{ "Event": { "published": true, "date": "2024-01-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-01", "timestamp": 1704153781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6109fadb-0d66-4d86-a033-9ec0be82e634", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98655a8-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121807, "uuid": "6f1bafe8-21e5-4fdc-a05c-4cfec9abdd83", "comment": "Malware payload (Mirai)", "value": "72173f51e76c6ce800c496800c117394", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121807, "uuid": "f3188f67-8c30-4b59-915a-d9ba2cbc3ab4", "comment": "Malware payload (Mirai)", "value": "00f0abcfcc0c4b64f259fffba3c99a0e56d612e0ff6bc048ffd41ccf8f2ccba1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121807, "uuid": "47d6aad2-bc17-4515-8e7b-93650165bea6", "comment": "Malware payload (Mirai)", "value": "72b7380f0e26383cc8d545d56d47f3ee6c60e174", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121807, "uuid": "715fe964-4b52-4502-a235-3029227328d7", "comment": "Malware payload (Mirai)", "value": "3085c094a71b285a86e24e7aecb07005183df2dfeb1912085fb0a2a89d0b7d9de295dfba574657d0122363c2612413fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121807, "uuid": "eae9876a-896e-4f50-b390-b4ef5234d2a1", "value": "T1C514D71AAF510FBBDCAFDD3706E90B0239CC655722A43B363674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121807, "uuid": "85d8d702-7230-409b-a89a-81e18577df50", "value": "1536:Fc90OhJ5V+hfifahv0Yb3RfIhnGZHofILBWp4ZWZcpeLMGzfECnOh98eHkVOSIlR:Fc90OhJifFtVIgLMp40LzvnFVXIKwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121807, "uuid": "ba166159-fb24-47f6-894f-9ae9fe6344d7", "value": 194864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121807, "uuid": "e0bd3ca4-afd5-4b1c-9b15-42547bc726f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121807, "uuid": "f4e362a9-fd08-4d3f-a178-277ecc307c5d", "value": "skyljne.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7814c42c-a8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704118637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118637, "uuid": "a5a2dded-6c9d-491a-a926-831b41228eb5", "comment": "Malware payload (Mirai)", "value": "36914a04314e5ebaac967e209c906438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118637, "uuid": "bff39d88-5be2-4adb-a62b-2ec6226a25cb", "comment": "Malware payload (Mirai)", "value": "0115d9aec427447d63e245cad0099c19f11f9d6cb49ab675eef9388bdd33a997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118637, "uuid": "d3f8e9bc-39c8-44a9-95b9-5206e5e6888b", "comment": "Malware payload (Mirai)", "value": "91042ec78d8d64c6875e4cd7821c6dae3c629f68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118637, "uuid": "466d18dd-b18c-48cc-84c3-52b3766478ec", "comment": "Malware payload (Mirai)", "value": "317f6df8b034672a01b2aa743c9e8fa3e903d23cdd64e0a7b40b92ecb2ab377bfcb7b0fa48425412a24a16c80268f616", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118637, "uuid": "2a8e200e-586e-4c63-a89a-fe373717171e", "value": "T130C2D0E07726FD31C420AC3DE53A4D8A3A51167C91FF353664258C398FC1A9B67A48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118637, "uuid": "7acadafb-52aa-4edf-b565-92aac01d27e9", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrb9q3UELuF:OKy4qfqoeJdXWg6LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704118637, "uuid": "848de734-467d-4735-bda9-903fdaea521c", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704118637, "uuid": "811a5369-55ff-4fc4-b0e7-d25165fa602e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118637, "uuid": "0665c483-4722-470a-a591-c7b5ed2993eb", "value": "36914a04314e5ebaac967e209c906438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e70dba-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140107, "uuid": "96c6272f-4427-42c9-b23e-903c7c5b143f", "comment": "Malware payload", "value": "a6ddab1384219de604b0e0a264cabcd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140107, "uuid": "a85e8595-3335-4d0f-a036-c3ca6fa6cff3", "comment": "Malware payload", "value": "049dbfebc95c1a295989816a9b35d6defaabcc3e41c5e7b6bd77aaa10f8b3c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140107, "uuid": "86cd5fea-1026-46fa-8555-490b1cf51c11", "comment": "Malware payload", "value": "2710519a1108c4cfc03043eb5d92b71c7ed31d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140107, "uuid": "b555a632-f5b2-417d-9470-6dae8f834475", "comment": "Malware payload", "value": "0b1b841a3d1b1660c937fc06dfbbadf8b84a72870ab73cd072bcb05824b89bcea9d0f832cb11f42ff8b9abcaa214da47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140107, "uuid": "be982b40-7a87-49df-aac1-afffc4849bbc", "value": "T162946B11B794D072C2A235304B57E7756AA9BA709F3487C37BD03B7D2E702D19A38B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140107, "uuid": "08af50b2-239d-4c4a-80a3-df5e73b3df78", "value": "cc2f1a584b5a0215054665f28f086a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140107, "uuid": "56f44bb6-468c-4971-8d15-24c62b71a216", "value": "12288:uZoQSj9Ymdz1UOnau9Av0KMtJyMo2bFQBEP:5zlnau9/JyMo2xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140107, "uuid": "0216b285-6001-4a7b-ab2b-32fef8abdfa7", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140107, "uuid": "2b2be664-512e-4b03-b6fa-5e3742d53453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140107, "uuid": "12b35067-c717-4ada-9cde-0347443cfd83", "value": "SecuriteInfo.com.Trojan.Shelma.2691.7206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b21daa9-a8a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113408, "uuid": "ae6f8b02-4467-4898-88f9-a007b0ec95d7", "comment": "Malware payload (Mirai)", "value": "671a5ae582f7a0f3419639c8dd3d4234", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113408, "uuid": "f43665c1-78af-4d69-98a3-45536306808b", "comment": "Malware payload (Mirai)", "value": "0594bda00da8aa0d9cc1662a17100e3bf87a4fe8ca04cdc690bfee243732392e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113408, "uuid": "3ef10c7c-4413-47d8-b92b-01facbed0906", "comment": "Malware payload (Mirai)", "value": "ac32022c699b436e6ae62478c844ef5824d1cf08", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113408, "uuid": "bfc2efb5-e527-4333-8008-f9fe65688999", "comment": "Malware payload (Mirai)", "value": "ca90ddbf432d0ea9c4a815f9fa0588c107cfc895809e537c857938fb403857953192cba7c787c10611aeed8ac376c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113408, "uuid": "5f03f7aa-6d0a-4fd6-b4ac-c5ff04c2fc09", "value": "T1BC733B81BC818A27C6D552BBFA5E42CC372623E8D2DF7203DD15AF157B8682B0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113408, "uuid": "a31756dc-e337-489d-9c53-f4216633d7b7", "value": "1536:vDhGXItFMR+Ygw2IQC1IswOOHgifZL9EWRRlvYbqCRp/:NGXIA4RCCswOOTLKWZYuc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113408, "uuid": "5e1b7dbd-4ad8-42c7-9e20-d461857dfc45", "value": 79148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113408, "uuid": "cd46a510-d33c-470b-b4b0-d214035c858a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113408, "uuid": "77c9f257-a2c3-4105-a991-e57e688def5a", "value": "arm-20240101-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e19eb4-a85a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704081618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081618, "uuid": "e3eaf6eb-39d5-46bc-ae94-af5f892860d1", "comment": "Malware payload", "value": "b6bbdd51556f752b034a1a74f54808e2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081618, "uuid": "ff00c5f3-88cb-4d98-a9f0-a13aad290aeb", "comment": "Malware payload", "value": "05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081618, "uuid": "b4ec8a76-f4a7-4d0b-a5e7-71e58982a6d3", "comment": "Malware payload", "value": "5d300ea856c27974dbd7b58401141c303b1db608", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081618, "uuid": "d72bbda5-6d8a-495b-800e-69789806370f", "comment": "Malware payload", "value": "239aa01576d1f7e42de763a2365d8523bd72eaf3b8c3023176263a329a6bfc0d6626c3561fb70d1e8a0286d447f834dc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081618, "uuid": "a5eb56e4-bdbd-4565-9fa2-0031689fb593", "value": "T165F3175672D00484DBF141B6C47FCFB1EA3078F25B12A3DB1B6462BB2A3A5859F2D394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081618, "uuid": "b92cc5d1-665c-46f0-8986-89f51d75ff1b", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081618, "uuid": "e2e42885-69ca-4d3f-85e9-98e44596c8ab", "value": "3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704081618, "uuid": "03e08031-9a93-4d9b-bd8b-4f905724769e", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704081618, "uuid": "1b33a6f3-8479-40b4-8b5f-2bbf0dccbf05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081618, "uuid": "76c3f75e-4cec-4b95-9555-379acb2afb69", "value": "b6bbdd51556f752b034a1a74f54808e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759db86a-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140108, "uuid": "0a7b7a83-dc30-4e09-a700-9bb907851639", "comment": "Malware payload", "value": "ea54d9d0d9676a2c19058abe2aef487a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140108, "uuid": "a68f9339-c475-42ea-8a27-053be8964c63", "comment": "Malware payload", "value": "078252271f503938516b9fa95e20456414befdea22e6a5bdba7e2443574bb6e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140108, "uuid": "95e644d8-e494-4fd5-bf5f-6a6fedf8e3cd", "comment": "Malware payload", "value": "5450786a03edf830a1c5bbbd6f258d9674221ac7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140108, "uuid": "04b808b5-5534-462f-9d53-29475979d8e9", "comment": "Malware payload", "value": "5767172161e86fc8fbe5efb2d1f34526c96355f6763e23eeb8c1b4e8022c9e08cca239f02370de22df581608480fedf4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140108, "uuid": "2f36bc3e-815a-464f-af1f-c99dec550027", "value": "T15A2519C2F66EE180D8AEC53CD4661CB77AE67F2D8894849E7749353D3AB2B420437907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140108, "uuid": "726f47a3-465e-4896-8d19-214975710316", "value": "5cf156b6d4a82cb33488885091bc5f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140108, "uuid": "66038128-4181-4f9a-94de-196f25a752d2", "value": "12288:jYPWEIDEnDvbITCKWmp82XUbITCKWmp822:jYP56EDvbITT7EbITT72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140108, "uuid": "7fb39244-0bb0-4ec0-9468-914abfbed735", "value": 1044178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140108, "uuid": "5be6a11d-abc4-4e08-956f-e8b7c67569eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140108, "uuid": "d2a4bcc9-0dac-44bd-9b27-72923d0ec0cb", "value": "SecuriteInfo.com.W32.VMProtBad.A.tr.31151.28210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ded973-a8a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704112830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112830, "uuid": "45675d61-c87d-4541-a8c2-6b8bf236e034", "comment": "Malware payload (Mirai)", "value": "16bc8781ac8d7c77bf42d6fca70cdabd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112830, "uuid": "d47981de-067e-4ebb-8b6c-d1b6b11d40b2", "comment": "Malware payload (Mirai)", "value": "0c74df96275e10b5b679705bcefc2f9d38f42fe5210f3bf9745e33bf505ad000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112830, "uuid": "47f10f8a-a897-4582-abcf-793f74241f5d", "comment": "Malware payload (Mirai)", "value": "e519ef24d2297634c76e35476bcf237c061e634c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112830, "uuid": "fa99b39a-c7a1-45a6-b2e5-58d4e0fce923", "comment": "Malware payload (Mirai)", "value": "a3f6b89b31b9ca651e03d6ce4325e1f80d1691d10233e89c656e029424586e046b8bf7ebf44c8f5e0429b4d9e21d9e0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112830, "uuid": "2a25ed19-4d60-45de-be8e-3dc3107df38f", "value": "T11A733D81FC819A13C6D1227AFB2E428D772653A8D3EF72139D259F20778686B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112830, "uuid": "53c37b44-c54e-45fc-b325-5148246e7b21", "value": "1536:KDfSao5LfQAfsLCLbQ3sbX4SHzX340xDHo1Bp4nhAJG2939h3m:kfSJvkhkX4EzH40xDHo1DjJH/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704112830, "uuid": "5fe2cb03-5c8a-43cb-a1b1-c59bf34b1145", "value": 75120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704112830, "uuid": "65b0ab3f-4864-44c8-bccc-59a48864ae3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112830, "uuid": "4e810458-3e91-4874-ba11-adfacd96bd74", "value": "16bc8781ac8d7c77bf42d6fca70cdabd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fd6c33-a85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704081945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081945, "uuid": "e7616b17-3b19-4773-b0f8-8de3188ec683", "comment": "Malware payload", "value": "be3082ad76a2e42146e15841b0a8701c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081945, "uuid": "6acf9276-f6aa-4edb-a644-8341dfdcbbce", "comment": "Malware payload", "value": "0eb49cae715e2f31551ea4afa64045540ed77ab891ba1864660b74af64a16971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081945, "uuid": "c2141fc5-9171-4c6a-943c-0c06bac7fd59", "comment": "Malware payload", "value": "32f128de805d6805c45191bbbd8e12c855f91f5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081945, "uuid": "d673055a-c76a-4c92-b7cf-26933fb678e5", "comment": "Malware payload", "value": "6b93b9b47c96e0b9070065862bc3b25abfb9df245b2353dc378ee3e6df70643eb44e88f46f8b95f39d7dc3a18f957fa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081945, "uuid": "5dc5ea54-4aed-4094-bdc4-f6c7ec27e3ce", "value": "T1C865336CF2E8FD8EE01906F089625531ED6AED24B93769A60324B5F50EB2574333C74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081945, "uuid": "818f5eea-d81a-45fb-8ffb-a96997252878", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081945, "uuid": "b3c69ee3-5a27-4d90-ad79-7c9bacb74c13", "value": "24576:XGljQk33d4AGvxnetyb0pxyTh8ynFNCJRkjFdOdqj1xCjBTXaUbydn8yePX78E4/:yl+AM9Y+PhxaJ2jTj1Mj5Rydn8E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704081945, "uuid": "387bef01-5306-4ff1-83e8-40ced3ed5b16", "value": 1536460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704081945, "uuid": "15115f8b-9ab2-4723-bd19-182f36e5be8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081945, "uuid": "180116f3-6684-4700-838e-fa6da56ccfea", "value": "be3082ad76a2e42146e15841b0a8701c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83c62c9-a89b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704109806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109806, "uuid": "ae615623-33f2-4580-925d-9052485571e6", "comment": "Malware payload (Mirai)", "value": "3a0fc12c5f8efdbfe79996aee1692d0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109806, "uuid": "84b02360-d983-41eb-aced-908dd4aef01a", "comment": "Malware payload (Mirai)", "value": "151b49633b1bd166fc66335ae4d489bab682360a22c0e0fc0e6491855c324a59", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109806, "uuid": "0176554e-2d0f-4698-a964-05495615fb90", "comment": "Malware payload (Mirai)", "value": "2aa358dd3d4d71b89aeacea182458d1f4e1f65db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109806, "uuid": "92106914-fce8-4aaf-90af-2142a52d5729", "comment": "Malware payload (Mirai)", "value": "6c6c908ca20a3b182529a127141e3b62bc83c215e28fb8987b04277390e41615bde9f99d99c5d465a787f9084f317787", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109806, "uuid": "c91481a5-7ca0-49f9-9fd2-5027c8d49196", "value": "T108534BC6EA43D4F1EC5709B01077E7338A32F9390179EB57C765DA36AC92A01E61B26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109806, "uuid": "ac8846ce-2042-4779-8717-21a252112187", "value": "1536:ctXOYJDFUsswTKxpKUeNMaa6y5zdvO6kSpnEq:AXbJpU1wTkde9av9dhEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704109806, "uuid": "5e7e11cd-1afc-4ba0-96bc-f1e5d511ade8", "value": 66704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704109806, "uuid": "9f446cfd-71ae-43bf-a3c3-2c71128de984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109806, "uuid": "55659810-7a78-49a1-999e-e89e0ed9d2a2", "value": "telx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dda911-a891-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1704105428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105428, "uuid": "278ac8cd-e62d-488d-a5a0-57faf1ee962f", "comment": "Malware payload (Rhadamanthys)", "value": "b4a982f6ca165f0d91bde7dd17239ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105428, "uuid": "965f92d7-5db0-4731-a429-9e7a81f5a7b8", "comment": "Malware payload (Rhadamanthys)", "value": "15c7ce1bc55549efc86dea74a90f42fb4665fe15b14f760037897c772159a5b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105428, "uuid": "04e5120c-bb15-4cd4-88b2-1bf63fce4e8d", "comment": "Malware payload (Rhadamanthys)", "value": "0c7eb15acdeeb472c94f38a879548d01ca68db1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105428, "uuid": "e63206bc-4e73-47b5-9c4c-b5cef838300c", "comment": "Malware payload (Rhadamanthys)", "value": "3c83ce86e937c86e05bfe09ce0335f53e426af0267dfbbe4371e96b91c6e11e67a44e93d371cdda7029bba2d8bd35dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105428, "uuid": "a8237b40-6802-49a8-869b-eb8ae4082438", "value": "T17E059D5122538DB5F127D533B07F62108FCDA92D4A854BE793CD887AE3A2581C41FFAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105428, "uuid": "587289cc-fefc-45c4-8535-bd5f7086e22b", "value": "e752126f7ead8b7c9b1a7360355346dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105428, "uuid": "226f3c82-525a-454b-8d1b-6d449f361cd5", "value": "24576:l76Fbh+BdZHyuXfW5+YgGHvMurli2U9L80V:l76FbhIdkuXfW5+PKvMupilu0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704105428, "uuid": "52e3cee7-9536-46c8-8278-5082718197dc", "value": 801137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704105428, "uuid": "efe3cfd1-d12c-4b30-8551-f1c196583541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105428, "uuid": "f472a968-6cda-40ac-9340-b9792463ed6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e535e12-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140096, "uuid": "1cc5a19a-b392-4b1b-a94a-3cfef673325d", "comment": "Malware payload", "value": "b7b0c0c4f051776c4b2b145e21a4a643", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140096, "uuid": "dd8de3a2-939d-4105-ab4a-11e9308f685c", "comment": "Malware payload", "value": "1a44d692a3fb7e739b023883b213f6d84ab72fb0ddb9dc62d928edcc25acdaba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140096, "uuid": "c7a4f228-10bb-47d6-9fe6-82de705c87e8", "comment": "Malware payload", "value": "4f614e9e87bea159a220ffda69609177b4f0a2e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140096, "uuid": "d1c14eee-d88e-4d4b-8449-239078bf57aa", "comment": "Malware payload", "value": "5a88bc391c8fa3d52d7099568a08dc36136d411fe9bf736406fbd3fbfac65af12c5cd02c730dc129077a58e1b3f19a18", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140096, "uuid": "a578b6b8-3321-4308-b8da-3c94b4846a88", "value": "T17C445B5DBDF1D8A3C82C1D3218B277E49971FC2B7C3E8E4B2766270D687A6005D9A871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140096, "uuid": "6491a40e-ee01-41ec-9611-6fcb4a787144", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140096, "uuid": "0a85df57-7add-457b-861a-9552b4539765", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjgGqpa/Y9JXbmVCoDX/EYJNaPgHQ8l5/:+RR5rhZFQGrsUwF7vlPoSk1stNaPgHx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140096, "uuid": "cb752cec-b5c9-48d6-9a80-cc3b53dfc1fc", "value": 275866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140096, "uuid": "6b13e954-60bb-403b-aa04-898be1082092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140096, "uuid": "39b933bb-5e99-4897-9e8d-c526c2f4c21a", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.28734.17977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed860ab-a85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704081953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081953, "uuid": "90887e6d-cef3-4d7c-956c-d9c9a1d41553", "comment": "Malware payload", "value": "8c1279098d87e19ccc488a4b04a77e45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081953, "uuid": "2acdc382-6ff7-4331-8b86-0ddfe6b198a9", "comment": "Malware payload", "value": "1f0c96d7ee0d9664c0085394604a9137abc292a52c871f4bc3b5245627961573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081953, "uuid": "6b90e7db-fd5b-43dd-af0c-f97fd9bf4363", "comment": "Malware payload", "value": "554654184695c2718ed1b4012bc9296996e24aae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081953, "uuid": "7ba3b847-cb02-4070-bf7a-b8c75224f003", "comment": "Malware payload", "value": "34ca6e88723f9d14e77c2df5f0b074ce222f4a1cb7203b8954527399f0d4a6110243f49c91f5be673594d04050d66f65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081953, "uuid": "b129845e-69da-4cb0-89f2-2b87f773a92e", "value": "T11165336CF6E8FE8BD05901F18A665632EC5FED24A53658E51234BAF509F25B0323C34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081953, "uuid": "2f223370-615b-4f37-8f76-e7c749f29aa5", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081953, "uuid": "7ea7c062-beca-424f-bffd-ec8746e233dd", "value": "24576:XMljQk33d4AGvpblCh8ynFNCJRkjFdOdqj1xCjBTXaUbydn8yePX78ESo:0l+AM9lChxaJ2jTj1Mj5Rydn8Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704081953, "uuid": "1f30624c-0a15-4254-a151-5276a699940e", "value": 1536702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704081953, "uuid": "fb14b29f-2e4e-4938-878e-3793e97caf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081953, "uuid": "94bf461c-e1e7-468f-8396-177766018e02", "value": "8c1279098d87e19ccc488a4b04a77e45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6169c65-a886-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704100729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100729, "uuid": "6a1b02cb-dc32-4a09-9c50-810874740ae8", "comment": "Malware payload (AgentTesla)", "value": "668e1b4df3690797f45e3fa3018e6461", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100729, "uuid": "adf1d708-bca0-49d7-9479-8c4ad3856726", "comment": "Malware payload (AgentTesla)", "value": "2139944dcc75ffd2ae23cf50fb751ebec4dffb7774764e8b4d48808f0925aedd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100729, "uuid": "e0488a12-f655-47de-bc98-ca149611363b", "comment": "Malware payload (AgentTesla)", "value": "394ea1b76befb440e22ef9656ca170cdab59b6d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100729, "uuid": "bcf115c4-74de-4da9-9c71-9c1b279e511d", "comment": "Malware payload (AgentTesla)", "value": "b31ab771b50a2ef30a3078e3eb2e714134d8684e908e30f1e92e884cace56757d7db43ea1262b874e1dacec451cec1ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100729, "uuid": "50b190c8-ddf3-43fb-b769-ff9b5c1be982", "value": "T159D41226232CDFAFC27D4EB955A0A26203B0466B3522D7DD4FC174EA252BF804919FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100729, "uuid": "cc463c9d-86e2-43b0-a345-7941868709d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100729, "uuid": "9753ffa6-6bdc-4e81-9ac9-9266e8ca2d7f", "value": "12288:1hkqtaT70iTsF9A81P1e3KwgFcFg1yGEbfYOkshhKwCH1:HtXimj19ahpuyGEYxAKwCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704100729, "uuid": "f03633b2-8bcc-4a21-be68-f39c37a36ea4", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704100729, "uuid": "22b935ff-6901-4773-acb4-f416627c1ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100729, "uuid": "befffa90-493c-440d-9c14-c6eacfd7c37c", "value": "SecuriteInfo.com.Win32.PWSX-gen.28032.25470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22f3b94-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131190, "uuid": "f5066619-6d64-46c7-9cbb-8b4945989fb5", "comment": "Malware payload", "value": "730185f3de5715116eaf3a54ee817354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131190, "uuid": "d77d99a8-8ae8-45e5-9452-ae4df5d31a2a", "comment": "Malware payload", "value": "21f0def099c99108487904a4198180d65de4d64de7eac95d12972d14ff1df95f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131190, "uuid": "38495ef5-1c65-4f86-ad23-25d6094940a8", "comment": "Malware payload", "value": "186822ce4c3716c8bb8616e3d984b9f963ce300b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131190, "uuid": "33f21d55-a08a-484a-9d1b-c476e03e3047", "comment": "Malware payload", "value": "317e769d904756614d7758db1326e1213e6ba88f85d284df89232db2d2e64fe144935a17f71e93c87ce0a99d52f32689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131190, "uuid": "12754020-2db4-48fa-b965-ac50be014339", "value": "T1D2D302C5DCD18CBECE87E6358A3CA949C0A1D9EC0102E7B766DC7AB36438103575EE16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131190, "uuid": "08ef31d2-b779-4a09-b0c8-8ee9a4357d6c", "value": "4393c0ff32774f18bbbb429d5c472c22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131190, "uuid": "8391ccc6-25fe-418e-be99-9538db4d2274", "value": "3072:MjpXOElqEFuTGZWZmOBA9YfrUWJifxi5puvNfUQl4Y:M3lBuKZWZnBfIKifMvel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131190, "uuid": "724f961d-d8f8-48e6-bc2c-8f841de3aece", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131190, "uuid": "420a5e28-20fe-4a81-8db7-71e492c32eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131190, "uuid": "9411b045-403c-4b0e-bf6a-04fd9638b86a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ff6d2a-a8f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704149984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149984, "uuid": "a97a1a92-5215-4bb2-bd86-dfcc3b728646", "comment": "Malware payload (Mirai)", "value": "2afc9ae9d9603bbf620992c09c1331b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149984, "uuid": "4aaa1b84-e9cb-4674-a2a9-1f03abe7e1e4", "comment": "Malware payload (Mirai)", "value": "256aac8f53ba7a5f04d646c933a6653aa3da5fd5449020580d41b2406dbe0cef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149984, "uuid": "11ce4bd9-e613-4ee2-821f-38fc80b5ab49", "comment": "Malware payload (Mirai)", "value": "129520ef5d4191480f20e120232eb6e6f8991822", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149984, "uuid": "4d5263ab-5845-4ed7-adaa-00ee5f85baed", "comment": "Malware payload (Mirai)", "value": "48b610bdfeb75186598c6132d66f77c36bef7421a6eafe1a21ce9c2f83beb46be299a52cef032e6110ef5dc507dcd1d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704149984, "uuid": "dbd21fa3-7c72-4c31-8894-cef648a47a17", "value": "T13DD3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704149984, "uuid": "95763441-45e8-4389-a725-07fa2932a580", "value": "3072:gHZ+X7AoyxFOV48wlP1z0RraPuk8d+Ow9L3sibH:gHZcA1AV48MP1zuQ9LsiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704149984, "uuid": "60fd8dee-c344-4b20-9938-e0b51349cbb1", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704149984, "uuid": "13b95c2a-cd14-4d4e-bc7c-a47f55a91ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704149984, "uuid": "e6a10e0e-127a-4039-b95b-a66f9a83b5fc", "value": "2afc9ae9d9603bbf620992c09c1331b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1b5ac3-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121815, "uuid": "b39f7c20-72f7-415d-a765-f4812547afd2", "comment": "Malware payload (Mirai)", "value": "dd18ae15a4476e485e3fd14869df1b07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121815, "uuid": "c17ca844-260f-48b3-9c0e-51c3e0a3d96b", "comment": "Malware payload (Mirai)", "value": "263b14beac8972ffcb8a07cb8515127101420721770253ba3b1e137b3dbbcbd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121815, "uuid": "e274f5f9-07dc-4ff6-acec-5e87df40cbbd", "comment": "Malware payload (Mirai)", "value": "0419ad2bd5066fbda640efe168334047b034ac2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121815, "uuid": "a81a3456-2785-4aa4-8a8d-bfdf40de19ab", "comment": "Malware payload (Mirai)", "value": "100c75d597fa717a396f2f76dd3af21caf27a7329e5cde148f380b26c7b380e0b87da792a36a1a280f3d26b23255ea9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121815, "uuid": "34ab40bd-0197-4d43-b0f0-e89e751b9580", "value": "T1E3142B46EA404B13C0D727B5FADF42453333AB9497EB73069528ABB43F8679E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121815, "uuid": "c1f6c9be-c9b5-44e0-ac37-b0f7e3e8beb7", "value": "6144:/iEfIyW8AcPaw6TWATqJBpgygxFM/RDkT:/iEfBAcPaw6TWATs4xO/uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121815, "uuid": "191f5b7f-8cde-4c0c-92bb-0613994fe7ea", "value": 198293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121815, "uuid": "df852356-9715-42ef-8c1c-9a9a257111b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121815, "uuid": "c7f2c857-b863-4c59-9ade-8590cb5f686c", "value": "skyljne.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddebb846-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131264, "uuid": "249a1457-8d80-4415-a510-976756617ee2", "comment": "Malware payload", "value": "66d88cc554f5d86b0a9dc7c6871d15a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131264, "uuid": "471a3676-b871-4d4a-99f1-3e967ab2a942", "comment": "Malware payload", "value": "28959e7e51065d5f870bd023962d48829b51cdfa044b1bd822651dbe2e9f4f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131264, "uuid": "0ee1e334-6f55-45c8-b963-6b1813d27788", "comment": "Malware payload", "value": "785328312a4d7fdf44b769ba037d8afb95c51f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131264, "uuid": "fe7a5371-1fed-4bee-bb2c-6954f43ed401", "comment": "Malware payload", "value": "7a05160b229c0295e163dce23f4a55dce3b310e642421f236ed3b6ca6d717354b1cb0e60ce91a2de2e2760ef70aa9878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131264, "uuid": "a2c584a9-a04b-44cc-8ccb-9933f1784fb0", "value": "T19CE533227BC4E831D970693A89B5D764953CFE30473258EF23596C2E8B306D1A6267F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131264, "uuid": "c33c1fcb-938f-43bb-98f9-1730fb02dcc1", "value": "4dfb85da1495e891078e48fc182e3cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131264, "uuid": "b78fc10a-f6f6-4b03-8c3c-f3c1b51c162c", "value": "49152:CvxfXTfqndtev53rVlqNpRMmA6KyxaXJCnH9hA+04OkpoyPbOXJiOTOYJC7WOG07:CvxjAK3rHmHLxaZCE4uyPC5iqtJV0Mc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131264, "uuid": "347a84a4-0a8d-43af-8ffa-7a4a86b7d02a", "value": 3209465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131264, "uuid": "8fa51ae1-48bd-4144-83a1-9c7aa40dff62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131264, "uuid": "1598c0c9-c7c0-46cf-8502-2cf7e784f9b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1e6878-a8a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704114005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704114005, "uuid": "cccc7c1d-719a-4abd-8cd3-70d8db5a988e", "comment": "Malware payload (AsyncRAT)", "value": "b2ecde6a292eea40a78dd52304c9f5b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704114005, "uuid": "d6cdd6a6-718c-4722-8f28-327e00abf6f6", "comment": "Malware payload (AsyncRAT)", "value": "2a95cf92c2a17056166d5e1572462daa83a48ba278b5429098b54f3f077853d2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704114005, "uuid": "42b1282d-05ae-4ec4-963b-c4e4c9cf9213", "comment": "Malware payload (AsyncRAT)", "value": "2957898117f0f8fefd4405aa417b7e8bcf5beea3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704114005, "uuid": "1949bfb1-54e4-4768-bae1-9b3c6e811691", "comment": "Malware payload (AsyncRAT)", "value": "aa11c2d146e8e3f4e946da29be91909aa5593a608875f539aa8f873ee35e40d647fa4e2ec452cdcd8ab48d26432dcf63", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704114005, "uuid": "6c635ea7-a2d5-483a-8b02-30333567f3c7", "value": "T1A3232B003BE8826BF2BE4F78ACF26145867AF1B72603D5492CC451D75713BC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704114005, "uuid": "833dcd24-069d-4b64-95f3-9742595fd966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704114005, "uuid": "f4b1b3cb-058f-48fb-a4b2-e178b2e778a2", "value": "768:NuPfZTg4pYiWUU9jjmo2qrm87ohEamPIvNjb6gX3iAXHvzMvEIRCr77BDZOx:NuPfZTgKa284EaPvFbtXSAXPzOC9dOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704114005, "uuid": "28f6ef46-d0fd-45a1-8160-203f7440605c", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704114005, "uuid": "2133faa9-bc51-4d3b-b071-4086d7a39611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704114005, "uuid": "f15d3bf7-be64-4884-b6cb-5232af6e9f7c", "value": "b2ecde6a292eea40a78dd52304c9f5b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ffbfd8-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131197, "uuid": "0b77d68a-03cc-438f-ab5c-fb8f056f3957", "comment": "Malware payload", "value": "6c81e39fd156891a6e8bbf3d8355e54b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131197, "uuid": "7751a215-aff4-45e7-adab-dcf119fe4209", "comment": "Malware payload", "value": "2b3fbb77e5ed29f7ffbcb9a73cc1e467aed6447fcaf28a47d50f78c81fa17eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131197, "uuid": "4e4e2fe9-bf4e-4398-9d8c-0aace3e0c93f", "comment": "Malware payload", "value": "3dba98dfcb96bed3f63e8d7524458127d1f8e877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131197, "uuid": "50ceddb1-35bf-4629-a479-d0660c105959", "comment": "Malware payload", "value": "ff0004843916d9fdb37913516e1011a8be31efe655a17bfaf9d3e0d1dc6b02b656cc39f7e52eebe029582e2e07bd1f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131197, "uuid": "d1aa8344-ad2f-4370-8b5b-d134a526b738", "value": "T113E423CEA4FE56B0D00390F59B3D4D004927A8A2B65C47D93BD4B15F9EB6889EB0C937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131197, "uuid": "92a204df-0831-46dc-acaa-aedadce7333b", "value": "26b8d976d96d16995492f63ab9fc0efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131197, "uuid": "a119e99d-035f-428c-b92d-6ab5de6354ca", "value": "12288:cjY/CBAkfIulEPWZmmdtpTkUtBYDxnnz5/ikp3tW9zgOX4sRqG1sqAQO1:F/C6kXNlS5KkqBnqGqqAQO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131197, "uuid": "8086a0ca-9e65-4c99-bed8-b82306d85123", "value": 694496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131197, "uuid": "5f2c71cc-6ed6-43f5-b997-530ba0193b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131197, "uuid": "d3cf4952-ce2b-41ee-a08b-4ca06b213415", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50e36a2-a8a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113156, "uuid": "b84043b3-02b9-4d30-b198-99b95eafea0d", "comment": "Malware payload (Mirai)", "value": "4bf0d743a4d3512bc6f3e5effacecf3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113156, "uuid": "7b4872e9-9289-4522-b958-9c426abdbc43", "comment": "Malware payload (Mirai)", "value": "2f00687dfc5c318afa2addc9fcbf2c428dced80741aeea07c2123cfc2f615d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113156, "uuid": "3745d9ac-9384-434f-aa36-10b4dd3d2243", "comment": "Malware payload (Mirai)", "value": "1929ed3ca4df1ece79071c79b6215ecd4eacdf82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113156, "uuid": "441562af-66d3-4a3e-ad6e-80533d76eb5d", "comment": "Malware payload (Mirai)", "value": "ae90aa3652bb17c7428c3be3af0e5369b2f67e018bf631a4e7e5162f9bc3173b4023addf4338e486dbefb4d4d77b548e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113156, "uuid": "c4bd9c31-227b-41b4-b6b8-ae065503c3dd", "value": "T1DE835C22BA761D2BC4D4687A61F30325F2F6478A24BCCA1B7D620D8EBF65A4031537F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113156, "uuid": "e92c7625-3def-400e-ad5e-88fe16cd4bc9", "value": "1536:AfjG7QyQBdlhmKBenkkEs0CitITYk5W2g9Sftgfzl:AfjNEVi6TYURerl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113156, "uuid": "fb6558d4-74f4-4fc3-8eba-2c221e1f130c", "value": 83320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113156, "uuid": "aa97efa0-4bc8-496f-a0bc-4c16a738446c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113156, "uuid": "6de7af6f-8d5a-4bb9-bbac-4708e6ed91e5", "value": "4bf0d743a4d3512bc6f3e5effacecf3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74825bf-a860-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704084464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704084464, "uuid": "1c2f1896-03a7-4154-aa76-898152ccaee3", "comment": "Malware payload", "value": "8fa7ca9c88c8a2bc2bceb42cc823cc2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704084464, "uuid": "e099d503-d35e-4bd0-8140-050f0b8373f7", "comment": "Malware payload", "value": "2f3ec648cb08ab1fde919b2be508999ef3eb501c6ccfae6d6c210a5a89a010b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704084464, "uuid": "7654e225-7804-42dd-bf9a-7c910f0806c2", "comment": "Malware payload", "value": "f53df6942debd02f25a271c1d0a85899f2cad962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704084464, "uuid": "3d8cc80e-a7fd-4967-8a22-42ca5802a48a", "comment": "Malware payload", "value": "360a24564caca03065aad29adb38ee33b1ff5556869769602fbbd50b44832182ebac4df05bd5771f32f7132d819b859a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704084464, "uuid": "1582bda7-d45c-403e-8ff3-61527b1cee1c", "value": "T12A533A15E1D347B0D6E6E3746204D56ECC4D97CF484D6BA02690CEBAFD231E3E62067A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704084464, "uuid": "cb9c1510-2662-4d28-ad4d-5f564fcc3e84", "value": "1536:1hisJB6l83ltp9shZ5dYnHM3ErxrHHPiaOpi1DaH:1p1t8X5PUr5PkcJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704084464, "uuid": "2a174cca-955a-4817-a6a9-c48a9fcaef28", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704084464, "uuid": "d8099276-f2b3-4f49-b03b-47da97ca2ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704084464, "uuid": "9d683c5f-39fc-49e7-98c5-68065d1d7d98", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2892.30446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ab876b-a8a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113191, "uuid": "418b066f-1936-462b-87a2-34a9aee1f483", "comment": "Malware payload (Mirai)", "value": "509ba28a0e6847ea79bd83f07f6598bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113191, "uuid": "194ac9ce-d05d-481a-bdfb-5dedcdfddd83", "comment": "Malware payload (Mirai)", "value": "2f4e68f4e0f1908da771b2467c8b2c6bf02c21b7aa5dd91bad8d1f4cb5024c48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113191, "uuid": "1fe63c8d-3255-4b97-b437-bd0387410300", "comment": "Malware payload (Mirai)", "value": "207aae83cfaefdff9d24867d9fc7e204610fcb21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113191, "uuid": "72fddfd1-2e8a-4aeb-b1b4-a0e9399006d4", "comment": "Malware payload (Mirai)", "value": "4c3bd9ba9ec4b4af25f1927aa8db39b9bc47048924e3e8830e287d93001ef4377a3d9b1092a8b6396d4087b1331ae646", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113191, "uuid": "179881e5-8d0e-4f59-b581-24a996b9e7c1", "value": "T1FFA3D74AFF510FBBDC6FCD3706A9170135CC590B22A97B3A3574D928B64B64B0AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113191, "uuid": "f42f5f04-0367-4b9c-82b5-76e833a4d752", "value": "1536:kQ/4KjVU3jiHMWhwn5o7OLGvf5DfSUFtZMWVchf5i5x2Ovia3bgUd:kQd+jX0pfSUt6MURaLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113191, "uuid": "308d1896-27bd-4e8f-b066-1c767488b2be", "value": 101284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113191, "uuid": "2b0d49a2-974e-4b65-a752-c86254de1762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113191, "uuid": "4c1c4f99-d4b6-4a71-9a8f-084b47cbcd52", "value": "509ba28a0e6847ea79bd83f07f6598bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c646d5f-a8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704118644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118644, "uuid": "7b7793f0-c7ac-4334-b780-e29c75b89ae3", "comment": "Malware payload (Mirai)", "value": "37a928b1cf26b4b9aefd881befd376c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118644, "uuid": "ce4cc7b3-fc2c-4130-9bd6-3d02057b7fb6", "comment": "Malware payload (Mirai)", "value": "313abb0639fff4cb358915a766755edc2815bc91e028bc8c94b1809549590f09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118644, "uuid": "2b07f64d-1909-458f-a7c5-978ea0c9a3f5", "comment": "Malware payload (Mirai)", "value": "306e86f3d31b68a2855c51f449605d37be8d64a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118644, "uuid": "3f756309-7f63-4511-b485-15f90287c543", "comment": "Malware payload (Mirai)", "value": "6980e585cf8fb0fe9c4e965fb3fc45a0ee9f4f919b48afa43f14fb0898dbce92544908b6c4644dd560625579a4951829", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118644, "uuid": "d9bd0842-6999-4b41-94ed-66da07eb7e35", "value": "T167A2D025E345AEF4DFAFAD9052C1C2C27BE943C7278AC8E240FEAF016506046B789D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118644, "uuid": "3128705b-5d83-4699-8ee5-280899cd9244", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5dNM4uVcqgw05VxJP:mRxsSVsMD6xiJJE5zRWNK4uVcqgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704118644, "uuid": "4fc4a21c-f9fe-4693-9571-59be6dd464ea", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704118644, "uuid": "a751b3f7-fb2a-4d4c-8831-68d3d1ce92c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118644, "uuid": "1ad04326-9cf6-43ff-bdde-d691aea3eedf", "value": "37a928b1cf26b4b9aefd881befd376c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93949c16-a8d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704135004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135004, "uuid": "7f71f608-769f-4fdd-a33d-7823cee8f569", "comment": "Malware payload (Mirai)", "value": "2ea478acc6f7245ef14b9cd59b37d664", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135004, "uuid": "ffff79df-4d94-4a6d-9912-2b5e364edd66", "comment": "Malware payload (Mirai)", "value": "31c5ffca4eb495f9f3673e1a3a2a6373e872d6b825de70012794330f12190abf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135004, "uuid": "3d1b015c-ac65-4306-88f4-2c1398cba342", "comment": "Malware payload (Mirai)", "value": "930731b7f6cae6293751a4a66713f6e46c1a0874", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135004, "uuid": "24b8af0f-142c-4b52-afc0-b1aca2f7e123", "comment": "Malware payload (Mirai)", "value": "957bf73700f4560f3bdbc4f7f280f16f87c05c05758c998763aeb9853e3b614e545e6806e4c4ec2e3c2e4d194a9e69c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135004, "uuid": "7aafc74a-dbcf-4a8d-81b6-e2975c1eec6a", "value": "T12CE2E1EA4B068B19DEC8B6B3D94C24750C72BA2327BDDFB12C752879553B5E401B8960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135004, "uuid": "62495bac-aa9e-4c02-a36d-0c684d80f210", "value": "768:2q3ydi2rg98FdmvPyQw7NAFkcEfUhpJJLpIhyCN5Ur/K4:xiFdmvPgA2cEfUhxLpIhgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704135004, "uuid": "b88754b3-65fb-4da7-b8a4-e0cc56018b7b", "value": 31320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704135004, "uuid": "4fc19474-79e2-4b3e-a9bc-0b31fbe5718c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135004, "uuid": "e0cd535b-4d8e-4fcd-b113-c16b08607283", "value": "h0r0zx00x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7510bfbe-a892-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AndroRAT)", "timestamp": 1704105747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105747, "uuid": "116ff1b2-8a22-4ce6-982d-a94f45b627aa", "comment": "Malware payload (AndroRAT)", "value": "36f79f6999010c2da60e1c98427f1968", "object_relation": "md5", "Tag": [ { "name": "androrat", "colour": "#5CDFBA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105747, "uuid": "cd380be8-7014-46a7-8b0e-7a55c43ee78a", "comment": "Malware payload (AndroRAT)", "value": "347f1b018f643de0b9c946c94bd490a7426503869a0828b0a70b4d318fa097d6", "object_relation": "sha256", "Tag": [ { "name": "androrat", "colour": "#5CDFBA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105747, "uuid": "d48a6fc4-81de-44f2-949a-1fc265afb953", "comment": "Malware payload (AndroRAT)", "value": "928e2d5e8478e79f44511b73f3d385dd67786d4a", "object_relation": "sha1", "Tag": [ { "name": "androrat", "colour": "#5CDFBA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704105747, "uuid": "925548ec-4e23-40e8-993c-85cff64cda58", "comment": "Malware payload (AndroRAT)", "value": "32ae7224a2707c47b7bc2abe5a9ea403feaeda5548fbc7d7496d2a9ecb59692d3e3dc4700c825a2c36df6f38fd2ce9fb", "object_relation": "sha3-384", "Tag": [ { "name": "androrat", "colour": "#5CDFBA", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105747, "uuid": "d7550a65-9434-4503-9021-840fb4281f4f", "value": "T145B5F148B7C4EC1FCCBB94328BB5866751494D8B8746E3038A26769C5D77EC09E86FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105747, "uuid": "e24f2499-d5f2-4a53-99ff-51b5ab2a4ea0", "value": "49152:iYRr5Yg+gvYUz0kYD4GfH6pTZxAovMLe30bq1:F6gsUbYD4Gf6pFio0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704105747, "uuid": "67688043-a0ab-4f26-9347-da52c7c2b13f", "value": 2332330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704105747, "uuid": "05a06f8c-79bd-492f-9281-4ced26938938", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704105747, "uuid": "9fe43268-f2b0-44e2-bef5-5c56f1a8528f", "value": "system.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56543a4-a85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704082260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082260, "uuid": "ba332b7e-716d-429e-a702-ca255a24efbf", "comment": "Malware payload", "value": "b19b78b10092d1ac185bc35faf8c6efd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082260, "uuid": "3e476066-0729-4bf3-a31b-b58b4fe13f7a", "comment": "Malware payload", "value": "36b82f3db4e4b1da53252cf0f99ecfab17a09b29783e7c9881f48fe5da6645be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082260, "uuid": "1a0a2bbe-d89f-43d0-a429-94bf110a275a", "comment": "Malware payload", "value": "34e1ab44835c41e7f17b6729bbd008b6c3e9afe5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082260, "uuid": "422f6a86-bff8-4071-9736-658084f74264", "comment": "Malware payload", "value": "633e4b1f53b96f39cdd0315bc133dffcb5c2996588324e144705e3d89e3f71d0cb837ef34bd09aa1a3f44711c69c7cc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082260, "uuid": "c7a81028-7790-42ea-9602-b6955daa4f6f", "value": "T19885333846EA6C09F0514578AD305325E89ADD1CA11EEFE68164BFF942B39ED332E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082260, "uuid": "fa03f5ec-9e77-4024-aa98-48d090fad02b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082260, "uuid": "73cae5ff-3518-4711-b1a1-ed76209b9ccc", "value": "49152:pl+AMVeJGC3hwJZ7a07xznKMj5RyX2sqq3BB:pIAMV+Ga+xznKMj58Z53BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704082260, "uuid": "b00250d6-ade7-4f46-96d7-6150fe3ed339", "value": 1748225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704082260, "uuid": "c91d7476-7dcc-4bf3-980c-7ec380d019be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082260, "uuid": "96688ff2-ed22-4fcf-a7cd-d19e1fa789d1", "value": "b19b78b10092d1ac185bc35faf8c6efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c61c24-a886-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704100730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100730, "uuid": "e6f63ab4-ed14-4a91-bb8e-061f34e125e5", "comment": "Malware payload (AgentTesla)", "value": "31518cd336b921c14aa5f6a70a58d140", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100730, "uuid": "737f6189-a3c0-4bdd-b93f-97e4cbfb1ecc", "comment": "Malware payload (AgentTesla)", "value": "36e763233ca3ff441f5ce71a59ec7b108f6329d27406b378758f6437a0f049c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100730, "uuid": "eb0c453e-e5d0-434a-b8a0-c18e41f4184a", "comment": "Malware payload (AgentTesla)", "value": "b6e15c68cc125660fff2e8613639b46430e254c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704100730, "uuid": "722067ad-ede1-4a21-bd1a-b3050d59f59c", "comment": "Malware payload (AgentTesla)", "value": "baca0e41c80b299a276b24ea5a2825d7faeee0f828cf08c2962ea681cab1bb2f6ea225bcf3c4b47a81febe93b882e08c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100730, "uuid": "54b283d4-369a-40db-9df0-470e03bb6297", "value": "T110D41269336CDB2AD21D07F4B198065143B241EB7963CBADCF94A0DB3D6BF4046196E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100730, "uuid": "9ec19ae6-d5ca-4031-bda7-de371eb14435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100730, "uuid": "29f005ad-8909-4291-8393-7db89e7bf3a7", "value": "12288:shkqF9T7fyahGQRo3hsJHNd9RPaCUHaogxp8XkGhWu6dxSJDvh5l9:+F9VGQ0sndvP7UHdeEkaV6d4JDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704100730, "uuid": "0d051ab9-9ec1-444a-bbbb-5aa0b200cf4c", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704100730, "uuid": "97fedb4d-dffe-4865-b557-43c9d8783f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704100730, "uuid": "cfe00472-d91c-42b7-8f95-71bed4398626", "value": "SecuriteInfo.com.Win32.PWSX-gen.1998.4962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04f2e65-a87d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704096908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704096908, "uuid": "2025774b-02f6-41e0-8ccb-586f18390667", "comment": "Malware payload (RedLineStealer)", "value": "a5f9699e55f4eeb48b5835733c95a96c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704096908, "uuid": "2a8fa7d2-e72a-414a-9871-0999e4576f65", "comment": "Malware payload (RedLineStealer)", "value": "3c085e47cb3925ab9a73a6f3e03b2cfe255f4b782e6916bee3eeae20af21ca20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704096908, "uuid": "83ad1041-53a9-4cf4-bb12-c62f52b6caa1", "comment": "Malware payload (RedLineStealer)", "value": "8844f9e41e8e580ff23d01d25dabeb338daacccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704096908, "uuid": "aeb8fbbd-48c9-4946-85d5-64f81faa3aeb", "comment": "Malware payload (RedLineStealer)", "value": "ee5a9c319c643bd130e3507f70084cb8f7ca19ddd56936d8abcdbf5830bbed1a993048e2b31bc8b70e8f5dc663179c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704096908, "uuid": "913a9053-f46f-48e5-91b9-7c8283fe1d61", "value": "T18B752312B9C2C071D879593519D247B16B787E305B2B57C7A7482F3E9F700E0AA39BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704096908, "uuid": "38aadbba-a706-4972-ad60-21107ded8a39", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704096908, "uuid": "855b0279-0328-4525-ad22-83ea260682f3", "value": "49152:lOtT5KfhZdjPmO7QH/jR5k140jfsccF0d:lOtTcLd6bH/jR5Adc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704096908, "uuid": "b3eb9fa4-26e1-4010-8d6f-13f993976429", "value": 1596272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704096908, "uuid": "5343853b-4e2b-4db0-9566-86dc39e39e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704096908, "uuid": "c52aa202-c7f7-42a8-a83d-53cdbd9bd8c3", "value": "a5f9699e55f4eeb48b5835733c95a96c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fc8870-a8be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704124484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124484, "uuid": "af7102fa-b0ca-439a-b967-b578d962a65b", "comment": "Malware payload (Mirai)", "value": "87978583e82df3be1bea48dcc67bf277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124484, "uuid": "484ac138-4162-46f8-aca3-4c9163291836", "comment": "Malware payload (Mirai)", "value": "3dfdfc217fdec969d28a9c792b61e308c6b85f58ab5da3e688feeccf09130527", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124484, "uuid": "08fa081e-ec45-49ba-a3dd-256cf450d940", "comment": "Malware payload (Mirai)", "value": "fdcf1967bdcc031d39752d642055a0386ea50c22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124484, "uuid": "4401b85b-64d2-4b7a-bdba-1750dc8c809c", "comment": "Malware payload (Mirai)", "value": "cb921a730fee2bd598afac4436950bf990a1c9e3f5bea2ec828faa7025a4343f5387ca6b7d88b95ac0a79e6e9bea7634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124484, "uuid": "ee8e121b-db6c-477f-99c2-08a66404172a", "value": "T1B3D35B73D82A6F68C165A174B0308F792F53A99082471FBE59B7C2B54043DCDF60ABB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124484, "uuid": "fa8cc8f5-f943-41e5-8e79-f3e4b5c48ceb", "value": "1536:0aAjjLVGaAJxWWIREApboJbRCSKjM4/Irqcs8NZMWHFhm8vymOSIl1dvpGs:0dBGitEKAbRojwqcs8MWlhm9mXI9pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704124484, "uuid": "dec45608-fd1d-4a69-b27f-7fce7989fe2a", "value": 132640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704124484, "uuid": "e48037bf-c4fc-43f4-98cd-afc81e140a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124484, "uuid": "122c4295-57b7-43b9-96f1-9adbc3603d8d", "value": "87978583e82df3be1bea48dcc67bf277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba2678f-a8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704118616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118616, "uuid": "d1288ed8-4961-41e3-a9e4-91beac17895b", "comment": "Malware payload (Mirai)", "value": "a6bd1893ff9272981bb5188116090d5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118616, "uuid": "fa3e2978-de46-4d91-982f-4318ae6d95ce", "comment": "Malware payload (Mirai)", "value": "406aecfd2cd7bf9ad2fcea90491ffa1584e0be5d5cd913ee30ae9e9f98defa97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118616, "uuid": "8b66d373-2678-4181-bcd3-2fffed9dceee", "comment": "Malware payload (Mirai)", "value": "76ed901017d8b38acd96fd10a364238105097259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118616, "uuid": "161b5303-4399-4ae7-b609-42e977483877", "comment": "Malware payload (Mirai)", "value": "adc9e27a632a3c611bb0cb593a8429ee106ed23116ff66a95905cacc2b96c1b4f3182036ed19deca389f3b0400b64bc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118616, "uuid": "e52ad22f-4b55-48f2-9f04-145cc917c292", "value": "T136B2D0CD60443084C98D7C7C578D4A664FACA1D0BAED8F16E360CD9873BEA8B385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118616, "uuid": "db8def48-c0d6-45cc-a77e-d7f80a00685e", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpy0ZqSWvE:4QlS07FUXqIYSXQKquBqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704118616, "uuid": "cc479b3e-6914-47d2-a1fa-feefdf10b762", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704118616, "uuid": "a436f159-617c-4bfe-850d-255d51a67168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118616, "uuid": "7e5229cb-d33a-45a3-9add-d732683d06be", "value": "a6bd1893ff9272981bb5188116090d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a459de-a872-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704092108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092108, "uuid": "f2696f1f-18f5-406f-8f10-d5bbae23de82", "comment": "Malware payload (DCRat)", "value": "a1e0f40382ed01f7e79922eac9a0cf1e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092108, "uuid": "88924361-5f8a-492c-8ad9-63e007de6774", "comment": "Malware payload (DCRat)", "value": "42f84bfd437bf53ee05fba0c0a4d980f7d360e2ff70f2b78c11f23db2c890983", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092108, "uuid": "c2944057-d164-401a-991b-dbfe5c57d124", "comment": "Malware payload (DCRat)", "value": "c793c4902d79c1aac34becc79bf92b5f945f8d84", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092108, "uuid": "15f6bb28-f869-4bba-a227-a2974fb2043a", "comment": "Malware payload (DCRat)", "value": "df132eacf3938612f7d39632879264b105199e9e01601b3cf91c5ea5ae91bc8f6218b1a309ab5afa4aceed41b6fe7a98", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092108, "uuid": "2a547918-4778-432a-bcf3-7f129de8ade5", "value": "T16F959D017E55C952F0660533C6FF45284BB4AC912AA6E31B7DBA377D59323A23C0CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092108, "uuid": "ce6a83d4-38c4-4527-8c06-5799c9ba26b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092108, "uuid": "7143d4f1-e913-463f-bf2f-98df70827890", "value": "49152:OvWz0sGNeOYyj4JbbA3p8k92B5DsaaP5TBdH3:Ov9NeOYyj2bqV4PDsaalBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704092108, "uuid": "d221a0a0-3366-4ed0-b268-248ade2a729e", "value": 2056192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704092108, "uuid": "28ed31e8-e232-4008-862b-2ba96597d887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092108, "uuid": "4431cd3e-ed75-4242-8601-19d446440b12", "value": "a1e0f40382ed01f7e79922eac9a0cf1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4234db-a87e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704097166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097166, "uuid": "5e3a2a8a-8b72-46d9-a26b-3bf578831fa7", "comment": "Malware payload", "value": "b134c83ee4c11271886a1fda69999375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097166, "uuid": "18b07339-0425-48cc-91df-94f48db73ea8", "comment": "Malware payload", "value": "446211d2ed10ab785a224abd5e731213af864064dd484cdb74fd5b3b8ebafd10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097166, "uuid": "bcbecff5-e1a5-4c6c-a88b-a215fc3f0c8a", "comment": "Malware payload", "value": "9141a07fcee3ad13456e8ba5b856c2726fd63fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097166, "uuid": "b2d4f071-2787-4da0-8069-976a40ab446f", "comment": "Malware payload", "value": "8c73273572016f835c1dd43d608079b79b7f07c8a5bef0f398b089304e14c17f122e3e25d6662a4eadbb615db0e8b336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097166, "uuid": "532689d9-fbcd-406a-b8fb-df077c5236b8", "value": "T188147C03BAC08073EC762D33E1B96B94563DF5602A87BDDB77182DAD0F746C06630A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097166, "uuid": "95cec516-f230-48ed-902c-1dad3222c0bb", "value": "bca1444b7046f60bbcd8b62c099e8398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097166, "uuid": "b69e7ff3-6d01-4edb-bf89-f8105b627b48", "value": "6144:mKaBxAgjDECSbdwZfURs6x4yqvDPQyOlo+5:qBqgj4CufxMMyOX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704097166, "uuid": "00ba5bdd-0f3e-488b-a1c5-892e7b0aaa09", "value": 204625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704097166, "uuid": "c20651e7-380a-4acb-9ae9-799c9d097c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097166, "uuid": "c1193196-eeaf-4cb1-bb6e-eaacf6b8664a", "value": "b134c83ee4c11271886a1fda69999375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b5d59f-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1704140110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140110, "uuid": "d2b24430-2e86-474f-9cc5-df8f6be18cad", "comment": "Malware payload (Adware.InstallCore)", "value": "d62d9e3526e3bff7a2c47572d9e8ed53", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140110, "uuid": "abbeb122-00c1-49d2-bcd0-f17f5390f717", "comment": "Malware payload (Adware.InstallCore)", "value": "4abbab1431b24795301658946d26e5055fdfa7c4d274f53d8236c4214e3d3d8e", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140110, "uuid": "6ba4c682-cd11-4d78-9a54-25731a0f315e", "comment": "Malware payload (Adware.InstallCore)", "value": "c47359e2e0c8c9c32e11ddd3c8ab606b89779031", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140110, "uuid": "62374b2e-095f-4524-978f-ccd92ca0a2bf", "comment": "Malware payload (Adware.InstallCore)", "value": "3389aaa1642662b11e4f44902b22081ffee270d9c438864a992d955000d15907676a840d7efb9174cc01714baeb1bafc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140110, "uuid": "6ce41a13-9cfa-4ce8-a626-40b12cac9cc4", "value": "T14F4633B627D1DDB2D4F4ADF0CA02A31068925C829FF11219B5BFBA6A52B4312DC5F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140110, "uuid": "ded63aaa-ed48-4ec4-85ce-1ff793b53e36", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140110, "uuid": "f34bb79e-9576-4a5b-9cdc-3cd9c1c5053b", "value": "98304:j5YIMzHusBFAL8NG5W/y0vTm6iItYRBgvFLCfrBwbh2DL8NG/lX3pJ+APrlvWs8H:KhusB6ANG5W/jr62Y/gNLCqbhEANG/lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140110, "uuid": "59c8b5e6-f5cf-471b-ba37-ff934cccdc3a", "value": 5830571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140110, "uuid": "26bf42b8-cb2b-4833-9730-44b83adb2bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140110, "uuid": "5688f950-c7b4-4dce-aaae-5e19f0e8abaf", "value": "SecuriteInfo.com.Trojan.Win32.Themida.15576.14721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f720dbf3-a8a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704112837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112837, "uuid": "f23e1ac7-32a6-4bd1-a2af-b6db15ff1ed3", "comment": "Malware payload (Mirai)", "value": "9e3ceaf37fa8a5066bed9d24cf704940", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112837, "uuid": "26864477-bd3e-4003-b7e4-eb01003f5619", "comment": "Malware payload (Mirai)", "value": "4c3622329109b9d63b1367b122c8365ff0835601e09f87450be8be7ded1241ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112837, "uuid": "389403e2-4db3-48c3-9344-0589dd4d22b0", "comment": "Malware payload (Mirai)", "value": "bdae309854de900ea03b3749b6d98674516bf491", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112837, "uuid": "de6c2c5b-f101-4586-8325-8b0e80f4f5b5", "comment": "Malware payload (Mirai)", "value": "4168e5c3c1f8405d58259553ea2fbde067671231d2321b3cdb6c213556e952233d6b11a302ae0c8f042c8b07d2489959", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112837, "uuid": "2bd14895-e90b-484a-8f8e-02a9f1953b35", "value": "T195A3D80E6E218FADF369C33547B74E25A75933C627E1D742E25CD6041E6038E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112837, "uuid": "ac30dd48-7911-4598-916f-309f9f0202b6", "value": "1536:3eeZjpBydlAlCmbvvXWKz6K6H6KGriUL1bnV0QOSdecVj8P2vbhl:3JBQrsvvOUL1bnmQOSAP2jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704112837, "uuid": "4d356d71-5785-4f28-bc3f-254c555c86f2", "value": 97684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704112837, "uuid": "ec947e79-2b2f-4af9-a8e8-837b2779c78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112837, "uuid": "005836aa-105a-40e7-b9ac-97b627feba31", "value": "9e3ceaf37fa8a5066bed9d24cf704940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb763303-a8a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704112845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112845, "uuid": "b11f653e-22cc-4435-add1-52ae1337ace5", "comment": "Malware payload (Mirai)", "value": "93027c57b7f489c6ec34a1fb9465a124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112845, "uuid": "a1ab425b-4417-40a4-a7c1-b5d5a69e2244", "comment": "Malware payload (Mirai)", "value": "4f55b23b6f3f3c4c6db970d3c11174d91c3691c157876c91434765fadc0088bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112845, "uuid": "4f02f7af-01a1-4e44-90fa-65d132b1da38", "comment": "Malware payload (Mirai)", "value": "d545ea01640412f86c83093d2ec50f46c9a58962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112845, "uuid": "11880d25-4a4f-4f0e-9fa3-e47736250bd7", "comment": "Malware payload (Mirai)", "value": "e3d811037c8e61c15e75a9ba5769896cda63c0a7198d79e090968f2276ec43f2a33980f80356c45d6471dcb09b072a7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112845, "uuid": "518aee8b-9820-4c45-a1fa-db96f9a85347", "value": "T1DC733A81BC805A13C6C1127BFB6E428D372653A8D3EB7217DD25AF21378B92B0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112845, "uuid": "4eabc44a-c671-4681-9aab-19a9d955a1ce", "value": "1536:DTkhjplyCSbRfqOn52rjaphUBeNLQI1A7SsxpW1Wkv9+:DTkM5fqO52rjaphUeEX2wC9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704112845, "uuid": "aa542991-4f72-4b08-8aa6-c86d1712905f", "value": 75108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704112845, "uuid": "c9a96ce5-5f9b-438e-9607-7cbc23fee619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112845, "uuid": "17ec2e1e-4be3-4e26-9616-6be92172448c", "value": "93027c57b7f489c6ec34a1fb9465a124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78a9511-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704131172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131172, "uuid": "afc57fc9-8d15-44be-9f8a-db10c13cdfe3", "comment": "Malware payload (Stealc)", "value": "07dd69c375fa8a6c3834b582aa927fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131172, "uuid": "8292d904-3761-43f4-af79-b23d55e5aa51", "comment": "Malware payload (Stealc)", "value": "5291fa7572877a4450b128b5766a5c39d7831231dc9b33f269018fc6d60ca9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131172, "uuid": "ad92acda-a251-42ee-bec1-ce9f5a680159", "comment": "Malware payload (Stealc)", "value": "6ad8c2e24b179a4895de64baa614a4403bffc284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131172, "uuid": "03732e75-b050-42d8-860b-6117af6b6498", "comment": "Malware payload (Stealc)", "value": "dadd249d8165e500c76cb58df963ce179a5c56cad9dbe5765167882fea9152f450d8785ebe72677667aeb468150dc6ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131172, "uuid": "6af7867f-8eb6-4a48-99f1-1461b595b1d8", "value": "T198248C1179F5C032F3B3593549B0C7B44A7F7CA36A35948E2BC526EA0EB56E19A203C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131172, "uuid": "4426ca61-644b-4b58-bc46-129e0a5d77d6", "value": "df6a6469b4143787a11116f9c977ca7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131172, "uuid": "e8ee170d-72b6-443a-a20c-bc50a1e02daf", "value": "3072:JAhL6w18zZJiVLXAidFDAUPif+fFiTZAN8SvC5DrRHZwgvXF/LwtO1/D:JAhL6BzSBif+fFMAeSsZwgdDwta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131172, "uuid": "0ba9fdbd-6194-4d42-b8c4-a822e85f7219", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131172, "uuid": "96a45527-5765-4279-9541-09dabb82450c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131172, "uuid": "0dcb75ef-3c90-44b8-8f52-2920069af5dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80473c65-a8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704118651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118651, "uuid": "319e1b80-cb93-48af-bf40-cda2605b9aed", "comment": "Malware payload (Mirai)", "value": "dcea1d0f3565b9bc7752911bcdd79627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118651, "uuid": "aab2109d-4ece-493e-a769-ffe18a5c3ce8", "comment": "Malware payload (Mirai)", "value": "52993fdd2984a7bf45f9e624e72d6e5671148c9a6a14c584c034f51737e5f9b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118651, "uuid": "2f53d0f0-4d73-468d-990b-7697ae113ce3", "comment": "Malware payload (Mirai)", "value": "b90c9643e28f5aa46d2ac29867a2abc417388cab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118651, "uuid": "9429bdfd-e865-4d7b-86ba-50b19bf846b3", "comment": "Malware payload (Mirai)", "value": "fa10b4054cffbaed27c2448421fa85e81130b73dbaecdcbc3526194338554c9847e6fe004f18f875c7ea1d68650e92d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118651, "uuid": "ae63bd89-556b-45f0-b073-83b61fa9528f", "value": "T103336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118651, "uuid": "03b6a18f-9e60-4f02-a14a-9e9235fa8067", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704118651, "uuid": "4272d390-deaa-46c9-84f1-2aebb58e1a2b", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704118651, "uuid": "93cc5951-7fee-4f91-8bd1-078011d53d54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118651, "uuid": "7e7b8d9e-d8df-4816-a396-ff94c022d46f", "value": "dcea1d0f3565b9bc7752911bcdd79627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31016a8a-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121524, "uuid": "bbf06017-8b6b-4af0-937a-28f89c32a5b6", "comment": "Malware payload (Mirai)", "value": "0dbc7c56ab0d0dd41ab9296417c6bc04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121524, "uuid": "59ca4b09-f242-4949-9e10-b692554402bc", "comment": "Malware payload (Mirai)", "value": "581a0fb0805c2d63a309a3853139bca7372c956bf0de57e54ad58e25c0595297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121524, "uuid": "f89aa73d-dffe-41c5-8fa3-e30a8c695c06", "comment": "Malware payload (Mirai)", "value": "e347203961f275d8ca1842ec4604e82c0e6e70b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121524, "uuid": "37db0e8f-e642-4a2d-b241-b29328959e35", "comment": "Malware payload (Mirai)", "value": "c11c84b60f4f79f03835b1e4ab8b505542b7e86b5de39d1ae058cbdf0002f066a67f1907d8bc949624c3aec2caa7bc9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121524, "uuid": "27e07762-7b7e-4da3-9117-c7a52ba7302b", "value": "T18A13F2A144D6CDD6CB1AE1BAAD8D03AC055A499AFE7FF3E7B24D000C878D387361859D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121524, "uuid": "962d77d7-bffb-4080-848f-314a4026b383", "value": "768:ZnQiDSb+lSax6z9sCeQhyfKjL+WuU5JBcag5SehuxuqrTHYgPM7XRX:ZnQiDwax6teZKjL+yPia3rxLrTHYwMRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121524, "uuid": "02f28ad6-f0a9-435d-aa29-37e20fc9899a", "value": 42892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121524, "uuid": "4634b089-8d03-4769-ac67-f99421796892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121524, "uuid": "37bd3fb3-ec9f-4886-9a36-6a132542556f", "value": "0dbc7c56ab0d0dd41ab9296417c6bc04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7389b81d-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140104, "uuid": "c2824b7d-9154-4f04-abc5-3c1fb6f19ee9", "comment": "Malware payload", "value": "13fafa7ece78378d0d0dfea266cc4569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140104, "uuid": "7bb6f7fd-962c-4612-b4ae-5165de916758", "comment": "Malware payload", "value": "5b66a22d1518a05674e6950d177f8b2dbe43f6b761a63df5f2f5cc066e196299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140104, "uuid": "d1855b78-edf6-49b9-b044-3b3f9d6c4a8b", "comment": "Malware payload", "value": "2f9019f1916eac26a4c6001f0b50073382dca17c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140104, "uuid": "eaa1af5e-3128-4e96-8767-75afc72cf489", "comment": "Malware payload", "value": "b5e384a2ffc0629c96802d22e9d79f57b29d127afde8970341adfe95a0f1fd9190dbcc17f06bf6c9183a0a1fd975ca2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140104, "uuid": "2d3523f3-80bb-4007-ac9b-c328158ad838", "value": "T141D533999424968EC7D474F40FE2E9B62BC01EEC7D94174224F21D8BBBEEB9B4D2105C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140104, "uuid": "25fd4fd3-ea11-41b9-bd00-ceacfa2971b6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140104, "uuid": "e6766ca0-831b-4ddd-80ce-6b9a1940f933", "value": "49152:nEsHxTRL9F525cr9qtw5NT51xAIK5ODfRgWmg4Xmh631FyCmNN0yE+fcl3ioqI:t55F4twPdvK8DZnmg4Xmh632u+fcl3HB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140104, "uuid": "d5f294c9-00f4-4719-904d-9c6b083e1ee5", "value": 2901018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140104, "uuid": "7add945d-a569-4b1e-8bf3-1d5180d02d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140104, "uuid": "33694c8c-0cbd-4cba-b592-eb4df5fbae71", "value": "SecuriteInfo.com.FileRepMalware.20949.22734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa7cf5d-a8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704118623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118623, "uuid": "15bad6a7-b9ce-4e04-bce7-137ecd9276b8", "comment": "Malware payload (Mirai)", "value": "9af990460bf0654c07ba4b60fe1f50a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118623, "uuid": "58966ad8-8813-4fbf-a4cd-a409ea2ccca6", "comment": "Malware payload (Mirai)", "value": "5d8c4036ab1b11255caca154f60896b367ccb69af6029be1574d20cd2c2ef7a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118623, "uuid": "a4b21e29-8173-47b1-8134-a3e5486b33fd", "comment": "Malware payload (Mirai)", "value": "a4b2305c4cb440605f22f5642b72655a3a989bc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118623, "uuid": "f16da097-7b43-4124-9143-58c1fcdd7f35", "comment": "Malware payload (Mirai)", "value": "058d2505e6a2bf401ece6e855ef24bb9f319cf0bdfea1a9c3bbacdb9571783a4cb922fc368e8bc6da45ba280f109ce5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118623, "uuid": "4c76c7cf-750c-4b5e-9743-932bc1ecfc12", "value": "T17182CF3061AB74F5CBE10431FAAECEC6971B0BF8D1FC36A216586B78894210651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118623, "uuid": "8cf0361e-1d64-4a3a-9c00-5ed159d596f0", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaprhymdGUop5h5lE:2dV0P6+kom0tVAoNvm+to1Rs3UoznlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704118623, "uuid": "38bcb0c8-b65c-473c-b3b2-fec418c0f010", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704118623, "uuid": "f37e6d19-b77e-4b25-8ff0-c299733be1f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118623, "uuid": "f37cb676-7006-4736-98a7-9658dfc56244", "value": "9af990460bf0654c07ba4b60fe1f50a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9358e37-a84b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AndrMonitor)", "timestamp": 1704075475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704075475, "uuid": "830f97ac-0e95-47ec-a75f-2cc1ce9d530d", "comment": "Malware payload (AndrMonitor)", "value": "274b3854076ae54515453e34e7042793", "object_relation": "md5", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704075475, "uuid": "12043132-ce8e-4a83-8c31-02cc7092a6d8", "comment": "Malware payload (AndrMonitor)", "value": "5f830ca263271deb676bc8ba77d7ecc5cd3c0731f7e01b9050fbe6f20066c47b", "object_relation": "sha256", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704075475, "uuid": "5a7764f9-6f53-4eb3-b4f2-6840bf9818bc", "comment": "Malware payload (AndrMonitor)", "value": "7607b232e147d8a26a1331e1be13b39e6dc6bc99", "object_relation": "sha1", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704075475, "uuid": "b0ce99c2-0b73-46bf-a227-414f40fddca0", "comment": "Malware payload (AndrMonitor)", "value": "4af86551cbd498c11cf30c52baffa329ad5d6142ac099ec162340b5a1a39839f236d125d5f6979bdd0b2e6d17a78596f", "object_relation": "sha3-384", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704075475, "uuid": "1e902806-9df8-47a2-abae-eeaf21f25e46", "value": "T1FE273363580A6DEEC031A436557E2345A872CE5E3EE267211440DEBBD2F3865CADDFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704075475, "uuid": "0541f1b0-5329-4ce3-bcfe-6ea66a0d1a2f", "value": "393216:oBtbEsJA35z7A79L+FyZ1mbgafiubcEZjbnT9i/zVN2I+TXaFKKpPbNiRSKcssJP:E5LJA35z7c5dPmbBffcGj1i/zVN2IkK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704075475, "uuid": "850f4879-2b01-4896-a1ae-2392d2cac3b6", "value": 21499368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704075475, "uuid": "332fad2a-3de7-4102-8b02-836da9201c16", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704075475, "uuid": "118a531a-ebf4-402e-9311-6b31b4adce1e", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba99ec12-a8a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113165, "uuid": "1918ab6c-bf27-4a11-94d4-8f698690ca9e", "comment": "Malware payload (Mirai)", "value": "92c0e1c39b734501f880cc6e41077134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113165, "uuid": "cecef7b0-1147-44fd-807e-fc0223d54fe5", "comment": "Malware payload (Mirai)", "value": "62be731321c14137a211cac325c4ae05db32c4e4f9a9d3cea488154857d4a1ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113165, "uuid": "9fe865aa-7b50-4e06-81a6-b18ef2b6e9fd", "comment": "Malware payload (Mirai)", "value": "5c7cd5d33336444869d0cba9e11d74d65afac2cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113165, "uuid": "3e013d61-f88d-46e2-9b5f-73ba4674cbb9", "comment": "Malware payload (Mirai)", "value": "1ee9b3179f06d17ffe61c40f2c797fd0ad72cba7e0bdb3357404e3583ca5e6415b6cc97265f35548e77e76e0e7936b4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113165, "uuid": "c2204207-e24c-4ea3-9f22-855a5f9323b0", "value": "T14F832955B8818B11D5D512BAFE2E128E3313177CE3DFB3129D10AB24778A96B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113165, "uuid": "edf9dc42-6bc2-4971-93a6-b931397d91ea", "value": "1536:NUneWWJspC/HKcCnHCoE9FKVQcpa30E8QsM3iu/+TywfWHb7L85gYc3N:fJhH2HM9F+Qcpa3X/aywfWHb/8uJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113165, "uuid": "6d62aaa0-7ea5-4435-8351-1b2a34aa9454", "value": 87384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113165, "uuid": "471e503e-1fa6-4c38-b139-8048259c036e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113165, "uuid": "d01b575b-7dd4-4fa0-887a-0df20efdc7e1", "value": "92c0e1c39b734501f880cc6e41077134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72abfcac-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140103, "uuid": "2b465322-49e2-4eae-9344-20ed56dcb490", "comment": "Malware payload", "value": "470dcc74ac1b8c4f0eebd2fcc04902ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140103, "uuid": "042adfc6-ced6-407f-8cc7-e78c1d9aca3f", "comment": "Malware payload", "value": "6bc44ffdf5fb9a208f27e836635852620368c30c5320163f3fcde1f9931091e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140103, "uuid": "5f159117-19ec-450d-9fed-9acd0cfb2b6c", "comment": "Malware payload", "value": "7362395aebc3022cef3596a4c88f0c7d47bbf695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140103, "uuid": "130f54a8-160b-4485-b2eb-c185f65a40d3", "comment": "Malware payload", "value": "bd8ca8c4137f567464a970ad873d70198ba6d6bb8a3fcfd161bc7ca4c9da0c72b772a62e2a08d0a11a09b6d59910e178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140103, "uuid": "799c1aa1-e2b0-40c4-aa5e-c23fff0ce837", "value": "T1E49633938D7A44F1F2DDC3F259A4D40A12ACFD9C4838D3A1339910C7DB9A14BBA9679C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140103, "uuid": "eb468232-7e7a-457d-8697-e9ee90e14430", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140103, "uuid": "7774b613-9b92-4812-9316-ff6d7535bde5", "value": "196608:DOEVrv9Et+hnI91fZFf4L5GHWIpsUYXVdQUiUV8cRwS8OMIys3albOQiGQNhXJ2v:DOEpGt+VQ1RBoT2OV29UV8cRw5xIys3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140103, "uuid": "07c59273-a905-41f3-8037-f977946d1666", "value": 9464776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140103, "uuid": "d46fba64-9f95-4e94-9dc3-e10b30860398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140103, "uuid": "60d86be9-2d65-4efe-bd62-efae78e45143", "value": "SecuriteInfo.com.Program.RemoteAdmin.952.15847.745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94928a9c-a8d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704135006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135006, "uuid": "445f026d-b558-4f65-94d9-8c277759392e", "comment": "Malware payload (Mirai)", "value": "1673aa9eb8c24cbbb15583a45cf44677", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135006, "uuid": "17585e0d-25f2-455c-9c3c-0c14d23f8c94", "comment": "Malware payload (Mirai)", "value": "6c8df72c33f5e8854254c7835d8fef59cf40dec522fd29cbb4d13cd72bd2b42b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135006, "uuid": "c7958a90-3b3d-49cc-9631-d10a42b558df", "comment": "Malware payload (Mirai)", "value": "84134faba000a0a98c60df76d09fcdb39186548f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135006, "uuid": "900f8d71-fdfb-4561-820f-266345ddaa1a", "comment": "Malware payload (Mirai)", "value": "a46da1c01c82bb0bac49a341b9e0e3bc65bbc9b422a9162ba4401275b1a93ced41397b01b2b347e89d0bff1112534f1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135006, "uuid": "33a8ca3a-4207-4718-82b0-1a467e6eb414", "value": "T15243F26CC0809777FAB7A07B8C84E35A66125F5964DFB6A7B128C54C22D12C37B78443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135006, "uuid": "d283ed4e-7089-4d26-ad12-ced74308aa0a", "value": "1536:soYqsxs8cBHEKon/bdulER0N0UOJ0BcgGfiXfiv:HFsxXcTMdulrrOJ0SOvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704135006, "uuid": "9ed8be3b-5be3-4b20-8710-066638e47c31", "value": 56016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704135006, "uuid": "ec5f9807-a7cd-4721-b9bf-45885fa6a924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135006, "uuid": "1151c31f-7e07-47ef-baea-65e03cae7bef", "value": "h0r0zx00x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7000f2-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1704131155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "033be978-dcd3-41ea-b1ba-0185b0ed995b", "comment": "Malware payload (Meterpreter)", "value": "19641940c87adf2e125b5b85f8d242a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "b840d1ba-d72e-4a89-a992-bb1f73717d4f", "comment": "Malware payload (Meterpreter)", "value": "6eadbbb4368eb760df9ccec6ea44a3d6b63c05f224738dc0e7c06db528ba85f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "ea3a6ac7-81fc-487a-a155-f15d95c33e51", "comment": "Malware payload (Meterpreter)", "value": "dd76a18cc6826b3a4a64eedca2dc9026714a3d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "14abffc3-2425-4c02-892b-870690cee483", "comment": "Malware payload (Meterpreter)", "value": "6b9c0d1c7fcf329e3f4a748507e117337bf5082266613bb865511d6cd38a3ae0b6f663456902ea853bae0eaa48c83c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "62495cb1-d84f-4b0f-8cff-813637b79367", "value": "T1B673BF42D9C41526D295127E2B763BB999B1F1FB7201C1DA794CCDF8DBC18B0A2293C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "9893584c-f1bf-408c-b8f2-6e1aec971fba", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "09901142-9660-43df-8e11-987a3c2c1660", "value": "1536:IGhs3e+IHJESRaZa4ctAm2r+Mb+KR0Nc8QsJq39:zhs3XR3stAJ+e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131155, "uuid": "bdb7d31c-b34a-489c-8474-70265e24cf71", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131155, "uuid": "18274c5c-9910-40a4-8d29-5f82061dc0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "6e716c06-cf8a-4594-95b6-ece95d5e62a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac5aed9-a874-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BazaLoader)", "timestamp": 1704093033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093033, "uuid": "53b42301-c721-4c47-ae82-3775f4457380", "comment": "Malware payload (BazaLoader)", "value": "3b1d15b557762c579fff9346a1d32ac2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093033, "uuid": "9f286c6c-9767-447f-a723-0f12e2a5e123", "comment": "Malware payload (BazaLoader)", "value": "710951956dadaaca476381818e2bb511f066805864c323fb2296ed7e3172d42e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093033, "uuid": "4350b6d8-ea9a-47da-a583-5f25263e5c49", "comment": "Malware payload (BazaLoader)", "value": "ab51c1cc70993f7d65c5020e057f7555ddbb1e90", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093033, "uuid": "7bfa304d-e33d-4c30-846b-ac9a2abc97d6", "comment": "Malware payload (BazaLoader)", "value": "7c6fb723c71b862ce3a6f3a7607f0077f64715d04b45e7efcda8a84f5bf1c186af55ba7ff3244b58020387b6fe72d96f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093033, "uuid": "4bf68bf2-fdd5-454c-b1d5-11a052660f66", "value": "T121468D3E756F50C1FE4AED385383D33E46823FA7B97E240A5B6E0A5504647F5AA83350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093033, "uuid": "8775c8f0-bed0-4a58-8851-a49b4fb8c6e9", "value": "060f1fdd4c28b012c5cbaa410e9e4b34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093033, "uuid": "a643ae93-ccc0-4cc7-9964-e0d4d770fc85", "value": "49152:pHEqac41dxGxDYftKbiV55MZHPcuZk8gkuRXp5PamYjN5B+9cI9O4aOjemkLm4XW:dUsowH2f9vaecR27N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704093033, "uuid": "caf8f3fa-cd2f-4984-9e92-e82487c96ac8", "value": 5531648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704093033, "uuid": "0c6d7964-72a6-4b26-b45f-f67b6e7f3450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093033, "uuid": "b711ee7a-c662-4800-a409-aa6cd5a8ff8c", "value": "3b1d15b557762c579fff9346a1d32ac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efce2db-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140097, "uuid": "9a145582-ac9d-4e8f-8498-2ab3d0c8b82c", "comment": "Malware payload", "value": "94e42ca97ef781da5c7b0a4119fcf5fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140097, "uuid": "d5f92788-58a4-45ed-ad94-76820277cb19", "comment": "Malware payload", "value": "71cec4311fb8b5f2e7ce53d6f4a392837483536bef7642f0ba92d5d05cb210bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140097, "uuid": "3d5f399e-384d-48b1-8236-b426e9b1920c", "comment": "Malware payload", "value": "06e86a0585e4ae7bb22a64ab1e6124a619774dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140097, "uuid": "78a77d08-d126-4ade-9948-05aa53b43ea9", "comment": "Malware payload", "value": "f6605580c8c673eef6ed032769215bf21576f63e9fabbe1297f2b70fdea3749d545eea98bf8d9497443a5b2a59224f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140097, "uuid": "42b11782-09f4-400f-8795-432d56c4d1fb", "value": "T1BC34B62BBE64210AF16286F425359146AD32BF324ED4ED1F6380599D6472A83FCF271F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140097, "uuid": "24598cdf-e72a-4063-8dc4-6f6520d9e1b2", "value": "b604f221f3599c647f69ef012fb38763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140097, "uuid": "6c901b2f-2e62-4dcb-ab76-83413c937545", "value": "6144:eL48WcGR+abNq4955D9+bY7MQJnFJ5mY1W++lrCKy7FyC4Yv5tbBhhv9Tu+:DcGEabNCQJLW++JCLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140097, "uuid": "c1993fb2-2914-495f-9fa6-b11371a94289", "value": 237288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140097, "uuid": "3894e397-b7e9-4f7f-9123-cc08f512516a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140097, "uuid": "ad69dab8-3dc1-40ed-b3c2-dee4ec61e940", "value": "SecuriteInfo.com.BScope.Backdoor.Androm.26413.11555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d4cb9f-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1704131161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131161, "uuid": "3570dbe0-0e65-4abb-8a41-c6bfd309184f", "comment": "Malware payload (Phorpiex)", "value": "cd84f15d0665079a3d84ce70538934da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131161, "uuid": "ccef4f27-e0c6-4668-a4c8-3b147cacb4c5", "comment": "Malware payload (Phorpiex)", "value": "789dcb2ef828eee82749c3ff3d08ac19d68ff06ad13ca1718c2ea47953775b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131161, "uuid": "6a6640ab-a140-4b6d-91d8-4a576618b110", "comment": "Malware payload (Phorpiex)", "value": "d6475c25de1df7706be69a1f02bf555849ed31d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131161, "uuid": "34ecdd27-1b19-4c0c-9152-337dcd799b24", "comment": "Malware payload (Phorpiex)", "value": "f72309435745c188f9310a2084e040713e6286eb16c826d08c6460e4a9f8c343d8cdd607fb51c221977a0b1a0b5c21b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131161, "uuid": "37078bea-4efc-4956-8c2b-76d6c6734aa6", "value": "T174830840F380803BE0B28ABFEEFEA299161C9FB4534594D3F2B174DE56646C6B639453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131161, "uuid": "a059095b-bb16-4827-a1c5-6b48a642ec2b", "value": "2ffdf0a1519d1adada787fd4df5a5fec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131161, "uuid": "3764bbac-47b1-462a-b031-b90d85ab40eb", "value": "768:K3MuYuJJXY8p5ZOcrq32UP3hBFt9iElU1lmWziu+1EcPk+4cW2TjlgE4EHZc9o/Y:K3Mz8gPxbD1eiFOcPk+2pROSKSPfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131161, "uuid": "e34c782f-b27e-4818-9994-6172bc43f809", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131161, "uuid": "ada4e4b3-8ad4-4298-bab3-2834d6b64b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131161, "uuid": "b61c9504-aa21-4ca1-96d0-8f476ffc476d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0ef898-a8a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113198, "uuid": "d78ef064-6ddc-4af2-8cf4-235fc8fd6e4c", "comment": "Malware payload (Mirai)", "value": "25bdb9a753851dd5d75ecd340821808c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113198, "uuid": "0cfbc076-c980-496c-acb8-42be3e78b732", "comment": "Malware payload (Mirai)", "value": "7e97e8f3e21d2f33330deeb9e983bcb22b68fb696a215a68b3aa33169a27676e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113198, "uuid": "5f951012-38f3-4669-874b-17dc420da8da", "comment": "Malware payload (Mirai)", "value": "88f27d15a5919644fda00f459eb870f8591de7b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113198, "uuid": "5d8436ff-1fcf-4c2f-9835-328cf1021886", "comment": "Malware payload (Mirai)", "value": "d1db7a20845ab70cbb6b4c9710aed2f7c4f40d07ce2e950afc3d7f4a1370fa1a2453434d4fbd413bf4d227c7445381ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113198, "uuid": "dde35d3b-ed24-45e2-93ad-a1f77fef04b9", "value": "T10A639D73D83A5E58C55891B0B8F08E352753B900D2471FBB69AAC6799043EECF6193F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113198, "uuid": "7684fd6b-228b-4926-8951-269be5dfbeff", "value": "1536:JBAOkletCp7hEKGapGX/gwCJNFxQIq/m:JBAOkc0hrGb/gw+PxqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113198, "uuid": "91dbbea8-f996-4485-8614-7cb6397bbef9", "value": 67884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113198, "uuid": "4ed71753-5eca-492d-888a-76e6355f9b87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113198, "uuid": "66caa5a6-35b8-4720-a4ff-89dbd437f7aa", "value": "25bdb9a753851dd5d75ecd340821808c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db09ee70-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121810, "uuid": "34a05ee2-c4ac-4e23-85fa-875480757ef1", "comment": "Malware payload (Mirai)", "value": "255ebc05b8c5821bdd5e02fd7e5e245a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121810, "uuid": "a2ca7861-fb67-46f3-b3bf-be53a032defa", "comment": "Malware payload (Mirai)", "value": "8162fd0add0beebdb9f8f97a0d8afd6676e0641e083a5bfa7e9bb7c9f6638b50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121810, "uuid": "e704aea2-cb1d-4cd0-b3ec-70ae494fa329", "comment": "Malware payload (Mirai)", "value": "b883573538b2256e2c547e8da564a9d0884bfea4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121810, "uuid": "ef9475d0-3a93-448c-a4b9-030a5de70ef4", "comment": "Malware payload (Mirai)", "value": "4b748018063e0f5f9f6487176e5f5cef553b385cf8d6813f2bd57a9aad22238f382b79630c14cfff344e0030f7cec070", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121810, "uuid": "63f3d061-db9e-4f70-96ee-6a96de859cad", "value": "T102E31945F8505F23C6D312BBFB5E028D3B2A17A9D3EE72039D215F65378A85B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121810, "uuid": "3bc91cba-6ac3-482b-8f12-e9697730a045", "value": "3072:IUcGlZjX4Rcsdn711c+4tDz0B9qXB/6zKJzZXIR:IUhrmnp++4t/0B9hzazZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121810, "uuid": "f939f8e1-91d8-4e54-9b67-60432ce81d11", "value": 144800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121810, "uuid": "3c86adf2-faa7-4512-9fa4-4c4301843d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121810, "uuid": "cb8a23d1-6ca8-46e9-98cd-426cf8a04641", "value": "skyljne.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715a4d5f-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140101, "uuid": "7656f7b8-f11c-4193-88e2-075b3019288d", "comment": "Malware payload", "value": "6b64da54d1dc0ed56ee74b830415bf80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140101, "uuid": "66b1effe-d0cc-46d7-bb6c-527234b5221f", "comment": "Malware payload", "value": "82bfaa07d548662efd85a71d121be0b067b6a78fb4c811bec2048a5826c2c716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140101, "uuid": "784cadf6-b458-4797-b4e2-a3875ae4fa16", "comment": "Malware payload", "value": "901e52797fa8f878549cd913badae459213ba2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140101, "uuid": "029bf549-b90b-456b-b53a-310757b84055", "comment": "Malware payload", "value": "83bf23975496e79013d21ba8b8b571b5efd7caeabe13eaab4f5d86dc0b04dc5a503f4cfee9ebee925419cca94eded11e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140101, "uuid": "d312e899-2904-4758-af1b-5758aeb37d4b", "value": "T1B964A417FB60200EF16389B018356511996BFD361E91EC9FAB807A4E6475AC3DAF0B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140101, "uuid": "b97d6ffd-b053-4304-b981-e06b8f767ff6", "value": "472cceca95ba9325e78498a51fcd2075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140101, "uuid": "25403003-5ea3-461e-ac89-3be08794a4ed", "value": "6144:+ptTy/ujr5tSXtOdiL2QGDq2qr8kgugBs9pofOtcrnK2O2eIKGRvM2yjqS:XWzqrXpgBs9yfa6j7yjqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140101, "uuid": "efa14594-2684-436f-bb24-a970cda3b967", "value": 331496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140101, "uuid": "160e3ea5-992b-4d4a-8f02-83adb468b1ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140101, "uuid": "17869914-c28d-46e4-b401-b7db532e7c46", "value": "SecuriteInfo.com.BScope.Backdoor.Androm.18428.18185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea859c3e-a8a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704112816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112816, "uuid": "363bbd9e-630e-4e1d-85ab-af816f5a15a0", "comment": "Malware payload (Mirai)", "value": "fb824c3ddc9a46d094c582f748dae96c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112816, "uuid": "6ac9abda-91e2-44e0-bbde-e14c50eb15eb", "comment": "Malware payload (Mirai)", "value": "85732f87844ef773361db3733aa9f0dc23c4919994d940274259eb2165d8ccc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112816, "uuid": "9df2c2b9-69e8-409b-87c7-ad27202cf619", "comment": "Malware payload (Mirai)", "value": "301f1b5660007bff708d084d3fadf0b8d3953c27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112816, "uuid": "b2f92c4e-59ed-4fbb-9b22-f2d32764782c", "comment": "Malware payload (Mirai)", "value": "746b934470aeb64e9c3eefc414e5737c6968704a426afb36d3bbdb609dd0e83c39ff1df4c677544c1a0decb3e633ed85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112816, "uuid": "ccccb001-aaa1-4446-9d04-dabb39975d14", "value": "T1F6735B42B30C0947D1A35DB02A3F2BD1C3BEEA9121E4F785651F9B4A96B5E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112816, "uuid": "dba72d4f-ad61-4aa6-ac31-126d5ef4de3a", "value": "1536:i8LXuMOZvk3M5G1+JEVO/nS+O2R/g32XsHvVIiq3J/z6u/ravrK23:nLsvkcGVYfRQCiVIJ30tDK23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704112816, "uuid": "e164c66b-d533-4042-8c79-9b5181712cbe", "value": 75204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704112816, "uuid": "aff0ac5a-28b3-470d-ac11-1b0812c6007c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112816, "uuid": "53b3e938-5d98-4266-851c-1f49777a201e", "value": "fb824c3ddc9a46d094c582f748dae96c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4265b166-a8c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704125849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704125849, "uuid": "37392bfe-1114-40b2-943a-0265f0c2ad47", "comment": "Malware payload", "value": "7204e1344c4569f47991c3e769a78e79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704125849, "uuid": "b2139fa3-5fc2-4812-99b0-6a93ab23f9e3", "comment": "Malware payload", "value": "85914b238a5e984b8075c722ef7104172dd8dc53852fad4d8b29e3c3b165bae8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704125849, "uuid": "7c4a9e0a-26da-45aa-a41c-8090cf817a7d", "comment": "Malware payload", "value": "e728d37c1266de90ba96cb13c06aaa9bab02e861", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704125849, "uuid": "55617e68-4920-47c8-9a57-fc64abc47aff", "comment": "Malware payload", "value": "b8d7d282160ce6fbce58d7335f1ee8981d75944276752cd6171c34984fc87803e47218053904c2d2ad76b2ed91f03a1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704125849, "uuid": "a78089ba-86ce-48dd-b155-221a6b36764f", "value": "T1EA13C4CB37E5CE63C298EB3899A723862335D1047F43BB4B5A94463D5C627CA3C98943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704125849, "uuid": "9fca8435-a0c9-4eab-9b4f-3235e8d979db", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704125849, "uuid": "1fc585ba-de33-441c-aca2-e999bc25d31c", "value": "768:HR/lW7+1RumNs3hIzX/Hu8OTDe0rUR4akOJ6hA:HR/k7IRNm36HED7AR4a3Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704125849, "uuid": "4465174c-7cf5-4bae-a02a-a59458215376", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704125849, "uuid": "6f365699-8a93-4871-87ed-f08ae49a71d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704125849, "uuid": "8c54ce75-069c-464b-b863-68e8f15361ae", "value": "KartalPE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0059377c-a85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704081929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081929, "uuid": "d21c1b19-d322-4638-a9a3-d817c0cc8a68", "comment": "Malware payload (GuLoader)", "value": "d176d5132b461760213c52d026b04e08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081929, "uuid": "74152c36-4f6b-4321-b011-b906622b4258", "comment": "Malware payload (GuLoader)", "value": "893e517f08913e1199a8c77dcc77302c7474cfe4f202c956f4d602d38d777b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081929, "uuid": "0f2077fd-40a3-45b2-9238-cf14b2cf738e", "comment": "Malware payload (GuLoader)", "value": "752c862a154cba230283ca640d8b3395d5d79ee4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081929, "uuid": "1a10e9f2-fabe-4421-97d5-b1d9e80553fd", "comment": "Malware payload (GuLoader)", "value": "4bee6887270973e728657feb643774cecb39c5459f9403d35bb5a0602ef4a10311de9da0ec1a046cb699c95cd3e4770c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081929, "uuid": "d472a768-ebbb-47ca-aa1a-a34e4923f07b", "value": "T143A5337482F6AC05D06607B4AF215B30E8D6CC18B166BFE6C650FBB110B7AD53719A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081929, "uuid": "238ba88e-1033-49d3-ab89-f3d867af5d60", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081929, "uuid": "e0e6d7d4-b37e-4e4e-aeed-fc0b09909249", "value": "49152:kaUQl+AMminT6x5fvymhIlbJZ7a07xznKMj5RyXE1ID1PG:xLIAMmuuVwm+xznKMj58aIxPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704081929, "uuid": "017f407a-60d9-4ecb-9e5d-b2241dc63911", "value": 2092042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704081929, "uuid": "7448e7ef-7329-4f88-bb50-c20a0b7cd2d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081929, "uuid": "01273424-b62e-4667-9e15-03a4286088c5", "value": "d176d5132b461760213c52d026b04e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70016cd8-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140099, "uuid": "1de98715-18fe-4d87-957b-15272fb24175", "comment": "Malware payload", "value": "aa6190c4501698fe3fb8a12b60e7b8ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140099, "uuid": "f3dd98a0-e770-4741-96e7-d5cd3cae0b1e", "comment": "Malware payload", "value": "8ca89afeeb38cda1dd2806fe18904a7fd62e6f368fc16d13199f42841a0cc300", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140099, "uuid": "7fdbdf06-6b1d-4788-8005-e725a9125c00", "comment": "Malware payload", "value": "1fb090c7a83b22f589105d5e2efe28f68ec88ae2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140099, "uuid": "41e40ee0-5337-4143-9e16-37704bf3a38c", "comment": "Malware payload", "value": "c733c6a2f6caf7f02d647ab0063ac4942ddb19a7e91f4e1a4092f236e15aefabf9b7d6218b2391b36efc5b2284fff9e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140099, "uuid": "1380edd5-4740-4e9a-82d0-0b09abe09280", "value": "T1E1360188F656E136D8160130EC9A92ECB375ED94CB1DA363339AFF1E6D31261CDA6503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140099, "uuid": "88655051-6d1b-4edf-8b76-d5873bf6e2bd", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140099, "uuid": "7a1bbadf-19a3-43dc-98ff-aca3140bdae9", "value": "98304:6u0srZbAVgaCFpg3ZZnx4hEQIlF9HKzHxmr:6u0qiiT4ZnA7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140099, "uuid": "2c27c0c8-1dee-4379-93d2-2747e91c2df3", "value": 5176592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140099, "uuid": "95cd1aaf-e9f9-4f2f-ae5c-d5d185dc8f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140099, "uuid": "16b5443d-0e32-4160-a6b1-4c695bf74a91", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.29333.80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dfbef4-a876-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704093607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093607, "uuid": "3a53c219-eba7-4c1d-860b-3d2217bbd1b9", "comment": "Malware payload", "value": "d10087face97db82d546b159fbeed159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093607, "uuid": "e8a662df-94ee-4e73-b673-e8211a431826", "comment": "Malware payload", "value": "9364086adb27bbdb8752310a0cc7b53b3efd33b9e47863acac7c2b4d956425c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093607, "uuid": "db4991b1-e38b-4af3-9a51-c0302633452a", "comment": "Malware payload", "value": "e6b87169b2deee6993207ceeaa34375f3fb97a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704093607, "uuid": "0bd3f2d4-fb43-4a99-a1cb-1ee90a3e60f6", "comment": "Malware payload", "value": "3774ef79cda851090d14758d7dc7a4317e48fe6018e8cc76d3d7661199092a5d3ccfc2104c6506be4ae6df938e2342b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093607, "uuid": "b0f533d0-162f-406c-bc4f-38a66846976c", "value": "T17815AD05B3E8C527E5FA073ABAB657229B75F8851B16C70F0318512D4CE3B844EA93F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093607, "uuid": "cf2eb1a4-bafd-4e19-969c-d15c848de775", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093607, "uuid": "edd53ed9-2da1-4604-a81b-a725aa1bd0fa", "value": "12288:LU1MN0SZ6hNcu/ZIeMINVyxLkiHgEYnDoD+jbbmkyicc:g1w6vHuwQHgznE6Nyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704093607, "uuid": "585f1ca9-0441-41ac-b9cf-f20ab0b8202e", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704093607, "uuid": "2ec618d0-6e11-452e-a62d-9e988af8a319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704093607, "uuid": "3cbe67aa-f5ba-490f-8dbd-76d81bc293b3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.18641.32699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6e98a3-a85a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704081626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081626, "uuid": "d9bb3852-4900-41dc-9acf-3ec362bc9440", "comment": "Malware payload (GuLoader)", "value": "2bd2b08ca47144328cbc68041d8714be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081626, "uuid": "576affc1-bce2-40fc-a11b-f7cd30d5eeef", "comment": "Malware payload (GuLoader)", "value": "93ef4244ed371d4be51955474c1713769f7973200030d8d7a5c61877236bcb3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081626, "uuid": "53ddbaa3-7998-4ba0-be73-eccc41cf1c2a", "comment": "Malware payload (GuLoader)", "value": "6bf34b851bf47514affbb54ea56da74bde446b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081626, "uuid": "cd3d3727-7bec-4ac0-9ab8-6109f30dd31a", "comment": "Malware payload (GuLoader)", "value": "ee67ccdec9bdeb6fbc6ead415da2026c9d404c7747681be0f465a3b373d135471a81d1688d4ecd7dd330be706fe9e06f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081626, "uuid": "35f5b66f-c6a0-4df8-9e42-b1f0a507769e", "value": "T1C3A5337482E6E802D0661378DA25CB24EC97CC1C625ABFEA8350FA72557B9C5331E74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081626, "uuid": "a5bf8ad9-ec5c-49f1-b238-b450bbd4913a", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081626, "uuid": "24c8f125-f202-4b66-a5a6-e90e5b730072", "value": "49152:WaUQl+AMminT6xkk26lWehIlbJZ7a07xznKMj5RyXE1ID1PX:DLIAMmuu9Ym+xznKMj58aIxPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704081626, "uuid": "248a7f57-179a-4c54-bd83-309d72e2a28d", "value": 2094012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704081626, "uuid": "0e6e59af-a843-4be8-a4cc-176b157bab80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081626, "uuid": "db3309bf-0ca1-4f1a-aa53-6e9b03a670ff", "value": "2bd2b08ca47144328cbc68041d8714be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c614e0b-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121517, "uuid": "b28c493f-2438-4c3a-9403-f2bce45ac619", "comment": "Malware payload (Mirai)", "value": "fb2fbc5fa948224ab3ac16e7bb51107b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121517, "uuid": "3ef2ab52-b663-417f-8af7-f8c5ba3122b6", "comment": "Malware payload (Mirai)", "value": "94104f303717e8c60a653fd132fbdc17ddfe3bf5b396626ed8e0e22a0a024817", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121517, "uuid": "1a0e2c28-a829-4c7f-989a-37097dcf4f7a", "comment": "Malware payload (Mirai)", "value": "636ff46b2da5c2ff2cdccb99bd3f4871ff91fb1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121517, "uuid": "a09f5250-1b3c-40df-a181-72bc846ad9b0", "comment": "Malware payload (Mirai)", "value": "2f0ea8313d0af2fef562ff7b4ec355da46aa303b41a0dcdeb4d6b65b24f8c33705beaa0ea669d2b5a55b42b232b67cc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121517, "uuid": "1e7931dc-3dc6-4c8b-b82f-e4a01d2a57a6", "value": "T13C432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121517, "uuid": "dc9f3429-da9e-4aa0-8a52-39c1f5761151", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw2:RqtmZPuutfbltZFBSJsBcfDSTFI+BE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121517, "uuid": "2aff41e6-46f5-4c4d-8da1-bac0496ab748", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121517, "uuid": "07e0ac85-738d-4520-9133-6ecd464b8429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121517, "uuid": "dd503555-f4cb-4586-9521-e6ac250b182d", "value": "fb2fbc5fa948224ab3ac16e7bb51107b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6ec710-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704131239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131239, "uuid": "01118928-f789-493c-966a-ab9c08c24ea4", "comment": "Malware payload (RedLineStealer)", "value": "11b3e483e9a0937c1076c092a16452ac", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131239, "uuid": "91de16f6-f3d1-42f2-91b1-98d7c53a6326", "comment": "Malware payload (RedLineStealer)", "value": "952ed9e258ca3af11547c77a5949b36c3497f75177c1d9a819516ef6c923fa9e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131239, "uuid": "2621bd1f-5976-4d15-9303-a465b208fb84", "comment": "Malware payload (RedLineStealer)", "value": "8dcd63ace8097a80e9d7250e023057bd39d757a5", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131239, "uuid": "e5343217-2a76-4c8f-825c-a89f7f037096", "comment": "Malware payload (RedLineStealer)", "value": "7e04862ba477e1c34d8c9effd3cd7f8f988b6b3e99c61012d563a383cb332dad997b53c894209dd9259767050d266f64", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131239, "uuid": "237bc231-323e-4832-b520-b731f546e68e", "value": "T16E84F14B739A8212D5A5127AC1D3553403F39B8B3673DBC97C4512DE2F23BDA8E42B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131239, "uuid": "54fd8ea4-f621-4cc4-bc6a-71ceebeb65f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131239, "uuid": "d36bbb5d-b4ef-4f2e-a505-119682074e47", "value": "12288:qOOMZVcSRGVs5D8CJl1X70FjRFNBtdi6rmj:l5GVs54C71rujG6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131239, "uuid": "3ae8b90a-2e9a-474a-b4ae-bf9c142400ee", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131239, "uuid": "5f436c53-ac11-40e2-96fb-f1cd0d71369a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131239, "uuid": "123b489e-5f8a-4469-8677-294dd07cd4b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106f819b-a8ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704117604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117604, "uuid": "03e5c58a-8800-4d3a-b880-b9558a22354c", "comment": "Malware payload (Mirai)", "value": "38036387799c1e2a53dcec350758e00d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117604, "uuid": "8bdf3ee3-5b44-46f2-a58d-cee8ee541b84", "comment": "Malware payload (Mirai)", "value": "96343e0a497957effebc3e8ad220f990aee579324aeb61d67b577f3d7feec21f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117604, "uuid": "922972ee-43a2-4a0e-bfb4-14fb34df6381", "comment": "Malware payload (Mirai)", "value": "c7049b79eea4798a2a3da22c3ef16b15920c3b6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117604, "uuid": "548d0253-7738-4522-bc98-473ccadbc0dd", "comment": "Malware payload (Mirai)", "value": "f6ebcf60c7d41aafa4a4022d607e76fb55b0c79ec9464cf2857da3497006bceaf0c06ad739cf0a92861631771df5223a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117604, "uuid": "afc6d3d4-acef-40b5-99c3-63d92a86d5c9", "value": "T1BEA2E015BF1886CBC832693451E9EAD21293FC72F2DDDC492540C16FF4A33A96474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117604, "uuid": "134831ff-188e-4fa8-95ce-881b2fd76ff3", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKK:798o08kxofBE+ZkXaqGbp2F2TWul0c5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704117604, "uuid": "697aa7f9-b29d-405c-a237-fb299e2ec138", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704117604, "uuid": "d901ae87-a48c-48f5-81fa-4aa6043ad2af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117604, "uuid": "12e7ba78-5c65-48a6-b40a-846a8ce371ed", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed30d01-a8a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704112824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112824, "uuid": "4702f0e0-50a1-48bd-8303-a0738642a5df", "comment": "Malware payload (Mirai)", "value": "76eb3cbd5d90114a36a132cf51355c7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112824, "uuid": "caa7c81a-2e63-413f-9f22-25561f6283b5", "comment": "Malware payload (Mirai)", "value": "9d441299226de1bf8e922f1e44cfd9c6637496a4a7d3125104bf1f3a8fc2c1bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112824, "uuid": "ea11184a-c4e4-4190-8b1a-bb3980847b74", "comment": "Malware payload (Mirai)", "value": "7b03123063420ac5c3da704c9011f51357f6269c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112824, "uuid": "1fc61493-7002-4eef-9748-95d7eb32653e", "comment": "Malware payload (Mirai)", "value": "1747d1399a7365a1b5d16524f7869744d306915567ca421bd6f5dfc76c3f3845f07b058cc3fcb07ef76b1d48544ef089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112824, "uuid": "7fcd7095-d6be-4fe9-955d-d79ed4b62dec", "value": "T13C73D64A6E218FEDF26CC33447B74A31A36923D527E19785E39CD6102F7024D586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112824, "uuid": "b505a0ac-7ee4-466f-a474-a8a969f45ac5", "value": "1536:KjESmzZ3KMYJ/MUtR3GRxsGRFgN3tlS2kxOEelxVa1eZqL:hSGJiJ/P9lSjxMCeQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704112824, "uuid": "ff799653-9f30-421a-bc1f-fda65fa57549", "value": 76716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704112824, "uuid": "a857ee5f-2829-4b1b-9631-1754e469e7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112824, "uuid": "8b2eb52e-5caf-44b7-8532-387791d7e6b4", "value": "76eb3cbd5d90114a36a132cf51355c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91d6482-a89b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704109807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109807, "uuid": "7ffa3980-a32f-4a59-8e4b-a3dd67ae60d8", "comment": "Malware payload (Mirai)", "value": "1845638fb146bffa33216e143c38d356", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109807, "uuid": "1f994f3d-1e50-4045-b416-bd59fdd1c125", "comment": "Malware payload (Mirai)", "value": "9ec76f69f824dd8785fe3ad28f018c2bcfbe489a6c22bf170a04c98793f3a8ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109807, "uuid": "c3807c3b-b2ba-4603-9aff-ed01c1c04d89", "comment": "Malware payload (Mirai)", "value": "0bcbdb929a5fea0a08702aa3eecf7af92bb50460", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109807, "uuid": "82e7e6f9-dbcc-447f-b863-4b978989fc98", "comment": "Malware payload (Mirai)", "value": "370d0a7c9f16e9ef1f45bc0db196b05bb638635189fa3f5aa38f07d5383ea2539b153c63d899bccaee9adbfa40fdf5c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109807, "uuid": "16030d48-fc8b-41c3-a4a0-440d048b163c", "value": "T1E3733981BC815A13C6D112BBFB2E428D772653ACD2EF7207DD21AF20378A92B0D77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109807, "uuid": "86529ab6-8a67-4944-9aba-d9f531308339", "value": "1536:fRitrfXZDcaUDfQQ6RgH4LXvE3EqPvTIGYkK31oPv23mD:pitxwfGRgH4LXvE3EqjvpT22D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704109807, "uuid": "89061d40-6d2a-409c-882f-4de475294034", "value": 79204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704109807, "uuid": "dad612ff-fca8-457e-97cc-8246cae627da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109807, "uuid": "d5213ee9-2d21-49d1-80e9-b281b2e63d06", "value": "telarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adfdc0e-a874-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704092711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092711, "uuid": "5c1f84b4-776e-4251-976c-349eab25fc07", "comment": "Malware payload (DCRat)", "value": "a27231c997680ed04bd67255df13a244", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092711, "uuid": "c78c0258-a840-4871-a0e6-e0bf09651941", "comment": "Malware payload (DCRat)", "value": "a057dce421f954cd0f7a88bb09a9475526290d702f62fe137a4e07bbc1385592", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092711, "uuid": "c3dd6036-f6af-46cb-8de9-a09cc79a0257", "comment": "Malware payload (DCRat)", "value": "735e6ceaeb3c60ed2c840322c14f681b5fa51b08", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704092711, "uuid": "76bf6a16-7f0d-452d-b381-d4d10881224a", "comment": "Malware payload (DCRat)", "value": "bb89389065ef9fe47ff5bf2331fe00dffd9f2a0c5c4f9bffbdf0df44288eb69bf99fea2def6843b5e918861fea1ff991", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092711, "uuid": "d63cab1b-515a-494f-aa26-ef44d8c5a10b", "value": "T17985AF07A5568E37C2667F7588EB091DC2E0D6727592EF0B362F18E1780A2319E172F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092711, "uuid": "2a4c0675-89b1-4366-b7b8-9fcad006b0d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092711, "uuid": "32d3265f-58e4-4a35-aab8-651710912316", "value": "24576:rQa+rRep38knZGbO4oFya8ZbRxaiXvnEc3Suvb7sNPwEFfTPCRi4Vz:rZ+rRe3zn4ioa8ZbRMiXO07sNPwERWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704092711, "uuid": "2b33983c-ffc7-476a-a286-fbca74482c63", "value": 1813256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704092711, "uuid": "782c5fe9-c06b-4782-a8ba-afb949037e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704092711, "uuid": "914ee778-490a-4ea2-9396-ec24a49f0d4a", "value": "A27231C997680ED04BD67255DF13A244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34db56e9-a890-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704104781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104781, "uuid": "00ab4a10-f84e-4bfd-bed7-13bdb41cd8eb", "comment": "Malware payload (AgentTesla)", "value": "3de4b89343422e86d998967aecabe73f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104781, "uuid": "990f6827-5365-45c1-9676-d2befc29632e", "comment": "Malware payload (AgentTesla)", "value": "a0be269fb06d62df3d7cd9214a4bae3bee6f5a93b2ff11422b26c5201c6bbc24", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104781, "uuid": "71443059-1fe1-41d8-99d5-948b25950447", "comment": "Malware payload (AgentTesla)", "value": "6faf67792009146a406e515f33096e2821a46f5b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104781, "uuid": "249a5b0c-0ee4-4c28-8257-f2e450fd8e5a", "comment": "Malware payload (AgentTesla)", "value": "db227383a343c60ad8eed32d7b15ecc9dba26dec28dec669115bfda6345789694d4bea119f0e2a4408359f00c31f8768", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704104781, "uuid": "9262e2ac-b59c-4c42-97e1-07c98ca9a04b", "value": "T10EC423AFC339D951746854762968F88C1C22F3043A74066D394B47EEB8D69DA39433BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704104781, "uuid": "0e077653-8772-4480-98c9-999d65dd69eb", "value": "12288:4X1o0gVkjaD+vw6/C3XNK4Gqejf9To7e5fv8nEIzo6UK:ao0aMw6/gXNFGPjFTtk3oXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704104781, "uuid": "394c2c1b-4411-4a8a-9b76-3d8a75caec2b", "value": 592092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704104781, "uuid": "74c6e4ef-ef08-4869-a41a-d7a4bd40cb98", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704104781, "uuid": "db2bdb2f-d292-498d-abb9-afd03e0bea81", "value": "Balance payment copy.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e751c758-a89b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704109804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109804, "uuid": "b4261800-80a0-4bdb-95a9-65b012432bb5", "comment": "Malware payload (Mirai)", "value": "b05942206d1d681aa46de7d5a85a7691", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109804, "uuid": "7aa3b860-17c6-4b1b-aeb6-713907e61e2f", "comment": "Malware payload (Mirai)", "value": "a13e0cd88d10bfa8f7bb89eca2ea0859f19fd1d27874b40d23ebca03406d6f40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109804, "uuid": "137ef2e3-95ff-467c-adcc-6a9155d78a9b", "comment": "Malware payload (Mirai)", "value": "1bc06c776a92fbe99b3366e9c0e4b165c5a09448", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704109804, "uuid": "7b1f4628-6ff8-4f64-ba1a-312c2a82ae93", "comment": "Malware payload (Mirai)", "value": "269dc7d75faba0112eff3269b79be0ce2c4fa8ce7ff64c395e7cecc70bab9640afad9537eb59c74f3a893609691ef057", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109804, "uuid": "ccbbe79b-b1e5-4cdc-bd52-901c84c4ce15", "value": "T1CFA31946B9819F12D4C621F9FAAE418933136FB9E3FA7101DD20AF6027C69DB0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109804, "uuid": "a3b0c177-0591-4481-a583-81e012123021", "value": "3072:GwDZqITQzu7OXa6XN38YUpubWkLeLyE6ZM2O:GwDizeOXa6XN38YIubleuEiM2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704109804, "uuid": "927a1830-318a-40b9-8a2e-96c045f6bacf", "value": 103196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704109804, "uuid": "92df4929-69ed-42d6-b868-a052ae25e003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704109804, "uuid": "c5d37df5-68dc-4f88-afb9-1e47f8a806a9", "value": "telarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf68b20d-a8ad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704117468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117468, "uuid": "8c90033d-754a-4455-9b7c-61f29de185ba", "comment": "Malware payload (Mirai)", "value": "2e2117b11452e62f4214db2c1d32b49c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117468, "uuid": "b80bb574-3637-4746-88fe-ee9316ccea6e", "comment": "Malware payload (Mirai)", "value": "a17fa8a28f85fbc6e48d33cc8c702e28c011c46ee12667c2ac37701ad6bf7034", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117468, "uuid": "52887102-491f-4f47-8602-0fc591b0a3b8", "comment": "Malware payload (Mirai)", "value": "81923b237033a53f8c95d453995152b73701295e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117468, "uuid": "563bc5ec-dd2a-48e3-acef-43a30c304ba5", "comment": "Malware payload (Mirai)", "value": "da65efc63ad10d4f0ca9f21781fc511175f3fca973668666a90b62c64c660ad3bd3cdcd17abcedd4531dd9cb3d676ea4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117468, "uuid": "c9164a23-8a38-45e8-bdbd-bc46c9e5f8d3", "value": "T1D613F2E5CA49C7D8F02EFC76CF2D69ED7E099742A24E6971006F82745F9724046A30A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117468, "uuid": "0b0a39d0-cd08-40b1-93c5-b68d85dd320b", "value": "768:6phrICtiuoeSax6z9dhk486W62dt3i9I+XnVigigBfbPou7XRF:6phDB8ax6r2L6W62P3iJVivgBTPoGRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704117468, "uuid": "7cfa7b6c-a965-4115-8c7f-1a4ff6a8fb7c", "value": 42884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704117468, "uuid": "c3355075-9b14-45a3-88f6-5b6bf40bede8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117468, "uuid": "d4f15681-887e-45cc-9d8a-0607aeb32ff9", "value": "popbang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bfa558-a8da-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704136514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136514, "uuid": "bd72b7bb-3379-41b9-9c22-61e1649747b9", "comment": "Malware payload", "value": "e589a961ad19060bab2f6c0263c70ee0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136514, "uuid": "3ebd696c-e14b-4751-881e-c7f301a433d6", "comment": "Malware payload", "value": "a7152dbefb9f413ba745295f5fa84b51527bc0943968f68a7164726528b4eb88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136514, "uuid": "0858bc24-1e9f-4bd9-9910-d4ae4199be52", "comment": "Malware payload", "value": "90f15285e3a92efd779e2c3a1f5f06b5a9b28219", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136514, "uuid": "7e9a99fd-2401-4f1e-b24a-a2c2e14e4666", "comment": "Malware payload", "value": "faf7e7c4961b9a1db5823bba16a938da58f2ab07368ff18eed78fe76bb590be3451b558a0f4fd7cec6a456d947ec04de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136514, "uuid": "97a04955-6bc0-44b5-83c3-947f0f1758f0", "value": "T12D3284C9263CB0BBD3823317B50BA55FC8A7593857CCA8ACF40AEDA0B95D12DC395A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136514, "uuid": "f3999525-2c15-4663-912e-a55a8609c4e0", "value": "192:RvpO9shrKGj7VlLa2bdmk5C0puTTjAZfR1d4Rs8bOS4RHrLhGU7a33PwUUXu:rOArKGj7/a2ck5C0pUijCtDU7k3PwUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704136514, "uuid": "1e01ff4f-10f2-4b73-8892-9abb67a1479c", "value": 11880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704136514, "uuid": "d1a6ffbd-c8f7-4f05-988d-6ec68b8899d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136514, "uuid": "2ba1f1b1-0c09-463c-b3f7-c5e349a1e9d0", "value": "jquery.tap.min.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70aa3dd1-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140100, "uuid": "03cbad39-0684-4591-b313-8a231901db25", "comment": "Malware payload", "value": "72d8ce07da0a5775cdde056c374bb53b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140100, "uuid": "76598526-62ff-4116-9971-210f55c2a1a2", "comment": "Malware payload", "value": "a7dda4615949be0869c3ca592b0e2eb8a598851266da3941d419114d70e1be20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140100, "uuid": "e185edc2-559c-4aab-b224-03e1c749ff59", "comment": "Malware payload", "value": "938c3f04e9c3d1e5b003786c86598c2dcb206477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140100, "uuid": "2762deab-4935-4bda-956f-7bd712566048", "comment": "Malware payload", "value": "28d5fb3752db1caa7a8639324723d038cc571558a3714528167dc0bc6a95952df8bf383283d93ca7f3838ca51a4a77a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140100, "uuid": "4079f82c-9387-4049-9ebf-b389b94e1eb2", "value": "T17C645C70A6E750E3E19855BCAC5E8F44EB3BF90A2E28342E77F97D66C83D790B510106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140100, "uuid": "6a3eeb43-6965-458a-9e59-7e54df9e3333", "value": "3072:rl3wnigWX+zqZB0SbTojludESbYr1AYKQG3o/wohX3NeK0yBzBcdAnDqB6C1TTzb:x89WuGZB0WTojl2Exr1A0tc4QYChPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140100, "uuid": "c55a2fd3-c203-4a71-8333-5382c091c211", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140100, "uuid": "4136162d-1c5d-407c-b7a5-6bf83096556d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140100, "uuid": "e99d6151-7df9-4c4e-95dd-f79142053c54", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.16368.29895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267d20b1-a8db-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704136969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136969, "uuid": "a1ae5bf0-fe79-4f4a-8dad-696db836a1c2", "comment": "Malware payload", "value": "24563d2a7acf612b7f772ac47109071e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136969, "uuid": "ab0889d5-d3a8-479e-bf1f-b499f461d191", "comment": "Malware payload", "value": "a8e53467c74885365a058ed7db191d50284b3e983c65bc69287927763d4301a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136969, "uuid": "ab8cdebf-11a0-44fe-98f5-45e4e61c8135", "comment": "Malware payload", "value": "80721ab7f1d28494997518abb3d8e54f6eda1b74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704136969, "uuid": "8c471d70-6137-4009-b3e5-7db8f36cb0ef", "comment": "Malware payload", "value": "5e865e76283afde6666863c44537f316c6043f95101d5e8f209bbd497b5f8f81048f111530cc33243e942e85720eb173", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136969, "uuid": "977d1184-931c-4add-a82c-3796d9dd71c8", "value": "T17FC523D033491D95D35C9E34502253F3BFF4AE4192D26A6038A41AEFDE20AF29D3E766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136969, "uuid": "92955d74-4e6d-4d33-9233-6faf57ed3de6", "value": "8c243590689fe8446ca0cd95c1f646db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136969, "uuid": "e766fba9-547f-4af0-b3cc-84977a2e0f28", "value": "49152:IAlXAK4m2iWyeRGVt2JNYrWdzzBynspVMZ3mus3/yjRF75jJ55MCsCYJ:IABAK4mWRRGb2JNYuzzByn+M3musEjzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704136969, "uuid": "c0ae71ce-5a09-401b-97d5-839035dd5493", "value": 2629632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704136969, "uuid": "4e983e3b-f0d0-4c26-b9f0-ca66c407a58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704136969, "uuid": "fb374a9b-7408-4a29-8c9a-3d3986278e0c", "value": "aclui.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b00997-a8a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113184, "uuid": "995f0837-4165-46fe-ba11-734a6d0f0b48", "comment": "Malware payload (Mirai)", "value": "5f7e877cb1b8a0dd769873b3ca4326c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113184, "uuid": "cf5aff42-076a-4f93-8a41-496fc1a4a372", "comment": "Malware payload (Mirai)", "value": "ab278d1446374f355effddf15b443f3720044ee0eb88779de6c9f0dbbd817077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113184, "uuid": "6fc553cf-5675-44ea-a3bb-3862c259ab54", "comment": "Malware payload (Mirai)", "value": "331dfd28a069f0e824d5d71d64332acea32cbaec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113184, "uuid": "25e5003f-6baf-462c-86b7-46c60103c335", "comment": "Malware payload (Mirai)", "value": "2fc23c0c873fdca072fcdb68f1e95d63a6a9c8d13c0418b5b1969533b81a5f565511a8b623e84be70e7f99e53d46feca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113184, "uuid": "69c8e6bc-01b0-4e8d-8220-02850c2d7dec", "value": "T141633A81BD815A12C6D122BAFB5E428D772653A8D3EF7203DD25AF20778782B0E37751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113184, "uuid": "62868c93-a0c9-4ea1-9dd1-966e032de477", "value": "1536:PiwRNuH5KU245CMzAdbswVrnor8yMGqrEhk957+:PiwzJEvz8bswVrorsrhz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113184, "uuid": "2e164e79-e17a-43c5-a326-7ee54ed621e9", "value": 71048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113184, "uuid": "a3e618ff-823f-410b-bb78-a8a27babef2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113184, "uuid": "598d3633-ea22-4dd3-b9be-d17fecbd398e", "value": "5f7e877cb1b8a0dd769873b3ca4326c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cce16f-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121799, "uuid": "d8d05910-3bfb-44e4-afd6-f8e8742072ee", "comment": "Malware payload (Mirai)", "value": "07a6a2ac5b1f05079c739df041c6e0fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121799, "uuid": "504fb9c0-4fdf-4008-b472-bbf6a0159869", "comment": "Malware payload (Mirai)", "value": "abb770269c81132c7a5349e7a6e3e378d929d72a9feb888685d0e10af983a7cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121799, "uuid": "ed53bd10-02a1-4abc-9c36-82561f592b95", "comment": "Malware payload (Mirai)", "value": "0e94567948b287fd64e1162668bc194c8260d9af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121799, "uuid": "c84e6173-94ce-4d99-aad9-1dd73e22ad68", "comment": "Malware payload (Mirai)", "value": "1d6402aa8092e3d3f0ec78cc5644f327e61c50fcec2cce55f8f76b61d6a5424bff1ab5689346fb82948eda69caabcd3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121799, "uuid": "a1732518-8202-425e-b29b-a6b367519bda", "value": "T18CF34B07B5C18CFDC899C1B44B9EB536DD31F59C0238B26B27D4EB262E5EE215A2DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121799, "uuid": "59064756-c9f6-4158-ae8d-31ebbc5a09f1", "value": "3072:YeDXnAEnUKR3iKAoFBAWZpOnDBxqio/D9Lu9SBlZkVO:YeDXnAEnUczakYifK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121799, "uuid": "982824e6-e59d-473e-bddb-dbbcd2150097", "value": 160216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121799, "uuid": "67d1a929-b3e5-425f-bda0-e3640e115537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121799, "uuid": "e77bdbf2-9e36-4997-aea6-fcd899b19a9f", "value": "skyljne.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae62a8f-a846-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704073196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704073196, "uuid": "199dc367-3dee-49fe-b2b6-fbc7db28a6c7", "comment": "Malware payload", "value": "708ad1508c8e7a40520c5c8bee7f32be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704073196, "uuid": "eed226f8-fd2d-4e98-b574-7bc9092c7bc8", "comment": "Malware payload", "value": "b3119dc4cea05bef51d1f373b87d69bcff514f6575d4c92da4b1c557f8d8db8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704073196, "uuid": "9267fc23-9511-46e6-8c43-d9b36f6a7e1e", "comment": "Malware payload", "value": "c17c7c8db1ec0c2d7e85d570267239ddcf5c5073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704073196, "uuid": "d1a3823d-f35b-432d-b34b-a202c8c52ee7", "comment": "Malware payload", "value": "dc9be4da23def05277d7af4ed39d1e784b106a0c9f616b7344f2d6107eef966beb23c4a51d468b5674843bac2342ee51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704073196, "uuid": "53ba33c9-cba4-464a-8dc4-983440837c07", "value": "T1522301993BD24A8FF0AF5035B9FB0AE74999B0386E9467E581F723990C74724DD02833", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704073196, "uuid": "0d2a1f01-9505-427c-979c-45172e5b082d", "value": "5a757cedf03930b945cf2435af0c6f5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704073196, "uuid": "efb9242d-500e-499f-8315-eaaa2c6c5880", "value": "768:uI0+FNeQT1ok/ILtq2FV5AY6t+ayph/bAUn26wriTJogrIyP85P85jaZV9VYnsQB:uI0eMCoHFVet+phX7lBF85EAaM1n10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704073196, "uuid": "60d7da7c-6fba-4738-b09a-bf226f731f84", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704073196, "uuid": "d40e5ebf-7c51-4d59-80c1-92c6122908bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704073196, "uuid": "69b6e205-7f2c-460e-bd9f-3a2d0ccdbb32", "value": "Sql0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1773cc-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704131180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131180, "uuid": "be03faf1-e1d4-498b-b302-dc5113699ee4", "comment": "Malware payload (Socks5Systemz)", "value": "b4eee55a064a07c81b6e664f80dc1239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131180, "uuid": "707bd8fb-5a29-400d-abee-da2cd0f03ce6", "comment": "Malware payload (Socks5Systemz)", "value": "b3926eda14e10469587385cceea81e13e27510bb9ed3a4e278b12acdb3dc084b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131180, "uuid": "fec166ae-4638-4b93-9d5c-791252b4c92f", "comment": "Malware payload (Socks5Systemz)", "value": "f413a9f1dc1862f40cce88e86382fd62022f2a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131180, "uuid": "c690f20b-a71a-49b3-bd12-29b7d724d81b", "comment": "Malware payload (Socks5Systemz)", "value": "cad4cd49c8713bf5640fbd69a56dcf137482b0eeb27b4ef37e609f490aa2814324b051618dc73ca829e8d92ed5b9120a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131180, "uuid": "c491c7d6-3076-4a73-b340-a196a92ba5ec", "value": "T1FB26335493E19C7AD4E5D4BB787BC83DA343A0220FF04553D8ED98186FB3B616A8B742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131180, "uuid": "c7c17fe5-8491-4a31-9af4-9eeff3cabd51", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131180, "uuid": "aed47b80-94f6-4bde-b063-5d06f341f576", "value": "98304:Q/vwNMoY6UMxJWSk/HA789Dpcq+1RBMjbS+yk0Jik0YzAKB4dm8:GwaoY/cWSk/b9DpggnSs0B0Yzp4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131180, "uuid": "ee4ac108-61e3-4ce6-b9e8-f673c6864019", "value": 4785970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131180, "uuid": "b5225aca-69ab-4d12-8542-c47415019504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131180, "uuid": "0ced81cb-d589-487a-8014-7bf5bc28787e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d397cda-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1704131155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "4957018f-c22f-460c-ba1b-c1f4e2679f5d", "comment": "Malware payload (Phorpiex)", "value": "8d9e7695b942e570f84564345d736762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "0f996e32-de97-460b-b651-af48ff5329a0", "comment": "Malware payload (Phorpiex)", "value": "b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "c62205f3-4808-40f0-a0db-68ecb0bcdd47", "comment": "Malware payload (Phorpiex)", "value": "e16022d7b4a5051c4bff6f8f23cf29ab0811c845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131155, "uuid": "d41569ca-ffff-465f-b620-3afb96e3b37a", "comment": "Malware payload (Phorpiex)", "value": "071e0ab938c6b1a6bdc11eb589d8452080780ae0ed4468592d9f7c6ef86d00bb4d27ce26aa5423b6a6f09daea6ad5cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "90df1c1c-61ea-4bbc-845f-08b8480042a7", "value": "T1B683F740F280803BE0F28ABFEEFEA6951A1C9FB4134594D3F2B164DE56746C6B639453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "c5d49d29-659a-4871-9f25-b74bed4b1c6e", "value": "2ffdf0a1519d1adada787fd4df5a5fec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "6dc4723d-2b97-4a93-8de5-28fc0b32ad44", "value": "1536:P3Mz85SRJP1sW7jeWkfp52S2QyS9QafFFUheeeeeeeeWeeeee:kw5gPiOjeDxb2QyS9QafFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131155, "uuid": "896c9454-f934-4f99-bb0e-7bc348c8e73e", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131155, "uuid": "091a9c6e-463d-47c4-962c-821408d2f0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131155, "uuid": "3cfa0034-06ba-4cb5-8cde-a7461714a338", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a41b98f-a8eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704144008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704144008, "uuid": "b8b8e21a-1fff-45bd-aea9-3d54b4001d7a", "comment": "Malware payload (RedLineStealer)", "value": "0aca7207b62d5c602107a6a50661dc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704144008, "uuid": "07db15bd-49cd-42df-9149-738b890fdfd8", "comment": "Malware payload (RedLineStealer)", "value": "b62a82b6e80e1aeac41958829ca5b03217be8cb4b574a8c47c5c3617fd3306b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704144008, "uuid": "1e5ad0b3-a9e0-4287-9fa4-91a04cdc80fa", "comment": "Malware payload (RedLineStealer)", "value": "437b742b8e4cb72f6c4d2453c6cd63e2a4c2315b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704144008, "uuid": "c87f82f8-aa31-4a2f-8af9-0396277a9038", "comment": "Malware payload (RedLineStealer)", "value": "91c9a63b5d998ee6b07c5859edd2335000c4f35c61f393e4cb8050ca5580d41dcd542173ae89551f28ff951558ee2d60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704144008, "uuid": "b9a50c0a-372a-442a-a80e-9a9dc48f96e5", "value": "T117748E1867E8C922F27E07B591F1D2B59374EC13A512E32B5ED42CB73D22750EB016BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704144008, "uuid": "64aadc32-369b-4128-aa01-eda0fd148ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704144008, "uuid": "12226025-f463-44a7-9738-37bee6e01143", "value": "6144:ukbsln1btxLYAXVMRqT6D4wLMyCmQlQ4Ok2:q1bjFMsW8wYyXQC4t2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704144008, "uuid": "2484dd2b-5447-452b-addb-db2ab3f2cdef", "value": 357200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704144008, "uuid": "a7f75839-9603-4361-9a05-e8580d408094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704144008, "uuid": "faf8a423-92fe-41ea-ad01-6a2b54fd76ab", "value": "0aca7207b62d5c602107a6a50661dc09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45a7d87-a8a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704112806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112806, "uuid": "318d3f0f-20bd-46ed-8836-89767b2b6057", "comment": "Malware payload", "value": "f0fd66dca501c92238e154273d029ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112806, "uuid": "98a928d2-5b9d-4029-ad16-7e77ac008863", "comment": "Malware payload", "value": "bd133209aa4e09f521377bc1a6d9f8dd2ac6c59e599eaa9dc5d7db62c4a2c17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112806, "uuid": "68037ac9-6c30-4f94-b09b-c3874b2a44ce", "comment": "Malware payload", "value": "a90406e5fafcf5c750f88ff40cdecca7c67064b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704112806, "uuid": "8aeae12a-cb1c-4397-bbfb-7491fd42af05", "comment": "Malware payload", "value": "952df456cb25b5a991590679462a5bc74bc34fbbaa7f7407e72ba7beebf2ed7b60f34bbb398e79969a6194538231ceeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112806, "uuid": "4d826ebf-c64d-4782-983e-428cbf7147b9", "value": "T14293E91E6E218FADF769833447B78E31A75933C627E1D646E25CD6001E6038E581FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112806, "uuid": "33a8999b-770f-4405-b1f2-8c0cf9c88b26", "value": "1536:Ihej5azwka/QqY+6WLuW6ruWybwCgnocav8em1kVqtdyB+:ImiWIqYJCgn9avidyB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704112806, "uuid": "972c7922-da74-4fa2-8b49-e8da1dbade81", "value": 93056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704112806, "uuid": "eda538f4-e6b4-4b9b-b664-4fea857b9ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704112806, "uuid": "8578db3b-58ec-41c0-8c37-5e726179e1bf", "value": "f0fd66dca501c92238e154273d029ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e35a9e-a8ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704117608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117608, "uuid": "b237d721-f24e-4d0f-b6c9-950099c9f495", "comment": "Malware payload (Mirai)", "value": "13416dfec5af905ff7b56bbb3a0b79b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117608, "uuid": "0be3e466-359a-49cf-82db-4d40b61e245a", "comment": "Malware payload (Mirai)", "value": "be19eded4943fb573f85d1a2081292784641bd15b6eb0203c598da8bc6b4af87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117608, "uuid": "b27202ff-5e1d-41dc-97f6-fb9d8f10f770", "comment": "Malware payload (Mirai)", "value": "bb064aeb8401970e38266872220bd5b073cc9582", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117608, "uuid": "3f5dd68b-3332-4d71-932b-812ef8cc0d65", "comment": "Malware payload (Mirai)", "value": "0d96b789e9327ae296ad19dda8017f1bf9beaeecbf0e7f21a38cee195f82cdcf8f0adb57eb05206860104ef0a272ca3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117608, "uuid": "ff9ae11d-6ba1-4771-a1c0-50e317415862", "value": "T132A2D11472A32D95E3ED1C3DC96E835BF9A70BFC80F6327569445620C94920A3E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117608, "uuid": "62dd7880-5924-4a2b-803e-bc8b85138bd3", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjQ7+hymdGUop5hE:vvQn4j+ZO5fKAlxM7+s3Uoz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704117608, "uuid": "4844c521-7783-49ef-8c2d-c19872dcf4aa", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704117608, "uuid": "7c261fa9-89d1-49ea-86d1-cbcf43ee1eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117608, "uuid": "4bfbd705-c85b-4991-9bf6-a935c38a32b3", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8feacb-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121812, "uuid": "9a6ad55d-8eca-4e4b-99de-a584098e0d28", "comment": "Malware payload (Mirai)", "value": "ddcb6f54618cd8aa26756eaae057798b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121812, "uuid": "a39dc556-1e75-43f4-85c6-8b988c85a338", "comment": "Malware payload (Mirai)", "value": "beac5e5f1f0b8735f4937d9ebd0fbbb67dc1ab90ce4a09f0afbccda98820e600", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121812, "uuid": "17db4094-d554-4330-9872-76f0db814470", "comment": "Malware payload (Mirai)", "value": "d321c97588cf7c4fd9a773b83c79b132d41d865c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121812, "uuid": "bb1692af-ab38-4665-a369-74b8b8403cee", "comment": "Malware payload (Mirai)", "value": "f933b8e9298bf170d199f4416d80f29f6e121abea030f6a72ded5027df2b0b5b145de4072a1cc43ad06c904dce88556c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121812, "uuid": "85b493e9-5608-4efd-b51e-2ed18ff0a5ec", "value": "T198F31A56F8819B11D5C311BAFE1E028E37131B78E3DE72029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121812, "uuid": "67915015-d81d-4fc8-87df-468d8759ab8d", "value": "3072:pkHg/4HiULW/oYXj23Twtamz5CDb/fkCjVX8RXI+Iv:iHg9EjYXi3TYaGeAyVX8RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121812, "uuid": "fcf62da8-ddd4-4f9e-9531-5f05fe3d0f7a", "value": 160668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121812, "uuid": "0860cc4f-fa3e-4100-b6c3-affe2f20e6a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121812, "uuid": "8cbb2740-82f0-4be8-bcf9-bf1147c43a54", "value": "skyljne.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cee9f6-a8b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1704120778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704120778, "uuid": "40e12e8a-dd15-49da-bd67-77e61dfd027a", "comment": "Malware payload (Rhadamanthys)", "value": "c21281219a116c1b1f7252dea64a727c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704120778, "uuid": "f301fc61-6f93-4786-843d-967b8825ff86", "comment": "Malware payload (Rhadamanthys)", "value": "bf08bc7a3d6d63ad432afa395ad885537b8a6fc35afdabb63fe414aa14bb1a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704120778, "uuid": "5c2f183e-a37e-442f-92cf-052a1d8b7c60", "comment": "Malware payload (Rhadamanthys)", "value": "99ae99a445978b28fd3e1f7786aa0a63b8aa38cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704120778, "uuid": "0e180297-a4ef-410d-9d13-59805f84116e", "comment": "Malware payload (Rhadamanthys)", "value": "551f226a6cdabe4120cf23ec136b73b95c7caecff0f45d0ea52076d591cc0cb2ce474d92a814cb86d6987f4c84b3e1e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704120778, "uuid": "a68a9bab-9248-42e4-a19b-b5c3c2e1c291", "value": "T155C4010675568622CA94A679C1D35D2003F3AB4B3633D7CA7D5016EA1F42FC9CE8BBC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704120778, "uuid": "52c4147c-f492-4331-84ae-972a4f6677c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704120778, "uuid": "bb501ee5-0706-43a2-9c2d-cc0865aacebc", "value": "12288:QNjnjP+KHjW3EDOxCjALNTb5Qy5C9f0skCtJ:ujpHoEBjALpbNM9f0s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704120778, "uuid": "fbb15ba1-8775-4325-8040-f5e1cd1a9e73", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704120778, "uuid": "a93050f1-9ac0-405e-ba60-5d4e0ab0b283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704120778, "uuid": "a4dd6c68-6df5-453a-a344-9946ee9390e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152c62a-a85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704082253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082253, "uuid": "3663841c-58bf-4e7e-b3e5-9c201468dde0", "comment": "Malware payload (GuLoader)", "value": "6d37f5e29d1c1f2635704bf043a58cd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082253, "uuid": "010f866c-18db-4de5-947c-54ccbabb6169", "comment": "Malware payload (GuLoader)", "value": "c45e0bc5947ac8141dce8305bf30acec32d2cee46afc64ec8a68cc6488e286fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082253, "uuid": "518718e1-8890-4bcd-b4c1-3a6ea76966a9", "comment": "Malware payload (GuLoader)", "value": "dd613aea20737f67bcc5faabd5f6f0eb3425522d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704082253, "uuid": "0ba61d36-feea-4ee4-b68d-c0f334d9626a", "comment": "Malware payload (GuLoader)", "value": "ad9e29f8e6dd12b6af9b838e67ecb1ccd4577c4136f4ef4260029169ca3b34b68f5e72b961301ef604bca7d7ad40baee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082253, "uuid": "92ce4322-4fd8-4600-a4f9-7bd8fbb1765a", "value": "T1DAB533B482F68C46C11593B4AA265B31DCCADC5C9148FFE68721FA7024BBBC5731F64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082253, "uuid": "b96f02f5-01ae-4976-92e8-302825f82d2e", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082253, "uuid": "50e4683a-67ff-43c8-866e-2781409fb22c", "value": "49152:Bl+AMxinT6x5W2ijhIlbJZ7a07xznKMj5RyXE1ID12oWBZ:BIAMxuu5W2Zm+xznKMj58aIxF6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704082253, "uuid": "f682dd35-fa76-4f44-b2e2-d494dd50a305", "value": 2320044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704082253, "uuid": "aefca9b0-07c1-4a3c-8e1f-9c332127d8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704082253, "uuid": "47ac3e2b-bea7-448f-9c75-c94af1cb0746", "value": "6d37f5e29d1c1f2635704bf043a58cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb8d093-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131263, "uuid": "1c99c93f-e44b-4b5e-a015-d37b14172124", "comment": "Malware payload", "value": "9db2d314dd3f704a02051ef5ea210993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131263, "uuid": "6c6e6860-9ab5-4c42-8c26-ae2c6c0bda38", "comment": "Malware payload", "value": "c6cf82919b809967d9d90ea73772a8aa1c1eb3bc59252d977500f64f1a0d6731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131263, "uuid": "b1a619cc-1081-470a-a011-c81234e6e41e", "comment": "Malware payload", "value": "039130337e28a6623ecf9a0a3da7d92c5964d8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131263, "uuid": "398a6339-7cef-424b-950f-f98cea8b9163", "comment": "Malware payload", "value": "89053caa99c1e8a2bb51088b7dfc7737715720c21993bb0777d77d6ffbf8af8cdb483c5735bbf9a0327f8604c536a4fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131263, "uuid": "af861fe2-5c81-4bbb-8fd9-275f4a5db481", "value": "T1B6B51823F8AA05FFC6BEF130459553217A7234A8433277C75F8456AA1A56BE4BE3E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131263, "uuid": "3d52ec73-77ba-468d-8960-294a89e3b227", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131263, "uuid": "7a076fb2-1e03-48f7-8b3a-5cfed174af56", "value": "49152:rPxfoRnTLWPW2szKDygg0DJ2g7X2gcIT:DxUTN2szK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131263, "uuid": "6c04ff61-06cb-4a3b-b7f7-c28aaf51b893", "value": 2396160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131263, "uuid": "7be730f3-1f9d-4dd9-ab10-b39a1336b1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131263, "uuid": "f0ee7d24-a68c-4769-b147-32f00d022bc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2982cce-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121822, "uuid": "df86c569-01b2-4692-b3ec-b5263ea3dcb0", "comment": "Malware payload (Mirai)", "value": "1427ce479062518133adeab79a325ec7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121822, "uuid": "9eead37c-f76f-4f38-aacd-6ae4ad6c586f", "comment": "Malware payload (Mirai)", "value": "c84313e450493e3197f551abd5dc491a61c2f18f3ab484f20a712b12ccfcdb8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121822, "uuid": "0976e38b-c699-4ec8-af16-010cdf688fab", "comment": "Malware payload (Mirai)", "value": "9139976d382d48af629c2471d9e53da675fb65c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121822, "uuid": "1ed3bf06-261c-493b-b566-068a174b5509", "comment": "Malware payload (Mirai)", "value": "ded9758c6abca07f20149c5bf3c45c2a985c240995c62d060695863f6e264a43c1988cfda0e8cac3a23352266d3c00c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121822, "uuid": "31922162-0af7-454b-b23a-5c6c9ea8aaa9", "value": "T19B14A81E6E228F7DF268873147B74E21975C23D627E1D684E2ACD2105E6438E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121822, "uuid": "2c0198c9-4f1d-4ed0-90f2-d6378bc1133d", "value": "3072:CbwA3cVg614fMnNBUuKf/te6OdCz6WVllXIxbM:CbwF14fAalQdfWnlYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121822, "uuid": "b90e06bc-3e17-4ba0-b23d-e6e8800b855a", "value": 192528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121822, "uuid": "5f3a1550-476d-4a11-b037-e8742be0baed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121822, "uuid": "0fa91b36-e67e-465f-b922-d3769c748f01", "value": "skyljne.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba107cbb-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131203, "uuid": "cfc4fcd4-2fe9-4d99-8592-d5dc6b3f616d", "comment": "Malware payload", "value": "72545dc76931ea890c9dcd093521cc0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131203, "uuid": "d6da24fe-ca25-434a-b6e5-dd091a814122", "comment": "Malware payload", "value": "cad66abae32e9de58d1538c7a992a350661f5a7d5c4774605c75183a038c8a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131203, "uuid": "330c7f10-173c-47fb-b0b0-69a525f4fe0d", "comment": "Malware payload", "value": "16c87c3c993a395d998ce4a21d590fc6d5da479f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131203, "uuid": "81515aa6-e619-443d-a5c5-09c7cd09446a", "comment": "Malware payload", "value": "836f69f16fe6533e9056694ae7918eed9be432287971095380f9f0b02fff403e589f6098f7811c287d29b6b84392ec05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131203, "uuid": "9abdec5a-c4b6-4d94-867b-62d029b499e7", "value": "T1F7E42309ECED58EEC2DA59747BCD929AC8EAAF91E2F444123E4FC61F602B1455FF0051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131203, "uuid": "8f253081-13d0-4ab7-9eed-bcfd7c10756b", "value": "26b8d976d96d16995492f63ab9fc0efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131203, "uuid": "b3f0fef4-5ae3-4abc-b6ab-cf28cb3ff472", "value": "12288:QFXkw3F8rmsJzFnyeSu6uALDyh1RNlfaWC+hJ6rOVXy/76O4yo6A9rg:QVV61oeAkNlfa8Jd0RjoDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131203, "uuid": "59e523d3-c4e1-418b-ba34-e41bf2da1a07", "value": 694496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131203, "uuid": "d47a5e42-3a16-43dd-97a5-882713e325fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131203, "uuid": "5339e4bd-f2bc-4155-9399-2db32347d4e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb9fff2-a857-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704080554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704080554, "uuid": "a3354e77-699d-403e-afd3-0c92cced7bff", "comment": "Malware payload (Socks5Systemz)", "value": "a143e23435905aaee78cca98f920b419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704080554, "uuid": "46cc75cb-2c11-4944-8fb8-731c51389959", "comment": "Malware payload (Socks5Systemz)", "value": "cdc42d582dcfc216e12fd59853ed4d26affbc1a5615d5a578872f674272dd80f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704080554, "uuid": "abc44c90-4e8f-496a-8bdf-8e94ca87f530", "comment": "Malware payload (Socks5Systemz)", "value": "32f33d44b67f41e438dbb81568f3cc0c566318b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704080554, "uuid": "4cd8aa41-533e-40a8-8439-fa0f7e6dacf4", "comment": "Malware payload (Socks5Systemz)", "value": "a3aada108a81506352b411d9c6982a5439deb79d2f0c525d72a078f19e928676a4c889ecfa871765769a111f46efa317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704080554, "uuid": "2e6a817f-9a4b-41d5-a100-2711a5bd5ade", "value": "T1EB36339105D90972E0A2A77DF763E3184053953B4FF24977346D48498EBFCA0E26B2EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704080554, "uuid": "169ae533-881f-4ef2-995d-7b808c63c605", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704080554, "uuid": "80d88e13-4fcd-414d-b99e-0e5e409ec418", "value": "98304:Q3mosrpRSHF9xN7hSYSmNNgl0+LP0d6UdDkXUymC5TBJvMwMgiCDhokKvk4dm8:csrpRoF9DXJNN6bL05ZkX9mC11Mhs9Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704080554, "uuid": "924dc1ab-5aed-4f43-92fc-029cce01ee1b", "value": 4877011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704080554, "uuid": "8a814e88-d871-4d01-a3cb-1239bfa92ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704080554, "uuid": "259c514e-b0f6-4387-ab60-8df55a51d3f6", "value": "SecuriteInfo.com.FileRepMalware.17033.29620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a298413b-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131164, "uuid": "49e698e2-a755-42fe-abf3-4c1284552330", "comment": "Malware payload", "value": "d7aa0e55d837860e507acb3f4602e44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131164, "uuid": "c15fba70-4afa-4322-becd-e85da9e3160f", "comment": "Malware payload", "value": "ce1f3e928a5d4354494851b835fc7c879a54fcfc58ab77cc278a54c9b8d9b3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131164, "uuid": "35e3fbe7-2fe4-4f36-9808-2e21ea661ac4", "comment": "Malware payload", "value": "324bfdf963fc91073aa66db4b3a016e9005fb474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131164, "uuid": "4840d99d-0cc7-40ca-9bf4-21e523f81857", "comment": "Malware payload", "value": "ea7e7a3b430f0692427ca93ddbf738f1f8bad011b74db4c49addcb124ff7d4f0393e25e185d1cf635ed4890cd3a74c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131164, "uuid": "d649a6b7-2390-4a25-8231-bf8cf012fff7", "value": "T16556334A7EC4169CCA58D8380293EF7CB4F1EEB096500D5DA9F8668B6FF3740593A847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131164, "uuid": "3dce6bb1-c66c-456f-b4be-2ae91a734779", "value": "a25e4210e15552467a253512d673291c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131164, "uuid": "51ea3efd-881a-4058-8369-4a3d9285568c", "value": "98304:Q3CgoB++Ev52OAYxeZX/vxHqOTZzPMY5blbNzh2Fd1TOCULmcE7qTjk5XigDkBw:7jMn3UZr5xlBtaHTEoY2DkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131164, "uuid": "4ad956d2-8a01-4f66-85d1-59cd8f9c5cc0", "value": 6089632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131164, "uuid": "2ef5bc5a-f335-4468-9a2b-8756a79b16cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131164, "uuid": "34522d81-0719-4191-89b6-73456e9ecbbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74398028-a8e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704140106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140106, "uuid": "09858f65-a04b-4944-b88d-2ceef63ec9ec", "comment": "Malware payload", "value": "8465b551fc60467fc4cbc97545aaf38a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140106, "uuid": "b641b646-86ee-42fb-abdd-7a4d86863695", "comment": "Malware payload", "value": "cecd6300d3b206bfef3ce3d6bc4f658c930df6f9150e6ba78dc902c586868bb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140106, "uuid": "dad365a3-29cd-4810-b02b-373e51c95151", "comment": "Malware payload", "value": "7793db9af02e03c948ace28718df382e6379c587", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704140106, "uuid": "62caa309-dae6-44a8-b1a3-8dbb920b4546", "comment": "Malware payload", "value": "68e1f9c12556eed8f9ee2c8f0fd36988ec6730418de04eaecf48bfc63c917d02a2e7945e2963f6337566eaa735666e4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140106, "uuid": "aba97bd8-ab09-4998-a1df-80be0f9a6967", "value": "T12B645B0A3F55D8A3D01B4931089387D47A79A4333EA286476B7A937D9C733D11AB32F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140106, "uuid": "3c31b968-97db-4cb3-9036-ec8b4c52d388", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140106, "uuid": "50b52bc8-3b68-4d70-8557-85ae1e649ddc", "value": "6144:+RR5rhZFQGrsUwF7vlPoSVd7J2tsUl047NoptzSzFG:+R5nWFpPoS3t2+jiFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704140106, "uuid": "bdc4ddf5-f8c2-4151-b112-7c5b8a156806", "value": 321976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704140106, "uuid": "5e5be2d0-2a77-473f-bdad-c03224f90855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704140106, "uuid": "f336c51d-eb1a-4924-90a0-76b620c6c718", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.5750.7761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1e77da-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131156, "uuid": "e1eeed8e-5215-4aef-811d-29e535ca0448", "comment": "Malware payload", "value": "261e666ba24df464b5a604637c6a50ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131156, "uuid": "0f6ffd2a-7a11-4d10-bf5b-f660f3e66f16", "comment": "Malware payload", "value": "cff57eb324f603b69429380de8cb79ae9e56526f0bcb369fe727b733079f08bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131156, "uuid": "f179ee0d-04b6-4205-8cb4-41a63fe0ac0c", "comment": "Malware payload", "value": "57bd0bdb879c54e0cbc835be142555f02b7e3328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131156, "uuid": "1b9df779-41a5-4cbf-85f6-2b95cbe5dd4d", "comment": "Malware payload", "value": "4c8916c8cf97aab80c5c03d6f80a2eeb4d859020c49858b3d9141d5b5f3ea8604861a7cfdfe3cd278de4725bea64a5b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131156, "uuid": "cb863e95-1a01-4738-a869-0dd926d9f3c0", "value": "T1C82633A3C4F38E31E1D20E71B90A6D626E72BC0E107159D07F5DBC4B7A8A415A74A3DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131156, "uuid": "da573ef8-4474-4491-af69-20237d47ac73", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131156, "uuid": "bc29f533-fa62-410d-bd23-f582ca4a9ce3", "value": "98304:QXFXiVsAf3VXHc9BEJ6Gsv2SQ3E3VqcQIqRMZhm3hDd96JZGX4dm8:sUsAf3VX0BEJ6dv1Q2VqBIqRgWZ96fqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131156, "uuid": "769aa9c5-53db-4180-b901-2e819bdcaeea", "value": 4781865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131156, "uuid": "bcc6339d-8d75-4626-a864-24403143f499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131156, "uuid": "c647658a-33a6-497f-834e-179cae7464d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c5e45d-a8ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704117607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117607, "uuid": "0195a0da-57d2-4335-a258-79ccf5e467af", "comment": "Malware payload (Mirai)", "value": "c4dfce7cec048c3a882717ddffbc2196", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117607, "uuid": "c81e7841-5c7a-46e7-8c28-5b246ff77919", "comment": "Malware payload (Mirai)", "value": "cff626c230bfdd7ded30560a2323cf76a8a8729d9dba853f2049c12076914509", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117607, "uuid": "41544484-aeac-4669-87e4-bc54095c1024", "comment": "Malware payload (Mirai)", "value": "85c53784f31bd0ca0d72ba40fbb8947dbf509c57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704117607, "uuid": "c334ca69-c974-4161-bb1e-d780ffbbaa00", "comment": "Malware payload (Mirai)", "value": "188c6c9fd860f69bfaa691b7d068a34587cf0b2a29dd97a0ac5744dfc116235ce38c44632cc973d115e84ec05cfe9c2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117607, "uuid": "0647c764-b882-49c9-9a5b-c2cc42ddfc91", "value": "T14A230271880A9EF124303C76DED59393B6E02AB1C6673013D62C0A386FB57531D5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117607, "uuid": "5fd96310-0fc3-44be-bb88-5d6d6feb0e1e", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3N9q3UELbUXfi6nVMQHI4vcGpvo:DECFd+A6YHAxgLRQZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704117607, "uuid": "36a4f133-1be9-486a-a044-cb23570bb08b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704117607, "uuid": "549ca246-03d8-495e-bb50-df5ae449b54c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704117607, "uuid": "4daa6453-da66-415b-92be-f7c44becdac2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d11fd0d-a83d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1704069307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704069307, "uuid": "ace845b2-d0e4-49e5-bd71-f797a0897f5e", "comment": "Malware payload (njrat)", "value": "0cb02769e5b5a64409d7043f6cfbbf36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704069307, "uuid": "3f34a64b-f07f-4891-81fa-4b62d19fcded", "comment": "Malware payload (njrat)", "value": "d05b32d4c9a924d316e2dd49394ca76a51a040654a2ef84de8c30b16be2b4c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704069307, "uuid": "e20afefd-2959-4ee3-9b32-a623c790eb30", "comment": "Malware payload (njrat)", "value": "c6603e76b010609f41933b0cf0b8ca8f21ea4284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704069307, "uuid": "f233ed76-7de2-42a0-8049-60761d907a87", "comment": "Malware payload (njrat)", "value": "0abed6a7719f2750fc84f9bbe3d41ef1211352c8225b467aba30f7026e698d9f69c610b7b6e1e785cab0e66c064e6275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704069307, "uuid": "c6970daa-a665-4779-950e-d6e8f650d53e", "value": "T1BE93F84977E56524E4BF56F79871F2004E38B44B1602E39D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704069307, "uuid": "e0717dd1-bd38-49f1-8c12-ecdb720780cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704069307, "uuid": "3b266b2a-3df6-41f1-ab48-cfbe1a068d78", "value": "768:6Y3/upD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3xsG/:BuLOx6baIa9RPj00ljEwzGi1dDBDbgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704069307, "uuid": "57cc204d-05fb-462a-9e6a-ac6b1699df78", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704069307, "uuid": "fdeb8f77-527d-482a-8cbc-9cec7730652a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704069307, "uuid": "a81ba7b0-ddd3-4a24-8c4f-e70ff463d65a", "value": "0cb02769e5b5a64409d7043f6cfbbf36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047fff10-a85b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704081936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081936, "uuid": "d2ab4b55-04f1-4de6-b51d-3fe0d7b96e5f", "comment": "Malware payload", "value": "f12d41a888b7e3fd03c3c5347c6ee778", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081936, "uuid": "c25a8db9-85c5-4b62-95ce-fe105a68a09f", "comment": "Malware payload", "value": "d2d3341ddcf1ff2a33413e05391689db8b17d1666b37bd4ef8f7ae3d73ef4352", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081936, "uuid": "40f05890-5869-4998-8ca6-3b8ae4968f78", "comment": "Malware payload", "value": "e1634073c1fd3a88e65e21d19edb108b60cbdd63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704081936, "uuid": "657dff21-8a05-4bc0-8f4c-5c4c5996bfd8", "comment": "Malware payload", "value": "fd673ea1dcab8c3e12281c5b7d6438eab09e0b10ed5b3e4490ba9254722338f94e875ef81409c5b5c19ac66c1ef57bad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081936, "uuid": "ec020801-e1d6-4a26-bccd-eb386699ea1b", "value": "T17F6533BCF7C9AD4FD05906F089424231EDAFDE14B522A4E51228EAB90DF2674723D74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081936, "uuid": "361fe546-1efd-440d-9714-5a50a76c4e29", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081936, "uuid": "19e562f7-7b28-4757-8d72-e7ffa5d8d510", "value": "24576:XWljQk33d4AGvTiszKXiP5Yh8ynFNCJRkjFdOdqj1xCjBTXaUbyJhn8yePX7tEfm:Cl+AMTXyixYhxaJ2jTj1Mj5Ry7n8Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704081936, "uuid": "b6a4732f-6630-40d5-a561-8ddae25dce2c", "value": 1537500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704081936, "uuid": "f76dd4e2-dd09-4f3b-9eb5-167e3dc71d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704081936, "uuid": "0afffa2b-2945-45fd-84af-e192a275ef39", "value": "f12d41a888b7e3fd03c3c5347c6ee778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00740f0-a8a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113174, "uuid": "5a0252ef-770c-4bbe-aa48-dee0b3fbf601", "comment": "Malware payload (Mirai)", "value": "ff5691819a59765662ebaff4be024e1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113174, "uuid": "77a18356-f444-4d83-a661-f64880201b73", "comment": "Malware payload (Mirai)", "value": "d419cf35017ea1484e070327e30dd84a68e699a93921f8ccef0fd75149ea0417", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113174, "uuid": "08fd64b6-4e2b-4de6-bc00-f89f7ebb00ba", "comment": "Malware payload (Mirai)", "value": "82ea981f0482f029aad7c29774e0b3c81e256dfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113174, "uuid": "a22f138e-95af-459d-9a04-ebb6f1dc2d28", "comment": "Malware payload (Mirai)", "value": "3b4c7aa396d75e1ae23e07225d5bd329243d2e8da27aa1a3135c8d2d7b53846480c7b62f7a11d4ce29528b4a4bab0935", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113174, "uuid": "0ccecf13-5bb5-4a27-8669-560848f8387a", "value": "T1F283398BF410DD7DF80AC37B44534A06B530E3A15B836F36A75BBA67B8711981926FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113174, "uuid": "212aa457-b017-4dbf-ab84-9fc6a2138431", "value": "1536:vRlvQsu1TbxkH9JIPrb3GoK8VECP3PtqAqnwL0zX07ugnJEjNn7tKI9:vn4spJWrb3GoS8Y3wLS8JEjN7gI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113174, "uuid": "6a1058f6-eb53-4cb4-9c3a-cc8a6feeb4f3", "value": 84600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113174, "uuid": "abf6e172-60fb-4921-921e-5af453f626f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113174, "uuid": "b0c709c6-c17b-4b75-be27-d2d90f49b9d1", "value": "ff5691819a59765662ebaff4be024e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7827444a-a8f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704149991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149991, "uuid": "2feb8706-7ab0-4c79-9073-f81328227ad2", "comment": "Malware payload (Mirai)", "value": "b961607f0e90f4c74cd77de4013ea665", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149991, "uuid": "74999ccc-fc28-48f4-9bb6-d373bce59039", "comment": "Malware payload (Mirai)", "value": "d6518412256e7ffcf1533b6bc283e9de7d1f2bc8b7b6839d06fd0c76ea5e74b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149991, "uuid": "91f224cc-6b9d-4136-b7d2-72e5d76e9531", "comment": "Malware payload (Mirai)", "value": "bbd097680aca3bfb659653a06e3e0089022025f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704149991, "uuid": "4f11877c-2470-4770-ab2f-6b3a5fefd60c", "comment": "Malware payload (Mirai)", "value": "de3d417777305ff721d23f68c941fbea704838f4b135f951cd6826614dd3955a3bfc373b67596384ba4e70e51ee5ea54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704149991, "uuid": "5771f42b-54a3-4bae-a820-1c41153adcad", "value": "T194042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704149991, "uuid": "a532024f-9f28-4cb0-970e-fd67ced9330f", "value": "3072:HK/lc9NbBLbcBCkoajwdyqkk4/T/6EBpZu/hJjogM/RHWT+M:HK/GBLbEloajwdybkwRBnu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704149991, "uuid": "abec4893-f5e8-4d29-a723-a5744e040e4f", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704149991, "uuid": "8ac572fe-efdd-4bda-b396-ed1479fcca01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704149991, "uuid": "323aef31-58c2-49f0-8417-96901fbeb98e", "value": "b961607f0e90f4c74cd77de4013ea665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965777e9-a8c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704128996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704128996, "uuid": "133abe6a-5957-42d4-b867-f02a782ef7f6", "comment": "Malware payload", "value": "a021864b5776689744c3fb72d0527e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704128996, "uuid": "09aa927f-3408-42fb-a1c2-c8ad0e0d71e6", "comment": "Malware payload", "value": "d8c5a13d192bd14b689755cefac59d3f78bea05526c50b8428655ff88568fc69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704128996, "uuid": "8f860cd4-2e23-4efd-8886-921a4abedec2", "comment": "Malware payload", "value": "cbeb2725bec4814f31ca8dcfd410fba34c457b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704128996, "uuid": "1dbfa4bf-2ea5-46a8-923d-265b6be843e1", "comment": "Malware payload", "value": "c22505f2df216310d0dbc637b0ee983a5a10219eee4f50b8e3dd57ffcaa273f6bae3b8c68de742141238b6f0fd38028d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704128996, "uuid": "fb6d561e-49ac-4055-80ea-c061d48b5579", "value": "T182B733B03DAD1483E5ED04B489A388539926BC932F9FB44FC039B6E4636E6C643F5197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704128996, "uuid": "fdff9316-1f3e-4da1-87a1-790d38799b7e", "value": "e38a9988837e3e3e52892ffdac5354bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704128996, "uuid": "ebaf1ddb-c686-4f47-ad0b-745ddbfe1bac", "value": "786432:9Dx1TvsIl4IwxCmaACTGYns3JCcICz5Q3Ii5WWry8N2:9D/vHlVwxgWw2zv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704128996, "uuid": "1ea5d480-0447-4124-a56b-a1d33a702cd4", "value": 50781696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704128996, "uuid": "5fd68fd0-7f4c-4968-bf41-dbed9979ed39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704128996, "uuid": "5e83d9da-2278-4eb7-aab6-2c8391ef963a", "value": "baliksabit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74db349-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121803, "uuid": "db72011b-a3bd-47db-9b7a-89ed85d7f67e", "comment": "Malware payload (Mirai)", "value": "aab347ab835eb649c37b653ce765c1a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121803, "uuid": "2f3ef0a0-6b8f-4c98-93dd-64b060e1ea98", "comment": "Malware payload (Mirai)", "value": "e2e5cb864d68ac88688d630c05e87a8decdcaa1a18654eed1f0709b31122d062", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121803, "uuid": "cf2dc2ab-520c-4bad-ab49-da885495f79f", "comment": "Malware payload (Mirai)", "value": "e073386dbea715a5bd5084ffac63e35146a21904", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121803, "uuid": "f2901de3-d1c3-471e-ac19-f4f31988bd18", "comment": "Malware payload (Mirai)", "value": "e065cc834eadc824361c9237d488d6a5745929e0cf7cd594c4309724b849c4d75ba5dc8ee882b84c4079ec6c5b72c172", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121803, "uuid": "4c7c870d-29b8-45d2-bb97-10ddd8ac9db6", "value": "T10BA36CC0F647D4F6E8470671217FEF32AB32E4792119DB42C3BA5E32AC51452E61AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121803, "uuid": "7205beec-9de5-4bd3-8c55-69feceef4150", "value": "1536:aGop8SPwIqGk2CJIXVJLLlJdFPpEwsFVTPn6MDiVLi0nUomtSHyZ8o7oABf:hG8S9qGk2C8rdFPSph6uqLi+KEHaVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121803, "uuid": "906b3f49-4a9b-41e0-9aed-f07919fb03c4", "value": 106952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121803, "uuid": "a43961a8-7c5d-4974-94ba-4f4d175e8ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121803, "uuid": "d132eee4-e25b-4b14-b2dc-b89da057f90c", "value": "skyljne.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73603a14-a8b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704118629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118629, "uuid": "a24decd9-ff8b-4e9c-921c-3ae55d07d1e1", "comment": "Malware payload (Mirai)", "value": "03d27dce443458c28604c3f654894888", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118629, "uuid": "63481056-ebe4-4be9-a3d0-7183f2da342a", "comment": "Malware payload (Mirai)", "value": "e5e4789718c575a5585f2a1c88c97a68276faa474f067abdb9f3fdbbae174af3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118629, "uuid": "597723f1-a245-4ea9-97e3-af9719ea7c78", "comment": "Malware payload (Mirai)", "value": "3a12ecd2955b41b004ff325d5b66225a8609d406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704118629, "uuid": "37954c51-2120-47cd-a1e6-ab838faa26aa", "comment": "Malware payload (Mirai)", "value": "d4b55b4435db538cb6ad95767b01c828659feda253ad080ac2e8be02be3e54c8dbba81ea45dab6f1d53968cf0d503b3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118629, "uuid": "613804e7-ef55-4ff0-a426-7dd6bdfd1481", "value": "T13533FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118629, "uuid": "bd1c341a-8691-4532-bdc5-887ca4cb3463", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGS:r/hqaJMcjeqK806MHdMfQXoHuCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704118629, "uuid": "312f2263-7d6a-4c8b-9b47-30f2e84a5d21", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704118629, "uuid": "56de85d9-9def-4563-90c8-a0932faae6a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704118629, "uuid": "a841bacd-91a6-47dd-9768-f3aeaf5edbdb", "value": "03d27dce443458c28604c3f654894888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37209c4-a8dd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704138118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704138118, "uuid": "11fd7d62-9334-4610-b4ca-1d7204033502", "comment": "Malware payload", "value": "f1ca55e0638b3e0b130a7f59a4029bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704138118, "uuid": "f8df0475-b3a6-41d7-ba52-cba08172f6cd", "comment": "Malware payload", "value": "e675f1c52fdbe655e968f9c600760a3ac492c1193ed963b914d02954b21105fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704138118, "uuid": "edf2c2fc-7e17-4eac-b3ca-e5e2810ab89d", "comment": "Malware payload", "value": "7d1ee456c709d49eddc0fac808c549a268b6f664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704138118, "uuid": "08daba24-72af-4ce8-95b4-63ac2f35903c", "comment": "Malware payload", "value": "35d4d1453148c6ade11c6ddb1d5f93c88b57bccf83bbbf2329bdff178d907292b098bdc7f3948bddadb3d3228267060e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704138118, "uuid": "0f6b48e5-60cc-4545-9855-11b373918ac9", "value": "T16E16E8C4FB66B122C357B33BE382121A41A081902F87A35B21BA5B5C1FDD6497DDF99C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704138118, "uuid": "2fc32cf7-0e0c-41d7-8fd0-fd61bf8ba533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704138118, "uuid": "c0bc2fdc-a6f4-4e81-bc4e-60f576e11a93", "value": "24576:o5bfqnwgTw5BiBG9Vg9FWtu5KvyjM8K3UYCZavwRf7N24Gc7Viefe5GknwFWga0:KfZvcaFC48DN24Gc7Viefe5Gk8Wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704138118, "uuid": "311a6a88-743e-407f-9542-e2f0488e1a37", "value": 4085760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704138118, "uuid": "e7a46675-587c-4a18-9855-590c29f805ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704138118, "uuid": "8a04e7da-6ec8-4266-8f95-4c77fa89b413", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9d4b11-a8be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704124467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124467, "uuid": "86cd5d28-0972-4374-ad26-6314f6799f10", "comment": "Malware payload (Mirai)", "value": "2b0a86323543e46ced2f581b284e271b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124467, "uuid": "d5d4777b-bfa8-4bd6-84cf-1d687ebfa029", "comment": "Malware payload (Mirai)", "value": "e699742af836bb610770228029c459b01e85d42fd01dc8a301eb4d9cae9792c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124467, "uuid": "a53e39bc-a4ac-49e9-8891-09c8ff2e8856", "comment": "Malware payload (Mirai)", "value": "dfd1ac9042f188b7c0daa1e53cd493fce18cf78c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124467, "uuid": "9f0345d6-3be7-4740-91a6-e8ccde636c48", "comment": "Malware payload (Mirai)", "value": "750b45cbaa2250fa8ccb74b490b1e92c5ac5d0869947abbad6dfcb2eb04cf58c26c8d57df9994fd3e9b51ab60ca2e9ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124467, "uuid": "d1d7c83b-864b-49cb-b8c5-8f048b04e6b7", "value": "T1F0E33A06B31C0B47D1632EF43E3F6BD093AF9AD121E8F644255FAA8A91B1D321586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124467, "uuid": "d46a64f9-289f-4304-a2b5-fee0997d1116", "value": "1536:hnRlzyzms/289yNxtQAeZxp+vHRKlp10KX42/ODzZr/VvAlWKrOueH8q9bS4FBZ7:8vG4JZxwfO7X1Yr6laFfXIDxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704124467, "uuid": "ae0ffcb5-6a08-4b16-a025-fc70851166f9", "value": 148412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704124467, "uuid": "dcaa9576-2c9b-403a-af46-34f6a1ef999e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124467, "uuid": "29d8601e-6445-4573-be77-b373d5e2cce8", "value": "2b0a86323543e46ced2f581b284e271b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a1726a-a8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704147819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704147819, "uuid": "56ecc2fd-a816-4b4d-b774-1c1fa75b5888", "comment": "Malware payload", "value": "2cfe96d2c172c597e95d31b2ae1d34d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704147819, "uuid": "1265ba12-be10-4de8-8ca5-1ee33c9fd1fa", "comment": "Malware payload", "value": "e840d96297d0a1260965678819666722e37401b84676656a8c6213b42d26dd9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704147819, "uuid": "df82c572-054b-49b0-8339-45c213743b83", "comment": "Malware payload", "value": "253d8057d08097342ea05be0b54215009e516873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704147819, "uuid": "23a0ee3a-2e96-460d-b3a3-85d6b770245b", "comment": "Malware payload", "value": "854aae739f05c31060682ee2adae2809280f416ad03951a296c2203186e11896fa48ded485e7013e5bc8770a2b4b731a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704147819, "uuid": "5883ba31-742e-46e9-964f-a3b42a29d8fc", "value": "T1E8D49E40F5CF9A32D48708734FFAA6722D676451071187FF5B657BB8AE600E04A7FA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704147819, "uuid": "f6f448e1-c2b0-4d81-ba22-39991d43eaab", "value": "e752126f7ead8b7c9b1a7360355346dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704147819, "uuid": "77283140-308d-4c33-8d29-ba528bb48af7", "value": "12288:Dj8XVkM2UI5z/QhAFa8oFfTOwA+jUtpQUD64vJj:DjSkh7FjDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704147819, "uuid": "ff7f6bd6-d37f-429f-a5f4-312f87b1b9da", "value": 614257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704147819, "uuid": "6bf669e0-6284-46b5-84ca-bf4c5b22f5e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704147819, "uuid": "39e75292-a220-4652-bad6-67d52e2c998a", "value": "Shxdow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fb5b97-a8be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704124477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124477, "uuid": "7077f5e5-cc90-4e89-90ef-32d83c260c2d", "comment": "Malware payload (Mirai)", "value": "fa958a5584659b344433ea48986f475d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124477, "uuid": "13a6ad09-84d6-4390-a76b-05884aec9175", "comment": "Malware payload (Mirai)", "value": "e890b4ece8be8eca2c075ef2856debc3be97e33c251e866e52c12f8ac45feddd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124477, "uuid": "f0a9306d-78e1-47ec-bc4f-029cc9b2e39f", "comment": "Malware payload (Mirai)", "value": "736e7684a4397ca5d7c32bfb350e4afb99f2bae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704124477, "uuid": "ca00dac8-8d62-4de5-ba6c-343ee7878429", "comment": "Malware payload (Mirai)", "value": "8ca4997285a1cbda1083a0bd939864f268ea307b8d0e2f57677e0fbb726f79ce156cde5a5f6edad43a7f1b8a1ba46abf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124477, "uuid": "df031506-e72d-49b7-81ea-383b688d929b", "value": "T175F34AC7F800DEBAF40AF33A48534925B130B7D211825F376297797BEC3A1995927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124477, "uuid": "4ce880eb-1b6a-4ab1-a4ed-7376a46e0d5c", "value": "3072:DbabZyexyDJfFh5tiqazHIlSIb3OSpTJJHIVrjbisLg4+dQyHkgVhPj:naQDPh5xgIb+S7JHILg4NyHrHPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704124477, "uuid": "e8faca7d-a8f6-486d-a31f-62b3781bd3bc", "value": 166272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704124477, "uuid": "293a1b56-7388-4fa0-9c06-7d56e7beef44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704124477, "uuid": "b8d390d6-a9ad-49d5-81f4-6c321ad6ed30", "value": "fa958a5584659b344433ea48986f475d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fa8579-a8f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704150074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704150074, "uuid": "777cafdc-d777-4858-8a5b-9668a533aa4a", "comment": "Malware payload", "value": "8d489ce6d367445a66741f6feedd7f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704150074, "uuid": "42e80957-288d-42e4-bc6c-d4cc7b6c8621", "comment": "Malware payload", "value": "eae6712c11dd6f02554e9670d81d55426c6c0590480ae08c281edc596615ea30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704150074, "uuid": "293291ab-36c0-403c-888a-dd0f343bb331", "comment": "Malware payload", "value": "c5e5ab029b8fb5c6a851db272d20f661604e3968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704150074, "uuid": "0284a84f-c28e-44bf-b987-f99bcacd168f", "comment": "Malware payload", "value": "0ed9eac36fb698ada0e7abf841051c8c6c53ed3b1721c0379ff882ae1b8bf4b6f60238d829065f4aa8b19b421b18614f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704150074, "uuid": "ecfed75f-015b-4813-b070-47153d0f2446", "value": "T166A5D022A3D38BB2C43739BABC3681306561BE116B2C26C15FE0C76D5F61DA127E9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704150074, "uuid": "62b9ca4f-a0dd-4a2e-b247-edd18c195dff", "value": "cef7175a80dc1e44efb0a2271953c6b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704150074, "uuid": "1205126f-a99d-4ab5-abdb-6143a9942208", "value": "49152:iUczy99w4YA7YiIAbgzwi0ZZJxQG+0ABa:iUczyCwRDVJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704150074, "uuid": "d0c21763-645f-405f-b854-2ae3e07e1c59", "value": 2131968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704150074, "uuid": "210753f6-240a-4290-87dd-289f44b0d636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704150074, "uuid": "30cfc4f0-ea50-43e2-849d-309b61a7d914", "value": "crypted.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab15681-a8cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704130560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704130560, "uuid": "4b9bcaab-425d-402a-95b9-0304df7f1613", "comment": "Malware payload", "value": "3c799c89f34236bed176b8510e151a2c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704130560, "uuid": "9ca791fa-551e-4ea1-a5b4-75bcbd9ba444", "comment": "Malware payload", "value": "ed8ae31d0f5a4e5b6cc7a02b43680dbfcafa4589c9fc4315a1eb63e15f1ec21f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704130560, "uuid": "5623facd-5e10-41a9-ac0e-906c294d48d4", "comment": "Malware payload", "value": "3385943b967149bd94614fec8a2bc0745e5d443b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704130560, "uuid": "c4119712-2528-4d30-b998-9f235eeb56f6", "comment": "Malware payload", "value": "d65686ac6b88926eea748b81a30f685dfbc843286c70d8ade4e4bcb75f4715552fab858ffbf4de18b1d3700b94aa14b6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704130560, "uuid": "e2b5121e-003f-49f4-93e1-930b2858e127", "value": "T1284701427BA2C67BF892F6B5C05A024AF324C4F2B300D713356EC4AA6F57664BD619DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704130560, "uuid": "635877f2-e29c-4f29-a9c3-54775d615c2d", "value": "393216:T1Z6W+P1dt4KPGXKBhyYLPHDSV7HsYGkexXh5AZcWbMpm9KmxAKwgxaZxvWnz:hT6OXK1PDSVYPR5AiW/smxzw3Zxviz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704130560, "uuid": "6ee8ef9b-decc-4f74-a6a0-dacf24290a15", "value": 26969709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704130560, "uuid": "ad2f4338-b355-4d0b-b39b-df1efa787d68", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704130560, "uuid": "47fff765-b95a-473e-8ecf-46175e227ed9", "value": "RBLXFPSUnlockler (3).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a34ea3f-a8a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113406, "uuid": "f345db4a-68b1-48eb-842a-7076ec722407", "comment": "Malware payload (Mirai)", "value": "9358e193ba41ffb48b46877f6ab16ff6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113406, "uuid": "82451165-2449-41f5-b672-87ffb66d845e", "comment": "Malware payload (Mirai)", "value": "f18a5e6ac36d4f935acb04fd40d9478926188599b076422dc3cea95bbaff699a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113406, "uuid": "9a1ded83-e372-49f7-b584-ae2d7154cbb7", "comment": "Malware payload (Mirai)", "value": "daa6ca8067b454559e3a7b86de6a03129773ffb7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113406, "uuid": "a77a23ac-ef1c-480d-8fc7-6fc8d004f15e", "comment": "Malware payload (Mirai)", "value": "be5c9b8146dd49b4d80abc966f84c15c1c04bed13e6e84fd27d27199094c0301bfa5d0c8ccd4eeb275817d0a107c04ed", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113406, "uuid": "522ed4be-6eda-4e40-affa-5dff1f4268ac", "value": "T105F34C46EA408B13C4D6177AFA9F424933239B64D3EB73069918BFF43F4669E0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113406, "uuid": "bf84ef3e-925f-461f-ab81-ca5d20031cae", "value": "3072:ons+uZ6csfF6qXv9d8JKOalHPb4s06mEaQKM9N+hncASM/9FSg:L+uAcsMyFd8gOalHPb4snmvJhnc5M/9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113406, "uuid": "cef27b7d-3840-4bec-ae07-5c21983508c2", "value": 161821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113406, "uuid": "99d20d12-6c2e-4269-be30-716126dab25b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113406, "uuid": "fd99c978-ea8d-4daf-af51-2e4817a4b5cf", "value": "arm7-20240101-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1071086-a8b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704121820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121820, "uuid": "2c3192b8-2b92-44cc-a790-31f1215a0531", "comment": "Malware payload (Mirai)", "value": "53dec94bed6f943b6a4862fa79bff6de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121820, "uuid": "79ed956f-8ff1-45a5-af99-cb46b51d794d", "comment": "Malware payload (Mirai)", "value": "f48bbc1c6f45c1a298bcda3c89c786ad97de498100f83b773c5f176233a40e5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121820, "uuid": "84094c6b-701d-4ba8-943f-fab660b52175", "comment": "Malware payload (Mirai)", "value": "324708d872a11a88e5d593afca3110a3ec388318", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704121820, "uuid": "7ea2eb56-4d82-4248-960c-a09e5fd57a4f", "comment": "Malware payload (Mirai)", "value": "341c8007493990cf840227e67ac6ac4cf13f0a322c44483583161fc2d9cd280165a12f7de4a1a6372650ec436142eefc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121820, "uuid": "414e6bc5-0fdc-42dc-98be-ca90a0c6b5de", "value": "T109E31945FC505A23C6D312BBFB5E428D372A17E9D3EE720399211F65378A85B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121820, "uuid": "530c2e4c-ecee-422a-a65a-85bc41ec62a6", "value": "3072:2Emyz6OOKMT1Fjo47jhsMqmJEXWNHcVXIq:2Ez6oMplo47tsMqpWNHcV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704121820, "uuid": "100b0b65-66a4-49cc-93ce-6c7c86ff13bc", "value": 148288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704121820, "uuid": "39b1fd05-7be3-45ef-8180-62d8253c2d43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704121820, "uuid": "b50f76da-8734-42fd-b604-3291fcbcd5c8", "value": "skyljne.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a07181-a8d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704135008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135008, "uuid": "09d9e668-70ca-460c-95e1-41e78fb47e3c", "comment": "Malware payload", "value": "ebf9bc7a5cffb03b67965b2ffe8030b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135008, "uuid": "8a0f5cd8-33ef-41c0-84a2-b584801cf379", "comment": "Malware payload", "value": "f4d1273f3ca99910603f01559cc2491ff37738bb6b6b21034ea856db14a09b90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135008, "uuid": "cac002ed-fcc3-4f51-87f2-266c18789bc1", "comment": "Malware payload", "value": "235cb2801f75621e09fc31d4634c339ea582a0dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704135008, "uuid": "83cab4da-77f9-452d-bc2a-71855dd1cbb8", "comment": "Malware payload", "value": "f3cc0dd251312a94baa97e7daa2f3991bbe1701c9c88ac845fb49fde4864c76c5923ff97c09573ccc8c8fb337ccdbc3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135008, "uuid": "ff8fefb1-24e2-4435-89ef-7147130a3cf4", "value": "T166E2F283C101887229341DF3FFEDD04C82229BA54C5DB2395A1A4541BEEF5D7AA3FAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135008, "uuid": "182804b5-3d88-4cda-ba43-675249d1969a", "value": "768:bLuUw1npveHnEjoJSDLoKC94HzXjeNb/7up5+9kx3Ux:HgpvKnuQKCeHDjc/k3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704135008, "uuid": "d362295a-e300-4f13-9730-daa1f3d94bed", "value": 31904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704135008, "uuid": "c4499c90-8c23-4f41-aa2d-80612a432470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704135008, "uuid": "791e8ff9-2724-44ac-a814-c0d0f22fc6a6", "value": "h0r0zx00x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be51132e-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131210, "uuid": "cc3a1e55-25f0-4b0a-bb16-018300a1a236", "comment": "Malware payload", "value": "21765d5c5a6f02096c257efb4bf990d7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131210, "uuid": "8a483cf1-eaa9-41b3-bc08-4cbdcdef9095", "comment": "Malware payload", "value": "f58ad4337612da61eb8872c59cf8c5a7c6ccbc36872284ff69ba053809d4195d", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131210, "uuid": "06e42c18-e666-40ee-a573-13b59db53d83", "comment": "Malware payload", "value": "7e4befa7382a809abaf57e1ae3b09d97b6743208", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131210, "uuid": "12e0c1bf-2f88-41bb-b0d3-5e443788b323", "comment": "Malware payload", "value": "1199f650f65c02587cc4a920d529c6022c200be34cba70e732a390164c50029a05b209c48118bd051f6e1a694d05b255", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131210, "uuid": "010560a2-466d-4b7f-8a2e-52df70b1f50a", "value": "T1C425CF0161B05B09E4FA97FD0E49119C93B2AD1631EAD726CDC3A4DE643CBCA4DC2AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131210, "uuid": "45754f9d-49e7-43d7-b0f4-c6fc4ac63b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131210, "uuid": "add563c6-8c3a-4f38-8648-301b58d0186d", "value": "12288:0wqGYdyxZJF4iLT3P7mrMonHnmhwfc76vRZOTV2HbV11OToWnTuToV:0woyZdPC/HnaoRkTV270TNTuTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131210, "uuid": "a9b732a8-021b-4f74-8fcc-a744a21f75f3", "value": 1022688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131210, "uuid": "db1780a3-e5f9-4375-b8ab-93d0edde7cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131210, "uuid": "44f8a58e-b8b5-4a52-bd5c-4324c508c9cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309c966d-a84a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704074709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704074709, "uuid": "29339d55-d769-4190-9d78-69ce5224b69b", "comment": "Malware payload (DCRat)", "value": "181173ad7c15eb5691d550b1add91036", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704074709, "uuid": "d90b9d52-7902-4018-bbf5-96c35dd8608c", "comment": "Malware payload (DCRat)", "value": "f7873b3d8b8f6cf252b37ad3ee8a57b1754b82acc1d0840184af4ce4c237a0db", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704074709, "uuid": "5c8435e2-a63e-4fae-ae24-1034b50beb31", "comment": "Malware payload (DCRat)", "value": "abcf6126173292aa3c4f077c739b7cd8c97b8128", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704074709, "uuid": "2583eb42-b577-4299-b827-accdcc78f1c7", "comment": "Malware payload (DCRat)", "value": "351d51677fb053a6d57504262f9a2d2ece21341cd2bcaf579ce484c74f105bcdb04326315351fa5b15a42803f877dbe5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704074709, "uuid": "5ab465e5-5e7e-4991-8cfe-6e9cd4d74e4b", "value": "T12AA5CF467E84CE81F0191673C1EF420447B4ED516AA6E72BBEAA337E15123977C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704074709, "uuid": "cf48e37d-cc9b-469c-b152-e829bc887930", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704074709, "uuid": "8204795c-fe8b-47f8-8a8e-c4665ce2a337", "value": "49152:2lHPy2tVhndTobZzxb0aAJ/ubQmowkA/lk:2lHPyU6br47ubQpwkA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704074709, "uuid": "5145b3af-8c3d-4810-b5b4-f26fa50dd62c", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704074709, "uuid": "6b7dfc63-fe20-4581-8b68-8e67c8d5c93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704074709, "uuid": "628d7b9e-c7e9-4c3b-87ae-7de46685985e", "value": "181173ad7c15eb5691d550b1add91036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c6c356-a87e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1704097162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097162, "uuid": "f2da442e-63f2-460c-9496-4e4d4e4246df", "comment": "Malware payload (XWorm)", "value": "cf9c7f40bf7ce222effbb870511b8c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097162, "uuid": "113c5e75-0671-41cc-ae6b-9240ef67fd7d", "comment": "Malware payload (XWorm)", "value": "f9125f4046df87ddb95b4dd8d32d603850b200c5e72302157ec364b6afbd4048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097162, "uuid": "ccb60a51-775b-4df3-a148-e4461baf2621", "comment": "Malware payload (XWorm)", "value": "73f43ec34dced0c9f69c43a006d6281cab8832a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704097162, "uuid": "d5a29699-4318-40f9-86bb-d4fc7164f199", "comment": "Malware payload (XWorm)", "value": "491aad653d10b2bcdc11f4b1045acdbe77b6ca7bdd250d933ebf4df9c8dc514759e7cba8b244dbd21d2bede1c62af5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097162, "uuid": "3157c9fa-814b-4e48-9f26-3c735ea5d234", "value": "T16C149E7335C08827FCB52E3AE4789E789D7CF5A32B96CDC73248166E4A2469069357C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097162, "uuid": "1c9bb62f-5184-4766-82c7-f7d8720bd4f6", "value": "2bf02ea082879bce481035eda6b0e50b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097162, "uuid": "b40165df-a91e-414b-a35b-d94fd9cbdf7e", "value": "3072:76vxcH7p53GC6rypQo1S66WKXhFiF38pZzdPy/bwtwCSrJWb8e2nsNwOt0H:2JcbptGtryBCjwbwOW4VsNwOtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704097162, "uuid": "50e63bc6-d4fe-4b70-ac9f-a15a93648577", "value": 199505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704097162, "uuid": "8cc69599-1af8-4394-9cba-cefb824aa384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704097162, "uuid": "c189e68b-bb13-46ba-ae3b-5a897340a2d7", "value": "cf9c7f40bf7ce222effbb870511b8c38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491c5a06-a8a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704113404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113404, "uuid": "8c5cea48-3651-43c7-9d6b-62b9366fc9b3", "comment": "Malware payload (Mirai)", "value": "eba2f8c0a092cccea8ddcec492c0b2c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113404, "uuid": "174aaf0a-0223-45c8-9d60-a611f5b7ffc5", "comment": "Malware payload (Mirai)", "value": "fb32444e8e73bf5c8b9f41dbba7bff0bdfc5a9d8ef9abdc71ed93dd3b8210fcb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113404, "uuid": "3a6fb51c-fcb4-4437-bfc6-937cf971e95c", "comment": "Malware payload (Mirai)", "value": "d391c8f54d860ce9c58762f962365bc67f7d82f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704113404, "uuid": "19bfeca3-f0b7-4713-82b4-85e2dc6acd47", "comment": "Malware payload (Mirai)", "value": "6ef3e695977ea0830e9d256592f7f64affd622c8c6c4c45d3ae8e891cdcfb966cbb558ef709af991621b7875015e1d7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113404, "uuid": "fbbc3fff-9e3b-4a19-9717-3a9c14b7a75e", "value": "T1E0633BC19943E8F1EC0656711ABBEB335732E5751025FA86E794E932BD43B02B60B2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113404, "uuid": "5bfb3a2c-596a-427d-8d09-7b932480c914", "value": "1536:7Or6GOIeHFzfaVPzy1h0EAlJT+YqO5MC2nOZpCsFSHQRh:7OmRIeHFDuby70EAlJKnmD2OZ0sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704113404, "uuid": "d151acb4-e998-40bc-bac6-e8fc18a447da", "value": 67932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704113404, "uuid": "ba8c3520-19a8-4b2f-8c9c-502712e5b882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704113404, "uuid": "4a712c40-e31d-4b19-ab54-023d866be214", "value": "x86-20240101-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63994b7d-a88f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704104429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104429, "uuid": "2754f264-bfb2-4a32-aea6-5da60813b824", "comment": "Malware payload (AgentTesla)", "value": "d0bc3ddecbb4fe7747520077f67f6bed", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104429, "uuid": "b1bd030a-7d6c-47f9-a464-8f0647ddc4f4", "comment": "Malware payload (AgentTesla)", "value": "fd6c101d8e29f6aca22602b377b7f30ab3c409334227e586f80e39716b060f6e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104429, "uuid": "5954c0d9-34e0-4e8f-b41c-fe0392a1cc53", "comment": "Malware payload (AgentTesla)", "value": "eef52466615baa79503dd09c7f9021a4249b57e1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704104429, "uuid": "d9a19a1c-4c9c-4898-b1ea-038f17d27b86", "comment": "Malware payload (AgentTesla)", "value": "54a27b8396682dd2ec5dee04bc13b011fa19e6e0674e610065c76f3383596d446b5281eba2e90d46cb16fb1b0edb1388", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704104429, "uuid": "8bec65cd-5a70-40a1-9bf8-5ecfb310a89f", "value": "T1E0C4235B95A49F7036CB25255459E0C1DB8901881C4675BEA6F3F13CFAC39A33EE02BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704104429, "uuid": "3078f54a-c49b-40e5-8f72-40cbd81d2938", "value": "12288:vFqAlBWleKI4WoJyVYx29ResHBM/XbvqbmnsTq244y6qitNcxBkZ7rQ0:vUAhKIgJBxYRJHOvbqbC286qjxs00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704104429, "uuid": "187e54e1-f570-4d91-b9a7-7f25033aad07", "value": 592799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704104429, "uuid": "d4fd3bf5-eb76-4b5b-a155-8cc5562393bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704104429, "uuid": "e79345a7-ebae-46a1-94ad-790d3b8262eb", "value": "SWIFT310120830H61984.PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c9d539-a8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704131189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131189, "uuid": "fbe73b37-91f9-481e-9688-144e28eeb9fb", "comment": "Malware payload", "value": "c3216405556183fc45e98cd744826a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131189, "uuid": "cc115683-e155-49e8-9b4c-3be92772f3d6", "comment": "Malware payload", "value": "ffa977ca7c7f3939fa6b2ac86dfb4cf4585b0cca2ce311943653fda5ba19b617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131189, "uuid": "9cab8c96-6715-41f5-a557-4af9acd441b6", "comment": "Malware payload", "value": "604f5c421a462045024141eb8c7cfe39230dcbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704131189, "uuid": "929e0188-eb48-419e-9512-51ede6b9159d", "comment": "Malware payload", "value": "5aaaef297ba3e3e4d7c70970c9144a0e14d4ce00bf4ea295e94ddaa3e3dd593c8cdf9b041dceb8c13d85f6ffdaf15e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131189, "uuid": "15daf787-6b6f-4add-9f49-fcd2902fdc07", "value": "T1ABE423D161BE61E8CBA7497B50E5383764B2B9BF0617E1BC5A54F0F598B23320B04BC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131189, "uuid": "f12d40b1-deaa-491a-86ec-1e369cb52950", "value": "26b8d976d96d16995492f63ab9fc0efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131189, "uuid": "bdc9ea6e-af9d-458e-839c-d248d10c046a", "value": "12288:y8xvAWQ9+PStHyCKkcE0fifb5ElnaDIKGnhoo2in+1BXt7aiO1jqjljgyc:xfQC0HjcziT5ElnaDItaDLB5d5lxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704131189, "uuid": "74a086f8-3ad1-4f73-a74a-2d718a115ed8", "value": 694496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704131189, "uuid": "b2ff2dab-e9c9-4cc1-a349-9aa5086df77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704131189, "uuid": "76a7a2c6-ebb6-4a57-8797-dc680b5852b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }