "uuid": "d14bbf01-7666-4a94-a457-cc5997b4aede", "value": "49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659868290, "uuid": "baaca6f1-cddc-4cb2-908e-46745b74be54", "value": 1856915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659868290, "uuid": "c96e6b33-167c-45bd-96a2-c915270c9fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868290, "uuid": "1cb542d7-a132-4e4f-9e15-6eff7eb1f31f", "value": "8ba447c1e8bb2a84e9a5f4c01e9981e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5a0cf6-1679-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659894734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894734, "uuid": "5622b3dd-6527-49c7-b37d-0bfc87d68f40", "comment": "Malware payload (Mirai)", "value": "ad71b62f0e5e93224687697ea3fbd310", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894734, "uuid": "744c8de9-c2fd-4680-93e1-e75369c43b22", "comment": "Malware payload (Mirai)", "value": "c94e7abdb7b94845b19a9f21346891c56159d1d8f6f9ff8775e3a146261f9efb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894734, "uuid": "39a7ad78-0162-4467-bdad-59baa61a5465", "comment": "Malware payload (Mirai)", "value": "931ed524b7201a51554319569562b6b33fa069f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894734, "uuid": "2a1c40c9-f66e-454d-907e-da69d7f24ca3", "comment": "Malware payload (Mirai)", "value": "b4607c38a315c4b581e74e1091931a21c6f8e877926edb1a5d544c86ffe97542b2471f9ae3dce0c83f2451cae5a11301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894734, "uuid": "552a85cf-f7b3-4fe6-a558-676c06409932", "value": "T18443F85AF9818B12C4D456BAFE0E138E33135768E2EF7313AD145F786B8652B0E3B402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894734, "uuid": "92cbc1cf-992a-4e29-986e-0e8d2c9901a2", "value": "1536:+8nTRYGYJAY4TFoFzl2EjGYinc3DMRiFpTFq0an:9eGfkjFpTFq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659894734, "uuid": "5b83c97f-dcbd-4ab3-8d47-c2808f39b315", "value": 56852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659894734, "uuid": "55d3d142-a3b0-4d8f-a1e2-7fd8c571a0ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894734, "uuid": "46c6131c-5aad-45a8-b900-cf149c70aa3f", "value": "ad71b62f0e5e93224687697ea3fbd310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192a96d2-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1659902649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902649, "uuid": "9205cfd4-410f-4ba7-96b8-e74278b8fc7c", "comment": "Malware payload (Gafgyt)", "value": "643492cd2960ff2f023c63dc652bae1e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902649, "uuid": "3f743afb-95b5-465c-9010-dfe4c599f6b0", "comment": "Malware payload (Gafgyt)", "value": "c9f545c81064a285a59bd699dce8d594a1f97fe2a4cf485d277cc2f0feec1f7b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902649, "uuid": "ca7c4340-47b6-4fb1-8bed-6df44bf22b09", "comment": "Malware payload (Gafgyt)", "value": "3286919be75f1924a5789f4a4774a3e73b2c17d2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902649, "uuid": "6acfed5e-c860-43a1-a1c9-439a7c16a421", "comment": "Malware payload (Gafgyt)", "value": "7e6200fc870e4da7bae34f179c46957fc9f900339672a4ee11d53fc9ca3f0669ea0d472183577b7ed9006422995723fc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902649, "uuid": "28bbc895-3307-4fa7-99a3-72aa7feb952e", "value": "T182C3171726D3CDBAC08397791BCED15368B2FC3F073621026755FEA42F39A985A9A311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902649, "uuid": "24bdb1e5-b03c-4c94-b813-e9ecb7cc0515", "value": "3072:U1g4GjebR3ARqVRU4WEO6XAyJbnhuA2q+lC7SdVnhGHSp5O:at0uRWVXo0FlC7SdVnhGHSp5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902649, "uuid": "16b0864c-ba8e-49ea-bfc0-988aed2294c4", "value": 126841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902649, "uuid": "3cc4e7cd-8394-4a64-8c46-c2a914395d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902649, "uuid": "f680487b-a98e-4c33-ad15-7046c7aa9d63", "value": "643492cd2960ff2f023c63dc652bae1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf7af8e-161c-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659854739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659854739, "uuid": "0c11e8b1-ad6d-4119-9702-79d25c039778", "comment": "Malware payload (ArkeiStealer)", "value": "39379bffb5e9aafdf8454ed2f96c3939", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659854739, "uuid": "ce0a68c9-911d-4209-84e8-7da242663c0a", "comment": "Malware payload (ArkeiStealer)", "value": "cd39c3247c322f1fe4972007f214413539b9f5f4454b87a79d1a099ef9fb962e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659854739, "uuid": "0561d3fb-94c6-41ae-8ab9-b42fc2a4cc92", "comment": "Malware payload (ArkeiStealer)", "value": "7d6589ad6c3c933851c6f826ce06815764f003ad", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659854739, "uuid": "f8ff192c-83a1-45e3-8817-34941b6f0436", "comment": "Malware payload (ArkeiStealer)", "value": "413d4bbe47898422634c20e6c006c9df906e9f70cca183e6d6c1eeff8dd610e88f40152748b59e3a997fc13d22bc1fea", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659854739, "uuid": "fe14164f-6df5-4749-baab-51e1ae39bff3", "value": "T1C3D53A135A9B0D75DDD23BB4A1CB633AA734ED30CA3A8B7FB608C53959532C56C1A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659854739, "uuid": "b64694af-6e63-43a4-ae40-389035ce04c4", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659854739, "uuid": "d1519831-524c-4ed9-b346-1795503d13e2", "value": "49152:4QO6BKeS5OAW0GE1YjpX+4kKW4Pgu+opl3Z:4QO6BKeS5OKGEY1W4PguRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659854739, "uuid": "04abade7-52fd-4c0b-9368-0223cd3b0cd8", "value": 2876180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659854739, "uuid": "a59677c9-987d-45f9-b607-5d7df9383a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659854739, "uuid": "904e2ad8-8ac0-43f0-a141-707cf3c65fdb", "value": "39379bffb5e9aafdf8454ed2f96c3939.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57d77d0-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842325, "uuid": "2067a893-b1b2-4ec9-8159-2470916fd7c4", "comment": "Malware payload (Mirai)", "value": "5795621e92997724a011c37b763fdc5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842325, "uuid": "865dcc0c-c082-48f9-bd68-996f4f22f9a5", "comment": "Malware payload (Mirai)", "value": "cd5ca57b83bdcca26941fc60c1da2645a3e3f814e4c1e9435482ee6640eb5825", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842325, "uuid": "daa34fe5-5f3c-4935-9feb-e371c5318b71", "comment": "Malware payload (Mirai)", "value": "fb50b698bc093dfc7b3b7906c4f64bc09bb26ec6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842325, "uuid": "09903ba8-2b26-4c8f-8d4a-a573857d2c1f", "comment": "Malware payload (Mirai)", "value": "1ecef74153f2578ed00835ceccce21e59baa57d443adb9c426f3423f793650f0d9343f1ee5760c3683d624862ba5ad3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842325, "uuid": "710c09ba-656b-4d36-94bb-eb495c152cb1", "value": "T1EF734B0271280B47E5930AB42D3F1BE05BBEEDD035E4B688695FDB664A35E375086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842325, "uuid": "f9d559c7-8add-458c-9726-9e60542a6160", "value": "768:+05DtKwQ/uUHRAlfu4cC1iJUqv2LHH9Jnc1mSQOi607DtFHwOTrIm5RmnZ5UIrEf:OHOPcC1iJUM+Hnc147/PmvUI6BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842325, "uuid": "f32dbf33-96ee-436a-961e-c8e584571900", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842325, "uuid": "237dd7fb-b773-4bce-91bc-53b6f76500c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842325, "uuid": "833270ae-15bb-4922-8af5-288b6826005d", "value": "5795621e92997724a011c37b763fdc5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9098dbd0-167c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659895977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895977, "uuid": "776d44c9-af60-4609-9492-a2f7f807c069", "comment": "Malware payload", "value": "7ec247424733c287c3322fc49f1a7766", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895977, "uuid": "7f9ad7cc-ee9d-4f9c-a971-39ca750b5d84", "comment": "Malware payload", "value": "ce62915cc96735d1921613c9969882e352429c7aaab54145d270502d6b6068d2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895977, "uuid": "922e749c-fe8c-43ee-80be-696d980221fe", "comment": "Malware payload", "value": "4a4486985f76c0305fe7ef05f11762eb49d6e2d0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659895977, "uuid": "018c909b-3dfd-471f-bc42-243ba6b927d0", "comment": "Malware payload", "value": "ab906ba97587fd7dd97736ae38fe11b6627134da6d29c186708ec01ec68c14586332996e4c5935ce854e5bbe7126fa21", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895977, "uuid": "d5a78b27-51fd-4a42-bdc6-f281360b0177", "value": "T141F5332BF5A38324DA57E038C1F0B0A5F2DC279E9518FF172AD5758A89E3D44AD02E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895977, "uuid": "c688fbed-2d18-437f-b337-824c8528d164", "value": "98304:CEVF6aL7fDW3v0AMYfccAQd+CsqBGnrBzeUw9UWosWzi/:C46x3vKcAyUnlzhwW6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659895977, "uuid": "11e31e7e-43a7-4127-a495-208cf59cbf2e", "value": 3423260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659895977, "uuid": "037286eb-28fc-4037-b060-c18426b8274d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659895977, "uuid": "b09be7ca-366e-4fe2-8336-2596c2ffa342", "value": "gen_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38d04c2-1639-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659867340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867340, "uuid": "d0e6988d-f900-4e14-aab2-93fbe08cdfb2", "comment": "Malware payload (Stop)", "value": "2a40abd870097e0e8c7e23b70e95fd93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867340, "uuid": "eda20060-169d-437d-9547-fc3a0c24ba31", "comment": "Malware payload (Stop)", "value": "cea10fefac43bd4b9f094c2391a130adc054aad664892177110e1bd21970c907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867340, "uuid": "47099706-9297-46d3-8ff3-97dfa6445685", "comment": "Malware payload (Stop)", "value": "e06f34c9a2ad3f7d21d663dc8a2714ac8f46c944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659867340, "uuid": "a745e4ab-29eb-4369-8f57-5dca68062bd3", "comment": "Malware payload (Stop)", "value": "408f3766c8078431beaabe24f5146c736a193085942e6a92c1607eddb5f9d4191e576313fe34454c36e410274dc11ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867340, "uuid": "9f09204f-a52a-4175-823f-a36e9a81b314", "value": "T135050210BA90D035F5BB26F44A7A9268BA2D7DD1973050CF62D82BEA57346E0FC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867340, "uuid": "69e8f188-41ee-47e6-9a8a-dd759cef00ad", "value": "89c35d8c74820f04e6fcc9097b9e8b18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867340, "uuid": "f8add4cc-3555-4cc9-9af8-772654a7ad26", "value": "12288:Jr5fxfTr9ONoYoNvU2M/S0lGsXbaaasRoJlQ1/oyP1UXCsBZhdk9675YSGqpWrX:tfTQleU2MlGOavDQWyP1w9BxPCSGqIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659867340, "uuid": "b1c0569c-a8ff-4031-84af-b02b5f54751d", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659867340, "uuid": "f96eb6a9-b9b3-48c4-82f5-1ba8cc2b3684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659867340, "uuid": "0c2e29a6-7dbc-4ee5-8f48-d20f5d677901", "value": "2a40abd870097e0e8c7e23b70e95fd93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45513db-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842430, "uuid": "ee74eaaa-f429-423d-a114-023e19b22b40", "comment": "Malware payload (Mirai)", "value": "ed6c1559c13c8bce6dc884c956c1a3f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842430, "uuid": "eca67c8c-66ce-497e-a91d-708a097f8674", "comment": "Malware payload (Mirai)", "value": "d28ca9ead53973259b4bb235858113909883b90b1aab5547ea00c3e286a07646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842430, "uuid": "ad4c8c3e-7825-4f1c-bf44-5a94cc8cf55c", "comment": "Malware payload (Mirai)", "value": "efe5ba7bc5340a400300b3cbc3d669b889585e57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842430, "uuid": "da7d3f1a-cd25-4a8d-848e-d1d54565f1a5", "comment": "Malware payload (Mirai)", "value": "c6a7b3be58e41e80d2de161e3e5217f7cc94dfd8f03ed26e951bcdb23b4b571ae305aa909e50dc96068862d89badd46f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842430, "uuid": "4cbc8fff-1e64-4546-a53c-720ddf67839b", "value": "T13863AE25E0058960C4864238B4E6CE751F63FCC483BB5EB5AAD581AB1447EF8F61CFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842430, "uuid": "362f4fd4-89f0-4bce-8917-061c4ea7230f", "value": "1536:GaPx+NOqFLF+wtHRHTyRWIL/NJzqYTCUdSCzc:GrNOqFLsWywDYuUdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842430, "uuid": "70c2edbc-0b76-4750-b7cc-42c12a013068", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842430, "uuid": "7260629c-abec-45ae-9366-a6c078589edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842430, "uuid": "82b8b7f6-18e2-413f-a700-b83d9b89dc0f", "value": "ed6c1559c13c8bce6dc884c956c1a3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6dca8d-16a0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659911595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911595, "uuid": "a0af813b-f850-4331-804c-29ef97562b75", "comment": "Malware payload", "value": "517767a37671d5933cd484d003d9b4b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911595, "uuid": "6581351e-a2ed-41e5-8eb7-bb3c8d87d852", "comment": "Malware payload", "value": "d2bccb1ce6fc13cf982842209ecfc19eecfb0e00d883f5ed702fa3da7fa2351c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911595, "uuid": "66af8086-c87d-4280-b36d-182917ccb3a6", "comment": "Malware payload", "value": "497cbbd0541cac266c9f3a07656c95e0b2b72db1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911595, "uuid": "13b91131-af9c-431c-bf15-5fe7404c922b", "comment": "Malware payload", "value": "3518f9a2447c3cce567791465e903f0fd4aeec422c9a4cb340a04c72b30451b7b7a58617c11327327e77b5c5c0027875", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911595, "uuid": "7d6f1856-74b4-4922-984e-e9564dfb9d34", "value": "T102732956F9806F11E5D521BAFE0E0149339357B8E3EE72129D209B2537CBA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911595, "uuid": "1c192b90-eaa4-4549-a554-1a49b7bc4c87", "value": "1536:6+nxA25aqa5OoZ5ImE5eta56SC5PgxQJfioHBVaqeSEY6tBillfiXKuBfML8cY7J:2257a5hZ59E5Ua5PC5P7VimBVaqeSESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911595, "uuid": "17d932f0-c37a-41ce-b1d3-7016e821b330", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911595, "uuid": "e1e19df2-016b-40d9-b3a7-0f544057ae4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911595, "uuid": "bcb47a8f-0a6c-4c5b-a1d5-6407521ebeb5", "value": "517767a37671d5933cd484d003d9b4b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a13f75c-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831810, "uuid": "1e791111-f810-47a1-9867-d8e391d870ac", "comment": "Malware payload (Mirai)", "value": "1eca1d841bb0a8ce9ce215096b8ac619", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831810, "uuid": "717f5286-0fbb-43e8-a157-8ff466d271c1", "comment": "Malware payload (Mirai)", "value": "d7866c764f583c691a7dd06c58a9ceaf035972d8789cb59dba1e8eb48381e671", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831810, "uuid": "5f0deeb8-a1ad-4ac2-b362-8293155d3cdb", "comment": "Malware payload (Mirai)", "value": "a1144582193540c7b5c29a9495791a35c3700411", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831810, "uuid": "e0d57884-dfa4-4548-b43f-0a0649952f06", "comment": "Malware payload (Mirai)", "value": "ab585435a2f082e8c7c916e90b8b4a3c7dd095551433077a247b2b49ba52f14408559739a555e46c30615de0cc6e486f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831810, "uuid": "13cc0278-3b1c-414d-aa92-8776b3c2b920", "value": "T101D2E16C660789E5CA9090BEA2A41BF21E320DFF5267BD497CD4E827891207E35D3DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831810, "uuid": "537656c8-0a64-4125-8f51-87ff7d9fd5c9", "value": "768:imalfnoD9h10qdSq0CuVqPYrNA+IRi8cJgGlzDpUYsS:ima1oDV3dSauVqPyWUVqYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831810, "uuid": "9f7dbb07-2296-47c9-90b2-15b2e7136b31", "value": 30796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831810, "uuid": "c7ce1184-d283-410d-83d9-4ef8439059d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831810, "uuid": "6d03bebe-8d19-4371-8616-2ab27e2590fa", "value": "yakuza.mips-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb3fa8-1657-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659879927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879927, "uuid": "8ab5493a-7302-46bd-a4a1-4b2e0cfcc6f4", "comment": "Malware payload (Stop)", "value": "2e6f66d70b6115ed729125e022c16d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879927, "uuid": "8e96a853-c67b-43c4-9e5f-e6bbeca7af6e", "comment": "Malware payload (Stop)", "value": "d83e3f7a65229291df7be6cc58a922081ee7d66fee59c514a1863e05b2a6ee04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879927, "uuid": "b8bd154f-528d-4ee7-a299-e30f8234f001", "comment": "Malware payload (Stop)", "value": "5c0b95370621ac2f226189555a61dc424ad0311b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659879927, "uuid": "90765b6f-cd3a-4ce3-b3ed-222cad593bbd", "comment": "Malware payload (Stop)", "value": "41c1d096b1c4ffe85217539ba9628ac936ea485729d4c502a8dc2cf8dff8b37210ee8b8421337d7ad760e224a42eba90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879927, "uuid": "76f12afa-b36a-4927-afeb-5b73ff19f96e", "value": "T11C050100BA91C430E5B616F4967A93A8B93D7EB1677161CF52E46AEE53386F0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879927, "uuid": "cc03b365-d6f2-4115-ae0a-c5cdf1f15399", "value": "39e2a2a3ff0fef7be07267ef50e1be9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879927, "uuid": "302c72a3-9847-47be-bbed-180f5709c9b6", "value": "12288:+gHUwThS3vfbzwvUCmop9HnzGW70SuvUcsOsnh/z1V4q6gChVLlNjVjjAJF3OES2:J0X37k8ynHzxYdrsOsnh7oq7k5nf8S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659879927, "uuid": "fd4ebf0e-17e6-49a5-8a9a-e9c352596761", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659879927, "uuid": "fef9d4c7-73d8-4bd0-92ae-c2a90845e213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659879927, "uuid": "1b8d3cd6-bc43-45b6-9b01-655fd740a038", "value": "2e6f66d70b6115ed729125e022c16d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cba614-165b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659881732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881732, "uuid": "60c7c52f-240b-4076-8212-de572727949d", "comment": "Malware payload (Mirai)", "value": "5630ee34393ce22d317c3a11a91b5bb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881732, "uuid": "5073ae4d-3745-4a28-89c3-f1ebd013f37d", "comment": "Malware payload (Mirai)", "value": "d86d158778a90f6633b41a10e169b25e3cb1eb35b369a9168ec64b2d8b3cbeec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881732, "uuid": "7cff5a82-671d-4fda-9869-8ef026fe29ba", "comment": "Malware payload (Mirai)", "value": "4698a9f872bde68f504e875cf02c87cd53a4b445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881732, "uuid": "e6807242-5932-479a-b68e-efb035505b01", "comment": "Malware payload (Mirai)", "value": "174c03e138bf3074e1549912c029b1c95122ac38047577bfdc5833757cc097ab36268652ed4435a208050def8835b767", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881732, "uuid": "a3ee3fd6-546b-4472-b91f-efb18c8ffb5b", "value": "T16AB3D50E2EF28FADF169C6396BB34931D359339633E1C285D1ACD5143AA42CD581F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881732, "uuid": "46bf83b5-0c90-490b-a103-a2e4edd35114", "value": "1536:TzCq0B8XpeSKoWOAYNoA4VQwKQHyiY5n20BxSsqTflewAc0oQGFxzG9FB2K9OfFy:fCpYNNoAJwMtBxSskfXxz0cFh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659881732, "uuid": "e696c23f-2a5d-4769-b69f-b13ca0abe165", "value": 107996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659881732, "uuid": "83d21815-3503-4705-bbb8-d50c3efbdfb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881732, "uuid": "1c0a6760-f660-476f-bbd7-f6eedd89a965", "value": "d86d158778a90f6633b41a10e169b25e3cb1eb35b369a9168ec64b2d8b3cbeec.elf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb6df98-1653-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659878257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878257, "uuid": "0448ec09-6518-4982-82f2-4a480552c564", "comment": "Malware payload", "value": "1bf023676ad36aaf90d2479a62bbad3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878257, "uuid": "d7ac5f99-9ccd-4c0e-b457-668c8e3c382f", "comment": "Malware payload", "value": "d941d430e3e4867c2136b198610d551774d44d73e3d9a1db379279291ba7acb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878257, "uuid": "36c11a1c-6d2a-4d41-8bec-0d0491aac81b", "comment": "Malware payload", "value": "8193c9eb664105b58541d7460e377008de3a17b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878257, "uuid": "548927a1-0e65-40b9-a433-25b933f1502f", "comment": "Malware payload", "value": "9f5b025d06ac4cb0998093d533a537b3933eb9b680205bb9f93e9b1cb68eb9683c48600d0973b1dfea82e0711b57b1fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878257, "uuid": "60a15a2f-9b7e-481a-9094-5c8a67cd32b1", "value": "T12CF4E0C09317EE77F0287AB7B520914C2B64152E81E4D5799AADB8EF70B230718F5E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878257, "uuid": "7829016f-2651-481e-bca3-e286198a3e69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878257, "uuid": "1cee0e3f-a5a6-4fc6-b397-dcac0051a978", "value": "12288:5Zpg6SKlpxiP6/V/qhDsLq1Q9GaLlOhlEm5XPbEkLD1MWhTSD+1:5ZHLlpx2AUhDqtUoWPFQMMWED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659878257, "uuid": "c8779fa2-b7bb-4aa6-b3ca-5edb0a952401", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659878257, "uuid": "30861228-5738-49be-93a5-f50f0cf8c268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878257, "uuid": "0b49df68-0468-42cc-a3b6-a9f58222c1e7", "value": "Purchase Order 194428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9099f28-162b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659861336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861336, "uuid": "3e500708-28af-47a0-8f0a-de361b08ab90", "comment": "Malware payload (Stop)", "value": "015f716f5fa75d5df4f8f7a83b839629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861336, "uuid": "a9dd636e-db3b-4f5d-8f5e-5e006ceaa797", "comment": "Malware payload (Stop)", "value": "d98d97f0fed4a9687c62c6554a1ed506e6a2d27fbf76078c0cb67850d05806f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861336, "uuid": "853add50-da8e-4519-bf43-ca149179fc9b", "comment": "Malware payload (Stop)", "value": "9ab9c55fb7a2f33a429b60085043b0cb4810cdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659861336, "uuid": "4dcaa7a7-1c7a-4a7f-b9df-43541f1b74c6", "comment": "Malware payload (Stop)", "value": "c6619fd014412e956fc607d097520036948303701f1c27bdd4570ac5387d8631e3a100c4bb653861f61eed9f83caf73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861336, "uuid": "009483f6-018e-4389-98b4-e0175adca0cf", "value": "T14905F100BB80C039F5F716F44A7993A9B52E7E90AB2564CB62D42BEE56346E0FD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861336, "uuid": "d9b3e9de-a3ef-4dc5-b039-c8347d07601c", "value": "09220c43a48769a57a51fe2bf629b1f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861336, "uuid": "629058f5-cb4e-43e9-8687-126537abf914", "value": "24576:m9JqoV63es8bU6zrmrY/vT5dA0NaPnI0DW:mywZ5KHPI0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659861336, "uuid": "404d9139-6cce-4f1b-9000-84e9055d0fe9", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659861336, "uuid": "0eaba990-6ab3-459c-85be-7a85e97e2d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659861336, "uuid": "1c997656-a94b-49bb-8dc7-a62ec2a582d6", "value": "015f716f5fa75d5df4f8f7a83b839629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb7d705-1619-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1659853241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853241, "uuid": "429bd948-abbc-47b1-a01a-a4500905c02b", "comment": "Malware payload (RecordBreaker)", "value": "1d11384246ce59a94992ae6d42028605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853241, "uuid": "d5e2ea15-53d0-490d-b00b-f245aba7e2ff", "comment": "Malware payload (RecordBreaker)", "value": "d9b885f05a64a1a3bab13334bf378b7093ee6b4a5790d5608c5cf3531de1de7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853241, "uuid": "3a8172ff-ec57-4f9c-bbdd-5ddfb6650fa4", "comment": "Malware payload (RecordBreaker)", "value": "b090c5efcfab406faed3963dcfdfb4cd1910c4dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853241, "uuid": "2b2ee38d-eda1-4516-826b-3a5244da3658", "comment": "Malware payload (RecordBreaker)", "value": "34a4eb9f806d3608e864df83e38e87d13333a669670c77bf797242bf9f3ec527d374e39531a65e069dbff9139f490632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853241, "uuid": "fe498d6f-e078-4d13-9eec-58be539dc06c", "value": "T1C9B5C8CD99B0ABB0FC6C95A1424DAB21C994DFEFAC670C5FD9D4A741738F289A500363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853241, "uuid": "70eab443-cd1d-47b9-80b5-f8552e76d936", "value": "3c28622a06e2435b829e7b3d3e133da6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853241, "uuid": "2bb38d0a-ac94-4add-9138-c6e2380bec4b", "value": "24576:ibc2LiC0j+/F0wAY0kReRT485C6AfsGVFzWLaXsA6/H3+OhOiUKyK6Z3mmxge7:i7+Nwi7Y0CeF485CtsGVumsA62J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659853241, "uuid": "4fb3c6bc-f3f7-4b94-a711-5e7ffaaf680a", "value": 2340816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659853241, "uuid": "efbb9de3-c2c6-4c0b-83e2-96aca1109d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853241, "uuid": "552a3882-5735-45f7-b4a5-8d5c98f1b042", "value": "1d11384246ce59a94992ae6d42028605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197a80e-162e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659862371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862371, "uuid": "b6418472-6cf6-4052-b6cd-db6955bbaf81", "comment": "Malware payload", "value": "d0a51f3b5e64e1fb4fd5396cc7b7f883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862371, "uuid": "4fb27987-7424-4126-9633-f6fca5593e67", "comment": "Malware payload", "value": "da4f28e06503fd29cac0094b1eab48cc3dd9bc82c6359a02017cada93f7f9425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862371, "uuid": "55db8e8e-22fb-4887-8255-1d72d05cef1c", "comment": "Malware payload", "value": "1b6a0f8ab28c5d0faefdde15fcbd076e5e61ca5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862371, "uuid": "e3bf3587-ab61-41fb-a150-9edce0283002", "comment": "Malware payload", "value": "006088299cb56c7c300f5a638318bfc0e487b6fb66918886b5b667818211744ab9c912e64aee4b27a39c51a1c2c7f7db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862371, "uuid": "0bd445e0-b878-4e62-ae2e-ba06e5c94e7b", "value": "T1A912C560B3C89B36E9BE1635983752212AB9F7254867D77A35F0124F9D327400E72B6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862371, "uuid": "ee4e809b-b90b-4190-a69a-a1c5ead0b212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862371, "uuid": "1c9411e4-d346-4596-9157-4c090938d4de", "value": "96:Kwa2aF5np9cbM1uv+L4HFrfaZ8aBrUCVJchD2VhG+oIStXRa3aNkpzNtb:vH6jt3cdfaZ7rPTcwVroIStXYLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659862371, "uuid": "364446df-aacd-4811-a097-bcd4c3c16d92", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659862371, "uuid": "6a467d19-01c4-48fc-b429-5dd084ca488c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862371, "uuid": "60d8f65e-11e7-4000-b36d-068f5b65c291", "value": "Custom Release Form(E) AWB 825.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f789392-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831819, "uuid": "b2ac6ba6-e1c0-4e8a-b621-5c1c6a96f205", "comment": "Malware payload (Mirai)", "value": "a1ac1a531cae7838dd251be0fd7f0ea8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831819, "uuid": "a12492ec-a41d-4116-b911-5078e53e6c97", "comment": "Malware payload (Mirai)", "value": "dba37149e17337d3edcaedf4d369436a8f1b307c41d2976cd61a0d9bc00c8773", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831819, "uuid": "1065dc2d-4604-484f-ab5d-158aea57f7fd", "comment": "Malware payload (Mirai)", "value": "9327cc9318584c131964808ba1f55d0f6cd3a31e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831819, "uuid": "58e7c1e0-6712-402f-80a8-1c9470975670", "comment": "Malware payload (Mirai)", "value": "ee97e96668dfbf195642f2918b8baa9b25b4eaff2711138c98bc82370c57aa3f53f5242cb178d558378e544bf958bbfc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831819, "uuid": "c80265b9-bf78-47ef-b141-ad265c2e7a44", "value": "T1F3D2D0107049D863E1F01E3AE078456223766EADF4CC7AE8786552BC77831A05AED7B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831819, "uuid": "4a4e5a8d-fcfe-44a5-8d10-a80c6c1ea925", "value": "768:qRlkd80kUfPLcT9BgySEiOdKKUeh6jRFXOQuXj3UU:SkdlHLcT925YU+6FFXOQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831819, "uuid": "8aa2c6c7-55bd-437a-be35-9daf3924b0aa", "value": 28476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831819, "uuid": "ac89b43b-2600-454c-9b89-8427b0a676e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831819, "uuid": "020e5563-a077-4c93-a5b9-fe88dc9b38f7", "value": "yakuza.arm-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b98c645-16ac-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659916450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916450, "uuid": "7128c954-d911-4732-aee6-16564ae849c0", "comment": "Malware payload", "value": "bfd164c598d3a365164c4a8f62b194b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916450, "uuid": "43a77aed-a5a8-4f21-ae1e-3c0819234b14", "comment": "Malware payload", "value": "dbaa654e027f88b023aff61c7d986c81f7715c84f1c87ee3c7bdc500f5b8fa66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916450, "uuid": "d1a48b0c-ab33-4e3a-813a-3eead08afb61", "comment": "Malware payload", "value": "3939db11bce5c4cd01a36bf9d99227b83c5bc8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659916450, "uuid": "94a47dba-0825-4595-a5f3-6b52666e3b4a", "comment": "Malware payload", "value": "6f98dfa1fb254a2984139d144b4adc890964086c507c033b70de18c5de839af40e8a564aca30136500c94dd5bfaf5bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916450, "uuid": "7dc74a1c-78cf-47d8-a141-b9528fbd941d", "value": "T1327533032AF84812EC532F317AB9C359EA31FD219AB0C41F1750F44E3FB9A965979267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916450, "uuid": "53f5d422-387c-4292-b7e6-feb5e5e04987", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916450, "uuid": "51830c6d-b51f-4616-9607-1aa2740cd982", "value": "49152:Ed361wCH6o+sIJMJ5sr0I3sSJ8sPXzOH8CLA/:Edw9aMJ5mrGs/6H8Cs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659916450, "uuid": "5d2b1762-598f-41b2-8bb5-45b2405454f0", "value": 1628360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659916450, "uuid": "9f21718d-39ce-484d-8824-01185bbd22dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659916450, "uuid": "b8b7c8d9-e1b4-4ba2-b4c5-26c934bf19b1", "value": "SecuriteInfo.com.win.grayware_confidence_60D.20089.8054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc177e80-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842363, "uuid": "160cfc9b-a0ca-43f6-9c21-443e42448ce3", "comment": "Malware payload (Mirai)", "value": "0be018a1ad850ae4572a0feaad07c869", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842363, "uuid": "a75ceb44-d2bd-4bfa-ae09-d63ca5aca195", "comment": "Malware payload (Mirai)", "value": "dc6448209d5411476a85783def05e34e54b3fc6c554bf9227ac9ffe64626553f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842363, "uuid": "d00e5ff0-d801-4598-a6e1-0c3fe7d8303e", "comment": "Malware payload (Mirai)", "value": "21edc73f8f9dedaf1eff32983820b84d27c1a159", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842363, "uuid": "08247307-58d3-4223-9587-c6015ee3f6d4", "comment": "Malware payload (Mirai)", "value": "5c5ec47a40231bc31803bcd78b0352ec7f2150c40cb17e31b5bfdda9034403bb7c268c1a1c954aa5ef4c3f1680b0e546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842363, "uuid": "b82274a6-35e6-4b89-9a30-b5d0123666d5", "value": "T16443F961BC915A2AC5E0537AF9AE558E332077E8E2CF3227CC611B107ADA41F1D63F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842363, "uuid": "839b0f31-0324-4cf3-9e25-dee3f2118185", "value": "1536:+n1pyUGLbFXsCmbnmcVBREee3mb1AVMoh+C+FPcd:+n/6Me2ZAVFhdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842363, "uuid": "362e826c-6840-49be-8f46-54189b95852a", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842363, "uuid": "2497117e-1e8d-4d72-9914-a886316f17ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842363, "uuid": "52b8616a-a62f-44a3-bd60-bfe7061fca1d", "value": "0be018a1ad850ae4572a0feaad07c869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a62c72-1619-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659853244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853244, "uuid": "90327ec1-c53c-4e17-b877-41d6920448bc", "comment": "Malware payload (RedLineStealer)", "value": "2ac8d72d59d43e280816dd9ab15a1ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853244, "uuid": "cc895e32-10a1-4db2-a76b-b543dc2fdb8e", "comment": "Malware payload (RedLineStealer)", "value": "dde26764479f0e0ac6f6cbf6f22a292686490c252c938a2321f86a1c849caef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853244, "uuid": "26f51d97-b1ab-4fec-8cee-7be1fa1dbef4", "comment": "Malware payload (RedLineStealer)", "value": "0d1447ff776e940656edc0a0f1fb67702525bc6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659853244, "uuid": "a541e994-31b7-4ec8-9588-40bd967ebfb1", "comment": "Malware payload (RedLineStealer)", "value": "2846d0c6feaa36508179c555dc29dfdeed25ba6ccf3b6a8c719a1480a3a1144715b8a4d05e8b73445cf52ce02292889e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853244, "uuid": "96eceb3f-609f-4821-8862-7d52845bb047", "value": "T1FC657D2AEB1614B4DB535772C1DEFB7B9B047A248032AF3BFF46DA0CA4331126C95256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853244, "uuid": "2268a708-6c5e-4e3a-bb8c-cee406232bc5", "value": "1e33718404ffbe0d91b536c10bf053f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853244, "uuid": "c12ebb49-96f3-46e9-a602-714ca396cd75", "value": "24576:snKMSuJwrKRuC1haYuYanDK1zLMepdfBwWUtXBg+J7+Ie+gQAJLf3Hb:sKMjWrKRuC1tEnfJZ+Ie+gQAJDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659853244, "uuid": "50d87454-1619-40e4-ab43-33d5f8673d98", "value": 1501656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659853244, "uuid": "7d54d661-913e-405e-ab90-53106756658f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659853244, "uuid": "6a2eb178-f767-4b69-8c82-930369f97391", "value": "2ac8d72d59d43e280816dd9ab15a1ad2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafe58e5-1694-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659906329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659906329, "uuid": "b2eb5506-e7fe-4350-8eff-010b9c962a5a", "comment": "Malware payload (Stop)", "value": "65c2b9127bc195373185ad15efa9148a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659906329, "uuid": "d8cc5651-802a-428c-b781-97aff81ee12f", "comment": "Malware payload (Stop)", "value": "de79568aa1aafc72e526bb57ccf999ed9c3b76a24e180d34e22cc0b90c3aec1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659906329, "uuid": "ff401f47-27f3-478f-83e4-6dda2a2c6d97", "comment": "Malware payload (Stop)", "value": "819a278a5b18ace7f51fbb6cd96bcf1b5c91f216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659906329, "uuid": "2dc00ef1-fd91-4b5d-9eca-1fbe7cef4fc7", "comment": "Malware payload (Stop)", "value": "573854fe6800c5822367f2ed8987709c263a7fa3e553dda30470005fe270e92c641ee09e04ba53927e1286e5b83d3001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659906329, "uuid": "a9d4d884-2f42-4573-8d90-b124171e2e66", "value": "T14605F100BB90C036F4B369F4497A839CB52E7E91976465CF63D43AEA57386E0EC3125B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659906329, "uuid": "84e2205b-4817-4de7-90e2-1de660bcd0e8", "value": "1cde00788a660bbb86bc7a2a2dba4e90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659906329, "uuid": "e67207ab-ae07-4320-821e-ca860b50c29a", "value": "12288:TEtKVQLhUHlGSN/N+XEhekJ36T6ZAe+Jw0osf+imwvc+Qpjr4Xru:AaQeHpF+Xb+T+O0oBimn3Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659906329, "uuid": "81910d49-e17f-4199-a968-dc154b5b5ec2", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659906329, "uuid": "e4d02758-4205-4e12-8d85-43bf86b5d2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659906329, "uuid": "efc0dbeb-98a6-4f4a-867d-c70f03c3d33e", "value": "65c2b9127bc195373185ad15efa9148a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be87f0e-163d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1659868830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868830, "uuid": "d054ea11-c5e8-4b58-afb0-58d366f418c4", "comment": "Malware payload (Stop)", "value": "37af2a7bb4d5260efb2b35fe13b0af72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868830, "uuid": "474e364d-1a55-42e5-823d-f99e0bce4389", "comment": "Malware payload (Stop)", "value": "df03446a7935255e535ac0db6e92da530ef948780a213a20dbde2af3703f6254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868830, "uuid": "2222765b-83df-4b21-8b59-73039f53397c", "comment": "Malware payload (Stop)", "value": "5118b49b86539fe4d5fd61818c5f5c0a20ec5bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868830, "uuid": "f945d854-856c-4a92-a284-b5b151e50a10", "comment": "Malware payload (Stop)", "value": "4ab80d8250e4c7fa6aa72d621dacbd3605377de46b11f898a81880125818223237b85167374f4ad7a4c1a0fd2c30a4e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868830, "uuid": "4f471f10-63e3-42fa-8b3e-f04593608461", "value": "T1F8150100A7A0D03CF5F352F4B969C2ADB52A7DA1976050CF12E53AEE96346E1ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868830, "uuid": "f073a351-67f0-43c7-968e-164a8c97b1dc", "value": "b22c20e8ba656ac02c99ce4b36129e8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868830, "uuid": "8c7b61bf-7c50-4f56-95b8-cec4ef7cae6e", "value": "24576:Ig7KryHvAsRxxmuUFsouT8dmzHyriVRP:Ig7HAsROuNzyi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659868830, "uuid": "3f8c9fc7-68ea-49e7-9490-0162b23bb585", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659868830, "uuid": "e32d1075-91cc-4937-a70f-0926efc4f44c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868830, "uuid": "982a3d29-98d1-4fa4-b8a7-4a5a6ba0ac5f", "value": "37af2a7bb4d5260efb2b35fe13b0af72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1eeb0e-162f-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659862845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862845, "uuid": "752fa88d-cce4-40b6-9fff-b6b64bbba67d", "comment": "Malware payload (RedLineStealer)", "value": "2db4b0855df0de3c4a99cfbee3918103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862845, "uuid": "9ee5d58d-c9d3-4791-8f9a-a4afdd76aa60", "comment": "Malware payload (RedLineStealer)", "value": "dfbb89c9a72f98fabf4631f85ee9db669be72994af4d1a5f4e51525c7eca2562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862845, "uuid": "37372c3f-4348-49a1-be55-cc1c1a62c032", "comment": "Malware payload (RedLineStealer)", "value": "f0fb0017d9c37407f3499a1c61696c68202d46ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659862845, "uuid": "01d8e1c4-ed6e-455b-bc26-6090edb81009", "comment": "Malware payload (RedLineStealer)", "value": "1854c6a1897515c69d4aab508f1510434a2acfada8ea00461903387346dddf87be14b22b4a69631ec0459962f505ccb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862845, "uuid": "2e81a262-5f72-4210-8b1f-db822422d7ed", "value": "T1B754F151F2A0CCB1E4E2553094318F725937B863A974458FB7543B2E2DB23C36AB2B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862845, "uuid": "7f5ce2c8-c1ba-4edd-80bd-f4ef7fb1052f", "value": "4607ec67423792fa764c28963d304598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862845, "uuid": "d836bc47-be23-4bd2-be58-95abb431f480", "value": "6144:lYj9Y+hGT+5V3KXDHMfxQ+0k3ltb0wjMuPgggggggTdy:l5eIDHzk3lewjM/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659862845, "uuid": "e082005d-56ff-47fe-a87e-22a439b15156", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659862845, "uuid": "f92de298-2747-4233-9686-170f0f213cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659862845, "uuid": "1f1a16e5-d731-46e3-a4b1-92901198dcd4", "value": "2db4b0855df0de3c4a99cfbee3918103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce42593-15e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659831815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831815, "uuid": "514ea13e-199a-4a9f-8460-14aed7c5faa2", "comment": "Malware payload (Mirai)", "value": "8923f452206a7bf69c227e23b4a82ac5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831815, "uuid": "d2f79a43-afcd-4230-8119-11d68159006b", "comment": "Malware payload (Mirai)", "value": "e2d86dbf1e73556192933656fa9b859c8104d8a03ca8d233d9168599e667fdc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831815, "uuid": "9e94c749-22f4-49d5-ad82-28f230b21500", "comment": "Malware payload (Mirai)", "value": "74b01b10ed5b5d20b80d378fb5bbd35ba52d2486", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659831815, "uuid": "6737757a-b3b4-4dc6-9255-69f68687cbea", "comment": "Malware payload (Mirai)", "value": "deace75a5042b2a7fdc864bd73005dfae2ea51230e5545edcf21a51dbe3d00f6130e903d048962118f52b218b6d2647f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831815, "uuid": "968c389c-a045-4af4-bf97-fae4039831f1", "value": "T10FE2E1925E1D46A0C9F00C76E87E09CDAA357EBC40A331A671585BD8B7931C3B0BD9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831815, "uuid": "060a3331-dd89-4587-85cf-a99ee044b03b", "value": "768:YssDLFclp/jNlh7lpn+imnEDFDwcexI4hR1e/lqq3UIkux:Ccl5jNvloEmxV2ldl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659831815, "uuid": "48a55c33-f209-4115-9e67-6f9bf6494f88", "value": 32860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659831815, "uuid": "6fbd65f5-9fc7-4d0d-9870-77f4c8a3a31a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659831815, "uuid": "b8cb4803-9ebc-46af-bc7e-ecce9daff95a", "value": "yakuza.arm6-20220807-0023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41d6bd8-1651-11ed-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1659877649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877649, "uuid": "80c4914b-a260-4685-81d5-03e67557a425", "comment": "Malware payload (MassLogger)", "value": "288bc9e780343a1abd6e997fc9f82ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877649, "uuid": "85712a87-2ab8-44f6-8885-3232473a2939", "comment": "Malware payload (MassLogger)", "value": "e4605db46828c62387d3877418064db4d3f27dcdef4f05ec5d8b8261dd23bf81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877649, "uuid": "30b5fa81-a62e-478a-9e22-93babe104a98", "comment": "Malware payload (MassLogger)", "value": "c06bb982ca42e04a461475ec84520fa80476e8ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877649, "uuid": "cc5e95ce-e36b-424e-979a-ef66b1a767d0", "comment": "Malware payload (MassLogger)", "value": "a4a033ab142fbff89ad901a0702ea415041ce426c58066633af64172c8d498e8584eecbebf3c9dabb6110dce92dfb84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877649, "uuid": "0bdd8332-493c-4ea0-8e4d-a7865db816be", "value": "T1C2C3281D3BFC8900E6FF8A7215B18112CBB5B912095ADD1D1AC1F4592A7D680DE2BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877649, "uuid": "3272e200-3243-412e-8fa1-4abb7c5ede08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877649, "uuid": "c7bf2fda-7465-452c-a21b-672be7b59326", "value": "1536:5mtcOks6s+macPiaE3HH0ssCYD4b53xW8TRpiOWBHQF0Kcl:5mtcXlsAcPiaE3HUsrbFxtDwBHQFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877649, "uuid": "111c2dc0-e362-4df9-9a74-ce7cd929b2c8", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877649, "uuid": "dcb96583-9b2a-45b2-9ca7-1f0a686aa1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877649, "uuid": "52ecdeee-bef9-46de-b2be-56e14e50c134", "value": "288bc9e780343a1abd6e997fc9f82ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba72843b-1679-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659894759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894759, "uuid": "47c94ec6-667b-4b44-954b-f4c413b75696", "comment": "Malware payload (Mirai)", "value": "54f861fee7e687aea68d228f8a38ab03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894759, "uuid": "9cc84ddf-65f0-4c47-8039-357aa7d2bd44", "comment": "Malware payload (Mirai)", "value": "e5abfdd8cc2b4e780f935df7f5adb04398545a5af2a1ffb5452ab12411c3081d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894759, "uuid": "a63d063e-9117-46c4-b376-61c97d48e08b", "comment": "Malware payload (Mirai)", "value": "e30bb3df0ac3cbbabb3994ba10cb4d482562b314", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894759, "uuid": "17e78791-d0f7-4ba2-ab6b-79f04126d71c", "comment": "Malware payload (Mirai)", "value": "fec39e22719a56f137a2670f6d9c90305dfc7e5ef27464dc383546d5f29ecb7bd6c35ecfe90782e4818a91f7e5a4f334", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894759, "uuid": "edb1d27b-a8b2-4b16-aa85-334dc111f375", "value": "T16CF3316AA7B26EBBD80DCD3302D54902104C969963DA6F6FF6B4C608F78BD4E44D3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894759, "uuid": "ea669bf3-1a82-49b9-93fa-423319ff99f1", "value": "1536:VKiwzwO4c5hZjeTrm8kNnrtZL6Xfpn9XIFNX:V1q4cVeTrmbttx6Xfx94f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659894759, "uuid": "39379ca5-0689-415e-a516-b044b76955b0", "value": 160354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659894759, "uuid": "0cf5b91d-392d-4a47-a418-27358b846ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894759, "uuid": "ffba717e-41e5-4b7b-b753-7a5a495dfe4a", "value": "54f861fee7e687aea68d228f8a38ab03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ecb347-1651-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659877650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877650, "uuid": "3e6a0008-b2c9-469c-a0fa-64532acb8c78", "comment": "Malware payload", "value": "10f2c9a68e3be43e575985e9e23b101a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877650, "uuid": "aa389d4b-0925-451e-8e23-e4fa95beee05", "comment": "Malware payload", "value": "e7c6cdcc9272e7b06d684c2b8ec38938376ec102eb133850b96efb228103b58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877650, "uuid": "d836b76c-2c35-405a-a131-3638e3aedc92", "comment": "Malware payload", "value": "3b0894f2c0d37f53b4b8fc091a2114edd089813f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659877650, "uuid": "3dbb6636-d720-4b49-a6e8-707cb5a4ec06", "comment": "Malware payload", "value": "705b317ec162801cae96d931fea987e222f2f95e2b6a80f2f2aefed76395725b46478dc3e1215d25cb33283c27b371ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877650, "uuid": "2fcbe59f-dfa4-4634-9fce-dfa5d8d539c6", "value": "T1EE056E2291C7D2F1F3F724B197D002BF5D289127C68A9D35F8252548A3861D6BC3DBEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877650, "uuid": "debf40d1-fc88-46d0-a0e5-c74fad53b9c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877650, "uuid": "0768ab12-c082-491c-8126-cbb2d0d7a386", "value": "768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659877650, "uuid": "53885295-69bb-4187-900c-257de90a4391", "value": 797393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659877650, "uuid": "8fd6ff7f-4d7a-400d-9351-a783663bfdeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659877650, "uuid": "bcfe22b4-1134-4974-8ba2-60dcb9c0d0ec", "value": "10f2c9a68e3be43e575985e9e23b101a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6f987b-1680-11ed-93bb-42010a9c0043", "comment": "Malware payload (BlackNET)", "timestamp": 1659897638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897638, "uuid": "f41cf2db-1201-4cd9-820b-81e151fc9546", "comment": "Malware payload (BlackNET)", "value": "64ba40f46bf4387da34a31a1f40bfa18", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897638, "uuid": "dc812924-686d-4327-92ec-d028ffea947b", "comment": "Malware payload (BlackNET)", "value": "e8436116cfac3fe6038f0f2578f79851777feb02a2150bb65d5bed2bc1770e45", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897638, "uuid": "cda7f7f3-4954-4024-8efe-8fe7180b28e0", "comment": "Malware payload (BlackNET)", "value": "f9ee774cef7be606b0b7089cfb73617f48f7d550", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659897638, "uuid": "bbab83fe-36c2-47ed-b6f5-45af2badfe8e", "comment": "Malware payload (BlackNET)", "value": "954c184dfbc096dce11fda206edd9b7d3553c8056750102a585f8331e547a4ae5500b4f5de35f1787377753b6f620a58", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897638, "uuid": "f9ce8417-7d89-4ef6-9b88-b8c1e2c8b1c9", "value": "T1C766F937F18D0D32CA14E0B65419462629DEAE0E827EF3AD9E2FF0614D68ED5074973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897638, "uuid": "e6bb835d-2174-42ea-a297-32a20f7a0b0c", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897638, "uuid": "f50c8086-ce0c-4a8f-98e3-b8cbe18feab9", "value": "49152:elfQKzUOLxMQg3Q3cX5C/wnvdAlPjcmYeuc8gFdbkLUtJd4Bg1S1CqtYRidsYs+s:el5uLA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659897638, "uuid": "88d95591-fe01-426e-8a71-3812b66c8487", "value": 6781952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659897638, "uuid": "30dd4f2d-2a34-49af-80dc-a54da8d5e717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659897638, "uuid": "bf07c7e2-28e7-4654-b948-01849a0bf15b", "value": "64ba40f46bf4387da34a31a1f40bfa18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d76bb1e-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659911648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911648, "uuid": "eebe9350-407a-480f-b246-ee823cab0bfe", "comment": "Malware payload (Mirai)", "value": "a5ba8660f2d1aaca8d0ed31ca1996603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911648, "uuid": "243f25de-6523-48df-98e1-399db7f03205", "comment": "Malware payload (Mirai)", "value": "ecd2fc6359f2c904189ea1359074188c1b0402159a89f0310e6cdeac1ba36021", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911648, "uuid": "96f3195f-a573-4178-94a8-c822ab5b817c", "comment": "Malware payload (Mirai)", "value": "e415a4f9bb969412286ab463872c6850167b11ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911648, "uuid": "44fd9a94-a890-4af2-bd5a-c2cf196f37ff", "comment": "Malware payload (Mirai)", "value": "45982930c058f4f562b0d8f93d1fcc6df30bbb0b96d388bd6a8997ff3e3a3eacebb88fcf10e54c2262c41d647f08f26c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911648, "uuid": "32f73905-aa6d-445f-ad88-4810ce837cd6", "value": "T1AD533952B9C19752C1E415B7FE0E018C376613FCD2EE72028E25DB21339796A0FFAA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911648, "uuid": "cd7038e3-578d-4bfc-aa05-177cfce39025", "value": "1536:saVf/B2dvPFA+JU/P84CKGrvOzUV4A4LTFJDhJxt4IdhCUQvxfZ:sad/B2dvPFA+JUn8flrvQST+FJDhJT4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911648, "uuid": "4fe6fff5-7ab9-41af-b11c-05ad314ba5a0", "value": 62964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911648, "uuid": "2385c655-d30b-44ad-acff-1a7662275cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911648, "uuid": "eb53b4d7-ef83-459c-97f9-ba9711daaa81", "value": "a5ba8660f2d1aaca8d0ed31ca1996603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91e1eaa-1663-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1659885335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885335, "uuid": "b0ba98c2-a1a2-4677-9a67-344e6523110c", "comment": "Malware payload (RedLineStealer)", "value": "57656bbf436ff75e09dbbc73847778db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885335, "uuid": "21167cbe-c7fe-4b30-884d-a9cc2220faa2", "comment": "Malware payload (RedLineStealer)", "value": "ed1c6db34f4cca9112dbf97264e4c3a906846abbe6dbbae98bfaf074bdc2b74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885335, "uuid": "0dc85751-35af-43cb-91c5-cce5f46b38de", "comment": "Malware payload (RedLineStealer)", "value": "367c72744187307c5cf8784fff0f00d51b57bbe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659885335, "uuid": "a3b206c1-27e4-4ba0-a7aa-848859f5b227", "comment": "Malware payload (RedLineStealer)", "value": "ff13c9c1f588d4893bf1619a948779fcd61777ab1bb525cde0d583b51f7526fd31b209f15eaa827d732e72925f36cc79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885335, "uuid": "acd34ed7-18bb-4adc-b7fe-95bdd3ff78af", "value": "T179344E9D36A072DFC967C576CEA81C64EB6074BB930B9203A15311EDAE0D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885335, "uuid": "0e641a61-5833-4a18-bd1f-24f25b6e7c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885335, "uuid": "9d28bad4-27b1-4050-8109-7da8bdb1d6a4", "value": "6144:s0B7fOHi8HDyvqJmqZ6Ayx7TAZX1w0h8PopHzEJK0a7mXQEuq:s0BqDjyv+mqZ6Ayx7TAZX1w0h8PopHza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659885335, "uuid": "b9ed7de8-7ff7-4566-a2ea-771b4744136b", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659885335, "uuid": "65519f24-f8ee-4ee5-ba1c-4fcf55893958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659885335, "uuid": "f5f453c3-5b4e-4e29-9583-87e0d7bf3024", "value": "57656bbf436ff75e09dbbc73847778db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b29684-15ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659842403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842403, "uuid": "32e84d97-5e70-4169-96f9-23a77dd8dda6", "comment": "Malware payload (Mirai)", "value": "259afd03fece7137d501906fde8e599c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842403, "uuid": "d4eb5855-3e10-4ee6-b616-35458ea5867e", "comment": "Malware payload (Mirai)", "value": "eef10e98efe6f9865dd0e1e0de366d1ccc2078ed9e03ef90bc6fe7e6624b1c0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842403, "uuid": "7bb2b3d4-d48d-425c-a291-cba450f200b9", "comment": "Malware payload (Mirai)", "value": "4f0a3834ea292086f87c7a08e1f93816e4261dc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659842403, "uuid": "a7f14dd1-2d51-484e-9d99-12e37506ed22", "comment": "Malware payload (Mirai)", "value": "e5a0b2ecfaa13e285f989908adf92234ea9b2bc935f0bd0865e044572b876d702ef88032dd334956672389e2eda1519d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842403, "uuid": "16a7b93d-0fe5-4538-855d-3ce5319d60de", "value": "T102830A95BC818A11C5D813BAF92E018E332267E8E3DF72139D205F6477CA92B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842403, "uuid": "b433f0dd-946e-4aae-8fa8-96f198605699", "value": "1536:aUn3Ps9mSxnPyPLY19i8GCUILzMNG6G1DWEOw6y5rpZ5xRhhecKhIriZqPzGG6sf:e9ND9vjUILzsFG9Wmbh1gqPzGG6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659842403, "uuid": "24a10752-2527-41a6-a1cd-ce410fe7c95b", "value": 87452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659842403, "uuid": "4ccb38ee-229f-44e8-90bd-93d4ea752147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659842403, "uuid": "2ff4dd66-a5ac-4165-a18e-360564c0a483", "value": "259afd03fece7137d501906fde8e599c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73df08a-163c-11ed-93bb-42010a9c0043", "comment": "Malware payload (BARAT)", "timestamp": 1659868635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868635, "uuid": "50f30936-87ec-4719-9612-f8a7960d9887", "comment": "Malware payload (BARAT)", "value": "6d94b156bd7fc19c1c95c12a0e0ce637", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BARAT", "colour": "#909F9D", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868635, "uuid": "0ef9049d-0bdc-445a-a73b-db07ec621e02", "comment": "Malware payload (BARAT)", "value": "ef614d4739c1f94f8df5e662b843c01622e2e75d79f6df158afde0c32a5a4825", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BARAT", "colour": "#909F9D", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868635, "uuid": "796b60bd-52fc-4c87-b26d-83184e870135", "comment": "Malware payload (BARAT)", "value": "658a5b38b89c1f55b9d40557fdc1bd6dcc45a405", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BARAT", "colour": "#909F9D", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659868635, "uuid": "b7a3b48a-2bde-4ea9-b687-e072c8168453", "comment": "Malware payload (BARAT)", "value": "2b6bf87c35034aea51309869ab9261f66173e290cbafd57dd384ff855cc084c22bc4201478a2e309108fc5d5dea7773e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BARAT", "colour": "#909F9D", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868635, "uuid": "60555945-b328-4fa9-a709-c239907cf28b", "value": "T169F5332BF5A38224DB57E038C1F0B0A5F2DC279D9618FF172AD5758A89E2D44BD02E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868635, "uuid": "66043da1-cae1-4566-aa9c-3f928587d6ba", "value": "98304:IEVF6aL7fDW3v0AMYfccA1d+CsqBGnrBzeUw9UWosWziCg:I46x3vKcA3UnlzhwW6Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659868635, "uuid": "afbbaa09-5597-43c8-abce-80750a364967", "value": 3423266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659868635, "uuid": "4f7dc8e6-ba23-4d47-905b-348549dfe3ef", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659868635, "uuid": "e05b9510-0567-42ce-8079-bfa35a761e95", "value": "lives (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b2e812-1668-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659887211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887211, "uuid": "28d28757-da95-4076-86d8-a12c92d8ee1e", "comment": "Malware payload", "value": "bc7ccbfdf2c357a1266d89bc134ae8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887211, "uuid": "f094effd-6544-455d-a6bc-c84a4c6512bf", "comment": "Malware payload", "value": "f4fd0f6c9754b08bc1e63a122c51e9c5dda2e4f7fbf55713923d4af861d2066d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887211, "uuid": "0ae42692-2eb0-46c6-8756-47e1218b695d", "comment": "Malware payload", "value": "87cf402f8317490b773676c2d78db968ff304c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659887211, "uuid": "47c2a573-c0dc-4d02-aa96-5e1cf2c65dff", "comment": "Malware payload", "value": "295b405ee634518299367d2d68b4b446d7b50fb1c44ac34f8105e7c1e460c3bb9d7ac206c4dfab0b66d26934410953b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887211, "uuid": "c7527e8c-e6d6-4a09-9b26-7c9ed5a98713", "value": "T1008523B4365CD15FE803893A9DAFE9BBCE8E2875627486D384667339111ECB3C8CD464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887211, "uuid": "573e8a10-e3bb-4d67-8cfc-d38ce663d6ad", "value": "a8edba105869c8b0330adec370df50cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887211, "uuid": "d60b72e7-e45d-4e4e-926e-e55ee533ff68", "value": "49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659887211, "uuid": "ee45cc7a-d096-4d2d-ab58-42dcf538d159", "value": 1857665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659887211, "uuid": "2e8921f9-a249-4f6a-b7cb-ffa60e9d14ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659887211, "uuid": "475497e3-40bc-4744-9cdb-a39061245abe", "value": "SecuriteInfo.com.Variant.Barys.242088.20956.31547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ab57ae-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659911657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911657, "uuid": "349155c1-cf54-4160-9911-28952cc81ed5", "comment": "Malware payload", "value": "339f49b7576bd070cf1448704d76a944", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911657, "uuid": "85fee26a-edc1-4732-b93b-4719342c7f04", "comment": "Malware payload", "value": "f50eb10f86afb4d33fb98dde7fdc2576d5a105b59280cc1e998cb8d5f3f45b6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911657, "uuid": "3a353b98-a21d-4302-bb45-5c5dcf679c22", "comment": "Malware payload", "value": "1c8039427a9d0382c64456571bc59a6d415f6738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911657, "uuid": "d96349a9-bb34-4075-918b-09100d101754", "comment": "Malware payload", "value": "119e9c44293fbb90098af79bab57f3beef2eaab02601718d55f5e18c01c90790d7ae1e5f465ac44b8b692dc63fa681bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911657, "uuid": "6ecede5f-47c1-4201-97c8-7e5fc546426a", "value": "T108C3405B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911657, "uuid": "14e2b004-7e9e-4ac3-9fe3-8d074198ebb9", "value": "3072:QISPhPh28cVCSFdCve0uPgrUiyeVKfj/GPIBWhFb1lqQl:QIyhPh28cVlhPgrUnas/GPIBWhFb1ltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911657, "uuid": "f992652f-ed37-4e4f-8f6e-d6071fc66a12", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911657, "uuid": "526cf8f7-3f14-4533-9445-f25e0fd5ce20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911657, "uuid": "ed5a2865-a859-42c2-b780-5f6478143305", "value": "339f49b7576bd070cf1448704d76a944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5e6578-168c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659902785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902785, "uuid": "9a318151-1d13-4660-bbc7-300d545bc761", "comment": "Malware payload", "value": "8618a8fde035ea884650f6f4079b9bfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902785, "uuid": "697629f3-7741-4d61-ae98-a9c1b7ffd6da", "comment": "Malware payload", "value": "f6c5b5f5a014480eefdd4962fd77d5ccfd1e679da3cfbb639be72a21b1b315ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902785, "uuid": "4b5caa3d-e6c1-42c6-91a6-89c6a3974e79", "comment": "Malware payload", "value": "7df0e1c74d628eecd8b1cccd0f0bc4d5a37ce0dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659902785, "uuid": "211b0c92-5e19-4336-995e-9fa59b53a242", "comment": "Malware payload", "value": "9dc780c4580152752f3f9430a7e0c422f7ffb2f688122d2014e612ed2d42673a8ab3638aabb275bffa29a8872613579b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902785, "uuid": "a9ef1177-29d9-47a2-a210-0e1c8dc77903", "value": "T19504961B7761AEB7E81ECE3302991611108CAD8A12EE3FBF7665E618E75E50F50D3C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902785, "uuid": "35ec745e-9ee7-4c19-b0b2-5b849304ef95", "value": "3072:osjIKgEvIpA6VpGbHW8SrldQnq2Z4c2bO:osjtwp/oJSrldQnq2Z4c2bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659902785, "uuid": "85714784-5809-4db8-98e3-36b441d62476", "value": 174505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659902785, "uuid": "7697d59a-e71a-4b95-af34-67febb3758e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659902785, "uuid": "481d2861-6b71-48b6-9643-d2c58ff5c06f", "value": "8618a8fde035ea884650f6f4079b9bfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292a1bc5-16a1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1659911695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911695, "uuid": "7ae1abfd-e981-4ebb-acae-69221290ea06", "comment": "Malware payload", "value": "87bd9591db36a562e40c5b3dd7e09fcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911695, "uuid": "6c26ace5-e10c-45fd-a122-85fb9556741b", "comment": "Malware payload", "value": "fa5905ec4c31efac975ec00cdb49b17c218e1284a8300a410a493f2b7f2f8ade", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911695, "uuid": "a0e3a179-3beb-460a-88ff-2362263211e5", "comment": "Malware payload", "value": "caf7c9a4c349f757944784d5fdb8ae2f687af253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659911695, "uuid": "2c528dc9-7745-48bd-bea0-24cef54deedc", "comment": "Malware payload", "value": "5f66d56390bac5347af0a2af02f2570f96cfa1422d744dd88cd6da8b66f40f22aab2069f1bdca9cab177a20a8d0ccfab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911695, "uuid": "1a7b9ea2-fc71-41e9-ad09-a0cbed65969e", "value": "T129C32086BFA03FBFD81ECD324198CA0612DC4A5953A4AF7B5E74D404B69B14E5AD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911695, "uuid": "814eca8b-831f-4854-af2a-d7da470a9c4c", "value": "768:GNNT1Nc12cVJ4vTYAc02GeJy3B2LGFvahPur8zhkbDrjeQ6BN8YJq6J9yx9Ly7YW:GJ2GrBcubDr6HBN8DCoyEElqXyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659911695, "uuid": "09a37ec4-ea43-4003-b20a-1d02e59e110c", "value": 120016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659911695, "uuid": "6c36a569-db0f-428e-9483-ee4a8653f2b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659911695, "uuid": "ecd80266-60a9-4584-9448-9d5da6eedc55", "value": "87bd9591db36a562e40c5b3dd7e09fcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fdffe5-1652-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1659878004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878004, "uuid": "659cc8e5-7174-4668-a214-0d5504fa4c72", "comment": "Malware payload (ArkeiStealer)", "value": "87391734385a668a149a696a03fc97f9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878004, "uuid": "37ad8f0e-ef1e-4479-b87d-49f681ca71af", "comment": "Malware payload (ArkeiStealer)", "value": "fc883ad07e9e3c4b03b62bde4bee510678149dc7afbee9027d71d556243a03c7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878004, "uuid": "7aafba30-4259-4ade-a9c6-89db35952d40", "comment": "Malware payload (ArkeiStealer)", "value": "5fadee3b0daada72a038aa9482f06689d7d54c58", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659878004, "uuid": "120476d1-e3b1-4dd7-90b1-9a88c6e704e4", "comment": "Malware payload (ArkeiStealer)", "value": "13ebe6559b03539ca796b4e3f1873fd95a9927218204d936399a89059d69b132216a1a2303f2c2daa8af24470c8dbdef", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878004, "uuid": "ac4a0360-4826-4d6e-9517-404968113c87", "value": "T1D3649D00B690C435F5B312F49AB683A8B53D7EE1AB6450CF22D56AEE57346E1EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878004, "uuid": "0f50a4f5-705a-4ae9-a809-87b55bd320db", "value": "c69f2bf46d64c24653b01cc6fcf4d6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878004, "uuid": "737231ce-cabf-4dc5-94a0-8d2a046e4938", "value": "6144:Kl2kQTyqKMoLtFuxuWjrJTP+wlpRKl2czunxcDwvEdJ+:I2peMoLXiuWj1TPNRKMKuUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659878004, "uuid": "56f24c20-d5bf-43dc-9e80-a01c5b25c5c9", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659878004, "uuid": "2e1399f3-2de6-466c-85c7-7b01d3aebc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659878004, "uuid": "fcf978cd-b531-4595-8757-0c6f736db6bc", "value": "87391734385a668a149a696a03fc97f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ad5d9d-165b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659881762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881762, "uuid": "149bfc7b-3baf-43c1-b996-bd18b849c778", "comment": "Malware payload (Mirai)", "value": "5d7d2618e09ea3c84f5a484553e0ea65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881762, "uuid": "708623b5-6da9-443b-aac0-8d2f159012da", "comment": "Malware payload (Mirai)", "value": "ff09cf7dfd1dc1466815d4df098065510eec504099ebb02b830309067031fe04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881762, "uuid": "b26238a8-93c1-46fe-a98c-e1cf6c498fdb", "comment": "Malware payload (Mirai)", "value": "679010f52909c909bde9aa34645c5ac0044df453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659881762, "uuid": "cea02593-1b30-4ff2-a8bb-5cb893209749", "comment": "Malware payload (Mirai)", "value": "8ca7e01bb5de00bedbfea90c46892f257ec7736b2273835b89c0b24a10e158796ea20ba8cbdcf0f82b4a7112bb1334a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881762, "uuid": "db9e1f78-1d94-4c0d-8af5-2ec832cb0ce0", "value": "T10F831680F5DEC4F0CC52ADB5006EB756CBB67C2E853C9A2AE7F5BA508DD3901E0A510E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881762, "uuid": "ff74e304-a35f-4fbe-a151-f99d9cecc95d", "value": "1536:2lhh73pICEbtL/CsNIZvvIR/12sEkmGrZhVBbX14oZp/OZDjS/B73UcF0:Khh73pILte06vvIR/1dEpshjbX1FZpyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659881762, "uuid": "e366a5b7-5585-446b-93d7-8cb01baa197e", "value": 85424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659881762, "uuid": "4910bfc0-49e8-424f-9762-c35b18e6fa22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659881762, "uuid": "21804444-8161-47e2-8d4b-ffef34e6cf3a", "value": "ff09cf7dfd1dc1466815d4df098065510eec504099ebb02b830309067031fe04.elf.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be00de47-1679-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1659894765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894765, "uuid": "49773f62-79f5-4e41-a8ce-871e35c95343", "comment": "Malware payload (Mirai)", "value": "daf86f5e8eddc44cfa20ec1c47727763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894765, "uuid": "1076a9cd-9995-4eba-9b62-bb38cabc2397", "comment": "Malware payload (Mirai)", "value": "ff2a28be253d06504c86373b0b3bd4acdae7ba576ec66852bf2b689a1337cb8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894765, "uuid": "afb3e9ae-803c-4adf-9059-3a85cd98154e", "comment": "Malware payload (Mirai)", "value": "b15a9bacbf5a62c7541d24ed59de01bb37036a3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1659894765, "uuid": "bc808dd4-ca68-4fbd-a7d9-46765825793b", "comment": "Malware payload (Mirai)", "value": "948ef29ebec948ef5a42caeb77f930c8e55a4f7b81dc3df759b173576002a15df7b2f3b058b76951554d3a8acdfde19c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894765, "uuid": "733e0b17-3e25-44ef-8ddc-ea75ba201600", "value": "T16143F746F9409A57C5C456B7BB0F038D332A936CD1EF72439D255FA527CB92A0E3B081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894765, "uuid": "6d0e1e74-e276-4268-9b97-a6e23ea8b2de", "value": "1536:NTfLQH6Ij0OozeBemvQDMfDHLZfiHzFOehEmRvKn:ZLWYYvQDMJ6TFOehEmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1659894765, "uuid": "866fdfac-439c-47e8-a373-8a624b03046b", "value": 56484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1659894765, "uuid": "a4160766-1dfb-476d-9c31-f8e45efc174e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1659894765, "uuid": "d8799871-729b-475e-8bc6-5e94357ff9ca", "value": "daf86f5e8eddc44cfa20ec1c47727763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }